IPsec: Drop support for MODP with subgroup

These come from questionable sources and are not considered
to be secure any more: https://eprint.iacr.org/2016/961

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi
index d6f6ecb33a91294ec43a3db562983edcb5458f95..4683c0c205456502079eaffdee8a5536efa5db8a 100644 (file)
--- a/html/cgi-bin/vpnmain.cgi
+++ b/html/cgi-bin/vpnmain.cgi
@@ -2178,7 +2178,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
                        goto ADVANCED_ERROR;
                }
                foreach my $val (@temp) {
                        goto ADVANCED_ERROR;
                }
                foreach my $val (@temp) {

-                       if ($val !~ /^(curve25519|e521|e384|e256|e224|e192|e512bp|e384bp|e256bp|e224bp|768|1024|1536|2048|2048s256|2048s224|2048s160|3072|4096|6144|8192)$/) {
+                       if ($val !~ /^(curve25519|e521|e384|e256|e224|e192|e512bp|e384bp|e256bp|e224bp|768|1024|1536|2048|3072|4096|6144|8192)$/) {

                                $errormessage = $Lang::tr{'invalid input'};
                                goto ADVANCED_ERROR;
                        }
                                $errormessage = $Lang::tr{'invalid input'};
                                goto ADVANCED_ERROR;
                        }


@@ -2219,7 +2219,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
                        goto ADVANCED_ERROR;
                }
                foreach my $val (@temp) {
                        goto ADVANCED_ERROR;
                }
                foreach my $val (@temp) {

-                       if ($val !~ /^(curve25519|e521|e384|e256|e224|e192|e512bp|e384bp|e256bp|e224bp|768|1024|1536|2048|2048s256|2048s224|2048s160|3072|4096|6144|8192|none)$/) {
+                       if ($val !~ /^(curve25519|e521|e384|e256|e224|e192|e512bp|e384bp|e256bp|e224bp|768|1024|1536|2048|3072|4096|6144|8192|none)$/) {

                                $errormessage = $Lang::tr{'invalid input'};
                                goto ADVANCED_ERROR;
                        }
                                $errormessage = $Lang::tr{'invalid input'};
                                goto ADVANCED_ERROR;
                        }


@@ -2545,9 +2545,6 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
                                        <option value='6144' $checked{'IKE_GROUPTYPE'}{'6144'}>MODP-6144</option>
                                        <option value='4096' $checked{'IKE_GROUPTYPE'}{'4096'}>MODP-4096</option>
                                        <option value='3072' $checked{'IKE_GROUPTYPE'}{'3072'}>MODP-3072</option>
                                        <option value='6144' $checked{'IKE_GROUPTYPE'}{'6144'}>MODP-6144</option>
                                        <option value='4096' $checked{'IKE_GROUPTYPE'}{'4096'}>MODP-4096</option>
                                        <option value='3072' $checked{'IKE_GROUPTYPE'}{'3072'}>MODP-3072</option>

-                                       <option value='2048s256' $checked{'IKE_GROUPTYPE'}{'2048s256'}>MODP-2048/256</option>
-                                       <option value='2048s224' $checked{'IKE_GROUPTYPE'}{'2048s224'}>MODP-2048/224</option>
-                                       <option value='2048s160' $checked{'IKE_GROUPTYPE'}{'2048s160'}>MODP-2048/160</option>

                                        <option value='2048' $checked{'IKE_GROUPTYPE'}{'2048'}>MODP-2048</option>
                                        <option value='1536' $checked{'IKE_GROUPTYPE'}{'1536'}>MODP-1536</option>
                                        <option value='1024' $checked{'IKE_GROUPTYPE'}{'1024'}>MODP-1024 ($Lang::tr{'vpn broken'})</option>
                                        <option value='2048' $checked{'IKE_GROUPTYPE'}{'2048'}>MODP-2048</option>
                                        <option value='1536' $checked{'IKE_GROUPTYPE'}{'1536'}>MODP-1536</option>
                                        <option value='1024' $checked{'IKE_GROUPTYPE'}{'1024'}>MODP-1024 ($Lang::tr{'vpn broken'})</option>


@@ -2570,9 +2567,6 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
                                        <option value='6144' $checked{'ESP_GROUPTYPE'}{'6144'}>MODP-6144</option>
                                        <option value='4096' $checked{'ESP_GROUPTYPE'}{'4096'}>MODP-4096</option>
                                        <option value='3072' $checked{'ESP_GROUPTYPE'}{'3072'}>MODP-3072</option>
                                        <option value='6144' $checked{'ESP_GROUPTYPE'}{'6144'}>MODP-6144</option>
                                        <option value='4096' $checked{'ESP_GROUPTYPE'}{'4096'}>MODP-4096</option>
                                        <option value='3072' $checked{'ESP_GROUPTYPE'}{'3072'}>MODP-3072</option>

-                                       <option value='2048s256' $checked{'ESP_GROUPTYPE'}{'2048s256'}>MODP-2048/256</option>
-                                       <option value='2048s224' $checked{'ESP_GROUPTYPE'}{'2048s224'}>MODP-2048/224</option>
-                                       <option value='2048s160' $checked{'ESP_GROUPTYPE'}{'2048s160'}>MODP-2048/160</option>

                                        <option value='2048' $checked{'ESP_GROUPTYPE'}{'2048'}>MODP-2048</option>
                                        <option value='1536' $checked{'ESP_GROUPTYPE'}{'1536'}>MODP-1536</option>
                                        <option value='1024' $checked{'ESP_GROUPTYPE'}{'1024'}>MODP-1024 ($Lang::tr{'vpn broken'})</option>
                                        <option value='2048' $checked{'ESP_GROUPTYPE'}{'2048'}>MODP-2048</option>
                                        <option value='1536' $checked{'ESP_GROUPTYPE'}{'1536'}>MODP-1536</option>
                                        <option value='1024' $checked{'ESP_GROUPTYPE'}{'1024'}>MODP-1024 ($Lang::tr{'vpn broken'})</option>