Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next

[ipfire-2.x.git] / html / cgi-bin / vpnmain.cgi

diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi
index 26f6f5311dbf96346f454e7f873c0c9e9cbc4d49..b25cb6ade2e7e277a83794f8d7f80459a00817ef 100644 (file)
--- a/html/cgi-bin/vpnmain.cgi
+++ b/html/cgi-bin/vpnmain.cgi
@@ -435,6 +435,10 @@ sub writeipsecfiles {
        } else {
            print CONF "\tauto=start\n";
        }
+
+       # Fragmentation
+       print CONF "\tfragmentation=yes\n";
+
        print CONF "\n";
     }#foreach key
     print SECRETS $last_secrets if ($last_secrets);
@@ -961,9 +965,9 @@ END
        if (!$errormessage) {
            &General::log("ipsec", "Creating cacert...");
            if (open(STDIN, "-|")) {
-               my $opt  = " req -x509 -nodes -rand /proc/interrupts:/proc/net/rt_cache";
+               my $opt  = " req -x509 -sha256 -nodes";
                   $opt .= " -days 999999";
-                  $opt .= " -newkey rsa:2048";
+                  $opt .= " -newkey rsa:4096";
                   $opt .= " -keyout ${General::swroot}/private/cakey.pem";
                   $opt .= " -out ${General::swroot}/ca/cacert.pem";
 
@@ -984,8 +988,8 @@ END
        if (!$errormessage) {
            &General::log("ipsec", "Creating host cert...");
            if (open(STDIN, "-|")) {
-               my $opt  = " req -nodes -rand /proc/interrupts:/proc/net/rt_cache";
-                  $opt .= " -newkey rsa:1024";
+               my $opt  = " req -sha256 -nodes";
+                  $opt .= " -newkey rsa:2048";
                   $opt .= " -keyout ${General::swroot}/certs/hostkey.pem";
                   $opt .= " -out ${General::swroot}/certs/hostreq.pem";
                $errormessage = &callssl ($opt);
@@ -1020,7 +1024,7 @@ END
            print $fh "subjectAltName=$cgiparams{'SUBJECTALTNAME'}" if ($cgiparams{'SUBJECTALTNAME'});
            close ($fh);
            
-           my  $opt  = " ca -days 999999";
+           my  $opt  = " ca -md sha256 -days 999999";
                $opt .= " -batch -notext";
                $opt .= " -in ${General::swroot}/certs/hostreq.pem";
                $opt .= " -out ${General::swroot}/certs/hostcert.pem";
@@ -1443,7 +1447,7 @@ END
 
            # Sign the certificate request
            &General::log("ipsec", "Signing your cert $cgiparams{'NAME'}...");
-           my  $opt  = " ca -days 999999";
+           my  $opt  = " ca -md sha256 -days 999999";
                $opt .= " -batch -notext";
                $opt .= " -in $filename";
                $opt .= " -out ${General::swroot}/certs/$cgiparams{'NAME'}cert.pem";
@@ -1673,12 +1677,12 @@ END
            (my $city = $cgiparams{'CERT_CITY'}) =~ s/^\s*$/\./;
            (my $state = $cgiparams{'CERT_STATE'}) =~ s/^\s*$/\./;
 
-           # Create the Host certificate request
+           # Create the Client certificate request
            &General::log("ipsec", "Creating a cert...");
 
            if (open(STDIN, "-|")) {
                my $opt  = " req -nodes -rand /proc/interrupts:/proc/net/rt_cache";
-                  $opt .= " -newkey rsa:1024";
+                  $opt .= " -newkey rsa:2048";
                   $opt .= " -keyout ${General::swroot}/certs/$cgiparams{'NAME'}key.pem";
                   $opt .= " -out ${General::swroot}/certs/$cgiparams{'NAME'}req.pem";
 
@@ -1700,7 +1704,7 @@ END
                exit (0);
            }
            
-           # Sign the host certificate request
+           # Sign the client certificate request
            &General::log("ipsec", "Signing the cert $cgiparams{'NAME'}...");
 
            #No easy way for specifying the contain of subjectAltName without writing a config file...
@@ -1709,13 +1713,14 @@ END
            basicConstraints=CA:FALSE
            nsComment="OpenSSL Generated Certificate"
            subjectKeyIdentifier=hash
+           extendedKeyUsage=clientAuth
            authorityKeyIdentifier=keyid,issuer:always
 END
 ;
            print $fh "subjectAltName=$cgiparams{'SUBJECTALTNAME'}" if ($cgiparams{'SUBJECTALTNAME'});
            close ($fh);
 
-           my $opt  = " ca -days 999999 -batch -notext";
+           my $opt  = " ca -md sha256 -days 999999 -batch -notext";
               $opt .= " -in ${General::swroot}/certs/$cgiparams{'NAME'}req.pem";
               $opt .= " -out ${General::swroot}/certs/$cgiparams{'NAME'}cert.pem";
               $opt .= " -extfile $v3extname";
@@ -2148,7 +2153,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
            goto ADVANCED_ERROR;
        }
        foreach my $val (@temp) {
-           if ($val !~ /^(sha2_512|sha2_384|sha2_256|sha|md5|aesxcbc)$/) {
+           if ($val !~ /^(sha2_(512|384|256)|sha|md5|aesxcbc)$/) {
                $errormessage = $Lang::tr{'invalid input'};
                goto ADVANCED_ERROR;
            }
@@ -2189,7 +2194,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
            goto ADVANCED_ERROR;
        }
        foreach my $val (@temp) {
-           if ($val !~ /^(sha2_512|sha2_384|sha2_256|sha1|md5|aesxcbc)$/) {
+           if ($val !~ /^(sha2_(512|384|256)|sha1|md5|aesxcbc)$/) {
                $errormessage = $Lang::tr{'invalid input'};
                goto ADVANCED_ERROR;
            }