vpnmain.cgi: Fix extra whitespace in exported pk12 file

[ipfire-2.x.git] / html / cgi-bin / vpnmain.cgi

diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi
index 805738288d1632af59913766674be85a42fd7db6..fb0af104f8d4071d1af55d021a79656fe810d3b3 100644 (file)
--- a/html/cgi-bin/vpnmain.cgi
+++ b/html/cgi-bin/vpnmain.cgi
@@ -208,10 +208,12 @@ sub newcleanssldatabase {
                close FILE;
        }
        if (! -s ">${General::swroot}/certs/index.txt") {
-               &General::system("touch", "${General::swroot}/certs/index.txt");
+               open(FILE, ">${General::swroot}/certs/index.txt");
+               close(FILE);
        }
        if (! -s ">${General::swroot}/certs/index.txt.attr") {
-               &General::system("touch", "${General::swroot}/certs/index.txt.attr");
+               open(FILE, ">${General::swroot}/certs/index.txt.attr");
+               close(FILE);
        }
        unlink ("${General::swroot}/certs/index.txt.old");
        unlink ("${General::swroot}/certs/index.txt.attr.old");
@@ -595,7 +597,7 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cg
        }
        &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
        &writeipsecfiles();
-       system('/usr/local/bin/ipsecctrl', 'R');
+       &General::system('/usr/local/bin/ipsecctrl', 'R');
        sleep $sleepDelay;
 
 ###
@@ -673,8 +675,7 @@ END
                unlink ($filename);
                goto UPLOADCA_ERROR;
        } else {
-               move($filename, "${General::swroot}/ca/$cgiparams{'CA_NAME'}cert.pem");
-               if ($? ne 0) {
+               unless(move($filename, "${General::swroot}/ca/$cgiparams{'CA_NAME'}cert.pem")) {
                        $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
                        unlink ($filename);
                        goto UPLOADCA_ERROR;
@@ -686,7 +687,7 @@ END
        $cahash{$key}[1] = &Header::cleanhtml(getsubjectfromcert ("${General::swroot}/ca/$cgiparams{'CA_NAME'}cert.pem"));
        &General::writehasharray("${General::swroot}/vpn/caconfig", \%cahash);
 
-       system('/usr/local/bin/ipsecctrl', 'R');
+       &General::system('/usr/local/bin/ipsecctrl', 'R');
        sleep $sleepDelay;
 
        UPLOADCA_ERROR:
@@ -702,8 +703,8 @@ END
                &Header::openpage($Lang::tr{'ipsec'}, 1, '');
                &Header::openbigbox('100%', 'left', '', '');
                &Header::openbox('100%', 'left', "$Lang::tr{'ca certificate'}:");
-               my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
-               $output = &Header::cleanhtml($output,"y");
+               my @output = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
+               my $output = &Header::cleanhtml(join("", @output) ,"y");
                print "<pre>$output</pre>\n";
                &Header::closebox();
                print "<div align='center'><a href='/cgi-bin/vpnmain.cgi'>$Lang::tr{'back'}</a></div>";
@@ -724,7 +725,9 @@ END
                print "Content-Type: application/force-download\n";
                print "Content-Type: application/octet-stream\r\n";
                print "Content-Disposition: attachment; filename=$cahash{$cgiparams{'KEY'}}[0]cert.pem\r\n\r\n";
-               print `/usr/bin/openssl x509 -in ${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
+
+               my @cert = &General::system_output("/usr/bin/openssl", "x509", "-in", "${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
+               print "@cert";
                exit(0);
        } else {
                $errormessage = $Lang::tr{'invalid key'};
@@ -739,21 +742,21 @@ END
 
        if ( -f "${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
                foreach my $key (keys %confighash) {
-                       my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/certs/$confighash{$key}[1]cert.pem`;
-                       if ($test =~ /: OK/) {
+                       my @test = &General::system_output("/usr/bin/openssl", "verify", "-CAfile", "${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem", "${General::swroot}/certs/$confighash{$key}[1]cert.pem");
+                       if (grep(/: OK/, @test)) {
                                # Delete connection
                                unlink ("${General::swroot}/certs/$confighash{$key}[1]cert.pem");
                                unlink ("${General::swroot}/certs/$confighash{$key}[1].p12");
                                delete $confighash{$key};
                                &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
                                &writeipsecfiles();
-                               system('/usr/local/bin/ipsecctrl', 'D', $key) if (&vpnenabled);
+                               &General::system('/usr/local/bin/ipsecctrl', 'D', $key) if (&vpnenabled);
                        }
                }
                unlink ("${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
                delete $cahash{$cgiparams{'KEY'}};
                &General::writehasharray("${General::swroot}/vpn/caconfig", \%cahash);
-               system('/usr/local/bin/ipsecctrl', 'R');
+               &General::system('/usr/local/bin/ipsecctrl', 'R');
                sleep $sleepDelay;
        } else {
                $errormessage = $Lang::tr{'invalid key'};
@@ -768,8 +771,8 @@ END
        my $assignedcerts = 0;
        if ( -f "${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
                foreach my $key (keys %confighash) {
-                       my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/certs/$confighash{$key}[1]cert.pem`;
-                       if ($test =~ /: OK/) {
+                       my @test = &General::system_output("/usr/bin/openssl", "verify", "-CAfile", "${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem", "${General::swroot}/certs/$confighash{$key}[1]cert.pem");
+                       if (grep(/: OK/, @test)) {
                                $assignedcerts++;
                        }
                }
@@ -805,7 +808,7 @@ END
                        unlink ("${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
                        delete $cahash{$cgiparams{'KEY'}};
                        &General::writehasharray("${General::swroot}/vpn/caconfig", \%cahash);
-                       system('/usr/local/bin/ipsecctrl', 'R');
+                       &General::system('/usr/local/bin/ipsecctrl', 'R');
                        sleep $sleepDelay;
                }
        } else {
@@ -817,18 +820,18 @@ END
 ###
 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'} ||
        $cgiparams{'ACTION'} eq $Lang::tr{'show host certificate'}) {
-       my $output;
+       my @output;
        &Header::showhttpheaders();
        &Header::openpage($Lang::tr{'ipsec'}, 1, '');
        &Header::openbigbox('100%', 'left', '', '');
        if ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'}) {
                &Header::openbox('100%', 'left', "$Lang::tr{'root certificate'}:");
-               $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ca/cacert.pem`;
+               @output = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ca/cacert.pem");
        } else {
                &Header::openbox('100%', 'left', "$Lang::tr{'host certificate'}:");
-               $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/certs/hostcert.pem`;
+               @output = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/certs/hostcert.pem");
        }
-       $output = &Header::cleanhtml($output,"y");
+       my $output = &Header::cleanhtml(join("", @output) ,"y");
        print "<pre>$output</pre>\n";
        &Header::closebox();
        print "<div align='center'><a href='/cgi-bin/vpnmain.cgi'>$Lang::tr{'back'}</a></div>";
@@ -843,7 +846,9 @@ END
        if ( -f "${General::swroot}/ca/cacert.pem" ) {
                print "Content-Type: application/force-download\n";
                print "Content-Disposition: attachment; filename=cacert.pem\r\n\r\n";
-               print `/usr/bin/openssl x509 -in ${General::swroot}/ca/cacert.pem`;
+
+               my @cert = &General::system_output("/usr/bin/openssl", "x509", "-in", "${General::swroot}/ca/cacert.pem");
+               print join("", @cert);
                exit(0);
        }
 ###
@@ -853,7 +858,9 @@ END
        if ( -f "${General::swroot}/certs/hostcert.pem" ) {
                print "Content-Type: application/force-download\n";
                print "Content-Disposition: attachment; filename=hostcert.pem\r\n\r\n";
-               print `/usr/bin/openssl x509 -in ${General::swroot}/certs/hostcert.pem`;
+
+               my @cert = &General::system_output("/usr/bin/openssl", "x509", "-in", "${General::swroot}/certs/hostcert.pem");
+               print join("", @cert);
                exit(0);
        }
 ###
@@ -939,20 +946,23 @@ END
 
                if (!$errormessage) {
                        &General::log("ipsec", "Moving cacert...");
-                       move("/tmp/newcacert", "${General::swroot}/ca/cacert.pem");
-                       $errormessage = "$Lang::tr{'certificate file move failed'}: $!" if ($? ne 0);
+                       unless(move("/tmp/newcacert", "${General::swroot}/ca/cacert.pem")) {
+                               $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
+                       }
                }
 
                if (!$errormessage) {
                        &General::log("ipsec", "Moving host cert...");
-                       move("/tmp/newhostcert", "${General::swroot}/certs/hostcert.pem");
-                       $errormessage = "$Lang::tr{'certificate file move failed'}: $!" if ($? ne 0);
+                       unless(move("/tmp/newhostcert", "${General::swroot}/certs/hostcert.pem")) {
+                               $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
+                       }
                }
 
                if (!$errormessage) {
                        &General::log("ipsec", "Moving private key...");
-                       move("/tmp/newhostkey", "${General::swroot}/certs/hostkey.pem");
-                       $errormessage = "$Lang::tr{'certificate file move failed'}: $!" if ($? ne 0);
+                       unless(move("/tmp/newhostkey", "${General::swroot}/certs/hostkey.pem")) {
+                               $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
+                       }
                }
 
                #cleanup temp files
@@ -1216,7 +1226,7 @@ END
 
        ROOTCERT_SUCCESS:
        if (&vpnenabled) {
-               system('/usr/local/bin/ipsecctrl', 'S');
+               &General::system('/usr/local/bin/ipsecctrl', 'S');
                sleep $sleepDelay;
        }
        ROOTCERT_SKIP:
@@ -1228,7 +1238,12 @@ END
        print "Content-Type: application/force-download\n";
        print "Content-Disposition: attachment; filename=" . $confighash{$cgiparams{'KEY'}}[1] . ".p12\r\n";
        print "Content-Type: application/octet-stream\r\n\r\n";
-       print `/bin/cat ${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1].p12`;
+
+       open(FILE, "${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
+       my @p12 = <FILE>;
+       close(FILE);
+       print join("", @p12);
+
        exit (0);
 
 # Export Apple profile to browser
@@ -1507,8 +1522,8 @@ END
                &Header::openpage($Lang::tr{'ipsec'}, 1, '');
                &Header::openbigbox('100%', 'left', '', '');
                &Header::openbox('100%', 'left', "$Lang::tr{'cert'}:");
-               my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
-               $output = &Header::cleanhtml($output,"y");
+               my @output = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
+               my $output = &Header::cleanhtml(join("", @output) ,"y");
                print "<pre>$output</pre>\n";
                &Header::closebox();
                print "<div align='center'><a href='/cgi-bin/vpnmain.cgi'>$Lang::tr{'back'}</a></div>";
@@ -1526,7 +1541,12 @@ END
        if ( -f "${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
                print "Content-Type: application/force-download\n";
                print "Content-Disposition: attachment; filename=" . $confighash{$cgiparams{'KEY'}}[1] . "cert.pem\n\n";
-               print `/bin/cat ${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
+
+               open(FILE, "${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
+               my @pem = <FILE>;
+               close(FILE);
+               print "@pem";
+
                exit (0);
        }
 
@@ -1543,12 +1563,12 @@ END
                        $confighash{$cgiparams{'KEY'}}[0] = 'on';
                        &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
                        &writeipsecfiles();
-                       system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'}) if (&vpnenabled);
+                       &General::system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'}) if (&vpnenabled);
                } else {
                        $confighash{$cgiparams{'KEY'}}[0] = 'off';
                        &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
                        &writeipsecfiles();
-                       system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'}) if (&vpnenabled);
+                       &General::system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'}) if (&vpnenabled);
                }
                sleep $sleepDelay;
        } else {
@@ -1564,7 +1584,7 @@ END
 
        if ($confighash{$cgiparams{'KEY'}}) {
                if (&vpnenabled) {
-                       system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
+                       &General::system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
                        sleep $sleepDelay;
                }
        } else {
@@ -1584,7 +1604,7 @@ END
                delete $confighash{$cgiparams{'KEY'}};
                &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
                &writeipsecfiles();
-               system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'}) if (&vpnenabled);
+               &General::system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'}) if (&vpnenabled);
        } else {
                $errormessage = $Lang::tr{'invalid key'};
        }
@@ -1952,8 +1972,8 @@ END
                                unshift (@names,$cahash{$x}[0]);
                        }
                        if ($casubject) { # a new one!
-                               my $temp = `/usr/bin/openssl x509 -text -in /tmp/newcacert`;
-                               if ($temp !~ /CA:TRUE/i) {
+                               my @temp = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "/tmp/newcacert");
+                               if (! grep(/CA:TRUE/, @temp)) {
                                        $errormessage = $Lang::tr{'not a valid ca certificate'};
                                } else {
                                        #compute a name for it
@@ -1961,22 +1981,26 @@ END
                                        while (grep(/Imported-$idx/, @names) ) {$idx++};
                                        $cgiparams{'CA_NAME'}="Imported-$idx";
                                        $cgiparams{'CERT_NAME'}=&Header::cleanhtml(getCNfromcert ('/tmp/newhostcert'));
-                                       move("/tmp/newcacert", "${General::swroot}/ca/$cgiparams{'CA_NAME'}cert.pem");
-                                       $errormessage = "$Lang::tr{'certificate file move failed'}: $!" if ($? ne 0);
+
+                                       unless(move("/tmp/newcacert", "${General::swroot}/ca/$cgiparams{'CA_NAME'}cert.pem")) {
+                                               $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
+                                       }
+
                                        if (!$errormessage) {
                                                my $key = &General::findhasharraykey (\%cahash);
                                                $cahash{$key}[0] = $cgiparams{'CA_NAME'};
                                                $cahash{$key}[1] = $casubject;
                                                &General::writehasharray("${General::swroot}/vpn/caconfig", \%cahash);
-                                               system('/usr/local/bin/ipsecctrl', 'R');
+                                               &General::system('/usr/local/bin/ipsecctrl', 'R');
                                        }
                                }
                        }
                }
                if (!$errormessage) {
                        &General::log("ipsec", "Moving host cert...");
-                       move("/tmp/newhostcert", "${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
-                       $errormessage = "$Lang::tr{'certificate file move failed'}: $!" if ($? ne 0);
+                       unless(move("/tmp/newhostcert", "${General::swroot}/certs/$cgiparams{'NAME'}cert.pem")) {
+                               $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
+                       }
                }
 
                #cleanup temp files
@@ -2008,12 +2032,12 @@ END
                # Verify the certificate has a valid CA and move it
                &General::log("ipsec", "Validating imported cert against our known CA...");
                my $validca = 1; #assume ok
-               my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ca/cacert.pem $filename`;
-               if ($test !~ /: OK/) {
+               my @test = &General::system_output("/usr/bin/openssl", "verify", "-CAfile", "${General::swroot}/ca/cacert.pem", "$filename");
+               if (! grep(/: OK/, @test)) {
                        my $validca = 0;
                        foreach my $key (keys %cahash) {
-                               $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ca/$cahash{$key}[0]cert.pem $filename`;
-                               if ($test =~ /: OK/) {
+                               @test = &General::system_output("/usr/bin/openssl", "verify", "-CAfile", "${General::swroot}/ca/$cahash{$key}[0]cert.pem", "$filename");
+                               if (grep(/: OK/, @test)) {
                                        $validca = 1;
                                        last;
                                }
@@ -2024,9 +2048,8 @@ END
                        unlink ($filename);
                        goto VPNCONF_ERROR;
                } else {
-                       move($filename, "${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
-                       if ($? ne 0) {
-                               $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
+                       unless (move($filename, "${General::swroot}/certs/$cgiparams{'NAME'}cert.pem")) {
+                               $errormessage = "$Lang::tr{'certificate file move failed'} ($filename): $!";
                                unlink ($filename);
                                goto VPNCONF_ERROR;
                        }
@@ -2276,7 +2299,7 @@ END
        &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
        &writeipsecfiles();
        if (&vpnenabled) {
-               system('/usr/local/bin/ipsecctrl', 'S', $key);
+               &General::system('/usr/local/bin/ipsecctrl', 'S', $key);
                sleep $sleepDelay;
        }
        if ($cgiparams{'EDIT_ADVANCED'} eq 'on') {
@@ -2337,11 +2360,11 @@ END
        #use default advanced value
        $cgiparams{'IKE_ENCRYPTION'}    = 'chacha20poly1305|aes256gcm128|aes256gcm96|aes256gcm64|aes256|aes192gcm128|aes192gcm96|aes192gcm64|aes192|aes128gcm128|aes128gcm96|aes128gcm64|aes128'; #[18];
        $cgiparams{'IKE_INTEGRITY'}             = 'sha2_512|sha2_256'; #[19];
-       $cgiparams{'IKE_GROUPTYPE'}             = 'curve25519|curve448|4096|3072|2048'; #[20];
+       $cgiparams{'IKE_GROUPTYPE'}             = 'curve448|curve448|4096|3072|2048'; #[20];
        $cgiparams{'IKE_LIFETIME'}              = '3'; #[16];
        $cgiparams{'ESP_ENCRYPTION'}    = 'chacha20poly1305|aes256gcm128|aes256gcm96|aes256gcm64|aes256|aes192gcm128|aes192gcm96|aes192gcm64|aes192|aes128gcm128|aes128gcm96|aes128gcm64|aes128'; #[21];
        $cgiparams{'ESP_INTEGRITY'}             = 'sha2_512|sha2_256'; #[22];
-       $cgiparams{'ESP_GROUPTYPE'}             = 'curve25519|curve448|4096|3072|2048'; #[23];
+       $cgiparams{'ESP_GROUPTYPE'}             = 'curve448|curve25519|4096|3072|2048'; #[23];
        $cgiparams{'ESP_KEYLIFE'}               = '1'; #[17];
        $cgiparams{'COMPRESSION'}               = 'off'; #[13];
        $cgiparams{'ONLY_PROPOSED'}             = 'on'; #[24];
@@ -2722,7 +2745,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
                        goto ADVANCED_ERROR;
                }
                foreach my $val (@temp) {
-                       if ($val !~ /^(curve25519|curve448|e521|e384|e256|e224|e192|e512bp|e384bp|e256bp|e224bp|768|1024|1536|2048|3072|4096|6144|8192)$/) {
+                       if ($val !~ /^(curve448|curve25519|e521|e384|e256|e224|e192|e512bp|e384bp|e256bp|e224bp|768|1024|1536|2048|3072|4096|6144|8192)$/) {
                                $errormessage = $Lang::tr{'invalid input'};
                                goto ADVANCED_ERROR;
                        }
@@ -2763,7 +2786,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
                        goto ADVANCED_ERROR;
                }
                foreach my $val (@temp) {
-                       if ($val !~ /^(curve25519|curve448|e521|e384|e256|e224|e192|e512bp|e384bp|e256bp|e224bp|768|1024|1536|2048|3072|4096|6144|8192|none)$/) {
+                       if ($val !~ /^(curve448|curve25519|e521|e384|e256|e224|e192|e512bp|e384bp|e256bp|e224bp|768|1024|1536|2048|3072|4096|6144|8192|none)$/) {
                                $errormessage = $Lang::tr{'invalid input'};
                                goto ADVANCED_ERROR;
                        }
@@ -2822,7 +2845,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
                &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
                &writeipsecfiles();
                if (&vpnenabled) {
-                       system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
+                       &General::system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
                        sleep $sleepDelay;
                }
                goto ADVANCED_END;
@@ -2903,8 +2926,8 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
        $checked{'IKE_INTEGRITY'}{'aesxcbc'} = '';
        @temp = split('\|', $cgiparams{'IKE_INTEGRITY'});
        foreach my $key (@temp) {$checked{'IKE_INTEGRITY'}{$key} = "selected='selected'"; }
-       $checked{'IKE_GROUPTYPE'}{'curve25519'} = '';
        $checked{'IKE_GROUPTYPE'}{'curve448'} = '';
+       $checked{'IKE_GROUPTYPE'}{'curve25519'} = '';
        $checked{'IKE_GROUPTYPE'}{'768'} = '';
        $checked{'IKE_GROUPTYPE'}{'1024'} = '';
        $checked{'IKE_GROUPTYPE'}{'1536'} = '';
@@ -2943,8 +2966,8 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
        $checked{'ESP_INTEGRITY'}{'aesxcbc'} = '';
        @temp = split('\|', $cgiparams{'ESP_INTEGRITY'});
        foreach my $key (@temp) {$checked{'ESP_INTEGRITY'}{$key} = "selected='selected'"; }
-       $checked{'ESP_GROUPTYPE'}{'curve25519'} = '';
        $checked{'ESP_GROUPTYPE'}{'curve448'} = '';
+       $checked{'ESP_GROUPTYPE'}{'curve25519'} = '';
        $checked{'ESP_GROUPTYPE'}{'768'} = '';
        $checked{'ESP_GROUPTYPE'}{'1024'} = '';
        $checked{'ESP_GROUPTYPE'}{'1536'} = '';
@@ -3108,8 +3131,8 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
                        <td class='boldbase' width="15%">$Lang::tr{'grouptype'}</td>
                        <td class='boldbase'>
                                <select name='IKE_GROUPTYPE' multiple='multiple' size='6' style='width: 100%'>
-                                       <option value='curve25519' $checked{'IKE_GROUPTYPE'}{'curve25519'}>Curve 25519 (256 bit)</option>
                                        <option value='curve448' $checked{'IKE_GROUPTYPE'}{'curve448'}>Curve 448 (224 bit)</option>
+                                       <option value='curve25519' $checked{'IKE_GROUPTYPE'}{'curve25519'}>Curve 25519 (128 bit)</option>
                                        <option value='e521' $checked{'IKE_GROUPTYPE'}{'e521'}>ECP-521 (NIST)</option>
                                        <option value='e512bp' $checked{'IKE_GROUPTYPE'}{'e512bp'}>ECP-512 (Brainpool)</option>
                                        <option value='e384' $checked{'IKE_GROUPTYPE'}{'e384'}>ECP-384 (NIST)</option>
@@ -3131,8 +3154,8 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
                        </td>
                        <td class='boldbase'>
                                <select name='ESP_GROUPTYPE' multiple='multiple' size='6' style='width: 100%'>
-                                       <option value='curve25519' $checked{'ESP_GROUPTYPE'}{'curve25519'}>Curve 25519 (256 bit)</option>
                                        <option value='curve448' $checked{'ESP_GROUPTYPE'}{'curve448'}>Curve 448 (224 bit)</option>
+                                       <option value='curve25519' $checked{'ESP_GROUPTYPE'}{'curve25519'}>Curve 25519 (128 bit)</option>
                                        <option value='e521' $checked{'ESP_GROUPTYPE'}{'e521'}>ECP-521 (NIST)</option>
                                        <option value='e512bp' $checked{'ESP_GROUPTYPE'}{'e512bp'}>ECP-512 (Brainpool)</option>
                                        <option value='e384' $checked{'ESP_GROUPTYPE'}{'e384'}>ECP-384 (NIST)</option>
@@ -3271,7 +3294,7 @@ EOF
        &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
        $cgiparams{'CA_NAME'} = '';
 
-       my @status = `/usr/local/bin/ipsecctrl I 2>/dev/null`;
+       my @status = &General::system_output("/usr/local/bin/ipsecctrl", "I");
 
        $checked{'ENABLED'} = $cgiparams{'ENABLED'} eq 'on' ? "checked='checked'" : '';
 
@@ -3705,7 +3728,7 @@ sub make_algos($$$$$) {
 
                                        if ($grp =~ m/^e(.*)$/) {
                                                push(@algo, "ecp$1");
-                                       } elsif ($grp =~ m/curve(25519|448)/) {
+                                       } elsif ($grp =~ m/curve(448|25519)/) {
                                                push(@algo, "$grp");
                                        } else {
                                                push(@algo, "modp$grp");
@@ -3722,7 +3745,7 @@ sub make_algos($$$$$) {
                                                # noop
                                        } elsif ($grp =~ m/^e(.*)$/) {
                                                push(@algo, "ecp$1");
-                                       } elsif ($grp =~ m/curve(25519|448)/) {
+                                       } elsif ($grp =~ m/curve(448|25519)/) {
                                                push(@algo, "$grp");
                                        } else {
                                                push(@algo, "modp$grp");