From: Erik Kapfer Date: Sun, 13 Apr 2014 05:14:25 +0000 (+0200) Subject: OpenVPN:Add HMAC, cipher 'n2n' and DH key selection. Fixes and new design. X-Git-Tag: v2.15-core79~100^2 X-Git-Url: http://git.ipfire.org/?p=ipfire-2.x.git;a=commitdiff_plain;h=c2b5d12b3453c55afce7ef84451a65e130b0d80f OpenVPN:Add HMAC, cipher 'n2n' and DH key selection. Fixes and new design. Added HMAC algorithm selection menu for N2N and RW. Added cipher selection menu for N2N connections. Added DH key selection also for existing installations incl. DH key upload possibility. Adjusted the ovpn main WUI design to IPSec WUI. Extend key lenght for CA, cert and control channel with faktor 2. Some code and typo cleanup. Bugfixes for #10317, #10149, #10462, #10463 V.2 New changes: Integrated changes in langs and ovpnmain.cgi until 20.03.2014 2.15-Beta3. ovpn.cnf have now default bits of 2048 instead of 1024. ovpn.cnf default_md works now with sha256 instead of md5. Bugfix: By new installation the auth directive for RWs is faded out #10462 Comment 15. Added error message if the crl should be displayed but no crl is present. --- diff --git a/config/ovpn/openssl/ovpn.cnf b/config/ovpn/openssl/ovpn.cnf index d82c04b904..ab026c1095 100644 --- a/config/ovpn/openssl/ovpn.cnf +++ b/config/ovpn/openssl/ovpn.cnf @@ -1,46 +1,46 @@ -HOME = . -RANDFILE = /var/ipfire/ovpn/ca/.rnd -oid_section = new_oids +HOME = . +RANDFILE = /var/ipfire/ovpn/ca/.rnd +oid_section = new_oids [ new_oids ] [ ca ] -default_ca = openvpn +default_ca = openvpn [ openvpn ] -dir = /var/ipfire/ovpn -certs = $dir/certs -crl_dir = $dir/crl -database = $dir/certs/index.txt -new_certs_dir = $dir/certs -certificate = $dir/ca/cacert.pem -serial = $dir/certs/serial -crl = $dir/crl.pem -private_key = $dir/ca/cakey.pem -RANDFILE = $dir/ca/.rand -x509_extensions = usr_cert -default_days = 999999 -default_crl_days= 30 -default_md = md5 -preserve = no -policy = policy_match -email_in_dn = no +dir = /var/ipfire/ovpn +certs = $dir/certs +crl_dir = $dir/crl +database = $dir/certs/index.txt +new_certs_dir = $dir/certs +certificate = $dir/ca/cacert.pem +serial = $dir/certs/serial +crl = $dir/crl.pem +private_key = $dir/ca/cakey.pem +RANDFILE = $dir/ca/.rand +x509_extensions = usr_cert +default_days = 999999 +default_crl_days = 30 +default_md = sha256 +preserve = no +policy = policy_match +email_in_dn = no [ policy_match ] -countryName = optional -stateOrProvinceName = optional -organizationName = optional -organizationalUnitName = optional -commonName = supplied -emailAddress = optional +countryName = optional +stateOrProvinceName = optional +organizationName = optional +organizationalUnitName = optional +commonName = supplied +emailAddress = optional [ req ] -default_bits = 1024 -default_keyfile = privkey.pem -distinguished_name = req_distinguished_name -attributes = req_attributes -x509_extensions = v3_ca -string_mask = nombstr +default_bits = 2048 +default_keyfile = privkey.pem +distinguished_name = req_distinguished_name +attributes = req_attributes +x509_extensions = v3_ca +string_mask = nombstr [ req_distinguished_name ] countryName = Country Name (2 letter code) @@ -73,31 +73,31 @@ challengePassword_max = 20 unstructuredName = An optional company name [ usr_cert ] -basicConstraints=CA:FALSE +basicConstraints = CA:FALSE nsComment = "OpenSSL Generated Certificate" -subjectKeyIdentifier=hash -authorityKeyIdentifier=keyid,issuer:always +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid,issuer:always [ server ] # JY ADDED -- Make a cert with nsCertType set to "server" -basicConstraints=CA:FALSE +basicConstraints = CA:FALSE nsCertType = server nsComment = "OpenSSL Generated Server Certificate" -subjectKeyIdentifier=hash -authorityKeyIdentifier=keyid,issuer:always +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid,issuer:always [ v3_req ] -basicConstraints = CA:FALSE -keyUsage = nonRepudiation, digitalSignature, keyEncipherment +basicConstraints = CA:FALSE +keyUsage = nonRepudiation, digitalSignature, keyEncipherment [ v3_ca ] -subjectKeyIdentifier=hash -authorityKeyIdentifier=keyid:always,issuer:always -basicConstraints = CA:true +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid:always,issuer:always +basicConstraints = CA:true [ crl_ext ] -authorityKeyIdentifier=keyid:always,issuer:always +authorityKeyIdentifier = keyid:always,issuer:always [ engine ] -default = openssl +default = openssl diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi index ceb63d4566..dec27b722c 100644 --- a/html/cgi-bin/ovpnmain.cgi +++ b/html/cgi-bin/ovpnmain.cgi @@ -226,50 +226,6 @@ sub checkportinc } } -# Darren Critchley - certain ports are reserved for IPFire -# TCP 67,68,81,222,444 -# UDP 67,68 -# Params passed in -> port, rangeyn, protocol -sub disallowreserved -{ - # port 67 and 68 same for tcp and udp, don't bother putting in an array - my $msg = ""; - my @tcp_reserved = (81,222,444); - my $prt = $_[0]; # the port or range - my $ryn = $_[1]; # tells us whether or not it is a port range - my $prot = $_[2]; # protocol - my $srcdst = $_[3]; # source or destination - if ($ryn) { # disect port range - if ($srcdst eq "src") { - $msg = "$Lang::tr{'rsvd src port overlap'}"; - } else { - $msg = "$Lang::tr{'rsvd dst port overlap'}"; - } - my @tmprng = split(/\:/,$prt); - unless (67 < $tmprng[0] || 67 > $tmprng[1]) { $errormessage="$msg 67"; return; } - unless (68 < $tmprng[0] || 68 > $tmprng[1]) { $errormessage="$msg 68"; return; } - if ($prot eq "tcp") { - foreach my $prange (@tcp_reserved) { - unless ($prange < $tmprng[0] || $prange > $tmprng[1]) { $errormessage="$msg $prange"; return; } - } - } - } else { - if ($srcdst eq "src") { - $msg = "$Lang::tr{'reserved src port'}"; - } else { - $msg = "$Lang::tr{'reserved dst port'}"; - } - if ($prt == 67) { $errormessage="$msg 67"; return; } - if ($prt == 68) { $errormessage="$msg 68"; return; } - if ($prot eq "tcp") { - foreach my $prange (@tcp_reserved) { - if ($prange == $prt) { $errormessage="$msg $prange"; return; } - } - } - } - return; -} - sub writeserverconf { my %sovpnsettings = (); @@ -362,7 +318,11 @@ sub writeserverconf { print CONF "status-version 1\n"; print CONF "status /var/log/ovpnserver.log 30\n"; print CONF "cipher $sovpnsettings{DCIPHER}\n"; - print CONF "auth $sovpnsettings{DAUTH}\n"; + if ($sovpnsettings{'DAUTH'} eq '') { + print CONF ""; + } else { + print CONF "auth $sovpnsettings{'DAUTH'}\n"; + } if ($sovpnsettings{DCOMPLZO} eq 'on') { print CONF "comp-lzo\n"; } @@ -559,7 +519,7 @@ sub getccdadresses my @iprange=(); my %ccdhash=(); &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash); - $iprange[0]=$ip1.".".$ip2.".".$ip3.".".2; + $iprange[0]=$ip1.".".$ip2.".".$ip3.".".($ip4+2); for (my $i=1;$i<=$count;$i++) { my $tmpip=$iprange[$i-1]; my $stepper=$i*4; @@ -1370,7 +1330,6 @@ END } } - ### ### Upload CA Certificate ### @@ -2248,7 +2207,11 @@ else $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem", "$confighash{$cgiparams{'KEY'}}[1]cert.pem") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1]cert.pem\n"; } print CLIENTCONF "cipher $vpnsettings{DCIPHER}\r\n"; - print CLIENTCONF "auth $vpnsettings{DAUTH}\r\n"; + if ($vpnsettings{'DAUTH'} eq '') { + print CLIENTCONF ""; + } else { + print CLIENTCONF "auth $vpnsettings{'DAUTH'}\r\n"; + } if ($vpnsettings{DCOMPLZO} eq 'on') { print CLIENTCONF "comp-lzo\r\n"; } @@ -2357,7 +2320,8 @@ if ($confighash{$cgiparams{'KEY'}}[3] eq 'net') { } else { $errormessage = $Lang::tr{'invalid key'}; } - &General::firewall_reload(); + + &General::firewall_reload(); ### ### Download PKCS12 file @@ -2419,19 +2383,21 @@ if ($confighash{$cgiparams{'KEY'}}[3] eq 'net') { } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show crl'}) { # &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash); - if ( -f "${General::swroot}/ovpn/crls/cacrl.pem") { - &Header::showhttpheaders(); - &Header::openpage($Lang::tr{'ovpn'}, 1, ''); - &Header::openbigbox('100%', 'LEFT', '', ''); - &Header::openbox('100%', 'LEFT', "$Lang::tr{'crl'}:"); - my $output = `/usr/bin/openssl crl -text -noout -in ${General::swroot}/ovpn/crls/cacrl.pem`; - $output = &Header::cleanhtml($output,"y"); - print "
$output
\n"; - &Header::closebox(); - print "
$Lang::tr{'back'}
"; - &Header::closebigbox(); - &Header::closepage(); - exit(0); + if (! -e "${General::swroot}/ovpn/crls/cacrl.pem") { + $errormessage = $Lang::tr{'not present'}; + } else { + &Header::showhttpheaders(); + &Header::openpage($Lang::tr{'ovpn'}, 1, ''); + &Header::openbigbox('100%', 'LEFT', '', ''); + &Header::openbox('100%', 'LEFT', "$Lang::tr{'crl'}:"); + my $output = `/usr/bin/openssl crl -text -noout -in ${General::swroot}/ovpn/crls/cacrl.pem`; + $output = &Header::cleanhtml($output,"y"); + print "
$output
\n"; + &Header::closebox(); + print "
$Lang::tr{'back'}
"; + &Header::closebigbox(); + &Header::closepage(); + exit(0); } ### @@ -2512,7 +2478,7 @@ ADV_ERROR: &Header::openbox('100%', 'LEFT', $Lang::tr{'advanced server'}); print < - +
@@ -2584,6 +2550,7 @@ print < + @@ -2632,12 +2599,12 @@ print < @@ -2721,10 +2688,10 @@ if ($cgiparams{'ACTION'} eq "edit"){ &Header::openbox('100%', 'LEFT', $Lang::tr{'ccd modify'}); print < +
$Lang::tr{'dhcp-options'}
mssfix $Lang::tr{'openvpn default'}: on
$Lang::tr{'ovpn mtu-disc'}
$Lang::tr{'ovpn ha'} Default: SHA1 (160 $Lang::tr{'bit'})
- + @@ -2784,7 +2751,7 @@ END print" + END ; } @@ -3023,7 +2990,7 @@ if ( -s "${General::swroot}/ovpn/settings") { - + @@ -3756,13 +3723,14 @@ if ($cgiparams{'TYPE'} eq 'net') { unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!"; rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!"; goto VPNCONF_ERROR; - } - #Check if remote subnet is used elsewhere - my ($n2nip,$n2nsub)=split("/",$cgiparams{'REMOTE_SUBNET'}); - $warnmessage=&General::checksubnets('',$n2nip,'ovpn'); - if ($warnmessage){ - $warnmessage=$Lang::tr{'remote subnet'}." ($cgiparams{'REMOTE_SUBNET'})
".$warnmessage; - } + } + #Check if remote subnet is used elsewhere + my ($n2nip,$n2nsub)=split("/",$cgiparams{'REMOTE_SUBNET'}); + $warnmessage=&General::checksubnets('',$n2nip,'ovpn'); + if ($warnmessage){ + $warnmessage=$Lang::tr{'remote subnet'}." ($cgiparams{'REMOTE_SUBNET'})
".$warnmessage; + } + } # if (($cgiparams{'TYPE'} eq 'net') && ($cgiparams{'SIDE'} !~ /^(left|right)$/)) { @@ -4637,7 +4605,7 @@ if ($cgiparams{'TYPE'} eq 'host') { - + @@ -4901,15 +4869,15 @@ END &Header::closebox(); } - if ($warnmessage) { - &Header::openbox('100%', 'LEFT', $Lang::tr{'warning messages'}); - print "$warnmessage
"; - print "$Lang::tr{'fwdfw warn1'}
"; - &Header::closebox(); - print"
"; - &Header::closepage(); - exit 0; - } + if ($warnmessage) { + &Header::openbox('100%', 'LEFT', $Lang::tr{'warning messages'}); + print "$warnmessage
"; + print "$Lang::tr{'fwdfw warn1'}
"; + &Header::closebox(); + print"
"; + &Header::closepage(); + exit 0; + } my $sactive = "
$Lang::tr{'ccd name'}:$Lang::tr{'ccd subnet'}:
$Lang::tr{'ccd subnet'}:
$ccdconf[0]$ccdconf[1]$ccdhosts/".(&ccdmaxclients($ccdconf[1])+1).""; print < - + @@ -2793,7 +2760,7 @@ END -
$Lang::tr{'net to net vpn'} (Upload Client Package)
 
 Import Connection Name
 Default : Client Packagename
 $Lang::tr{'openvpn default'}: Client Packagename
* $Lang::tr{'this field may be blank'}
  $Lang::tr{'pkcs12 file password'}:
 $Lang::tr{'pkcs12 file password'}:
($Lang::tr{'confirmation'})
 $Lang::tr{'pkcs12 file password'}:
($Lang::tr{'confirmation'})
 
$Lang::tr{'stopped'}
"; my $srunning = "no"; @@ -4923,7 +4891,7 @@ END } &Header::openbox('100%', 'LEFT', $Lang::tr{'global settings'}); print < + diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index 3fbdd2072d..ceba677ebb 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -1,15 +1,17 @@ %tr = ( %tr, -'Act as' => 'Konfiguriert als:', +'Act as' => 'Konfiguriert als', 'Add Level7 rule' => 'Level7-Regel hinzufügen', 'Add Port Rule' => 'Port-Regel hinzufügen', 'Add Rule' => 'Regel hinzufügen', 'Add a route' => 'Eine Route hinzufügen', 'Async logging enabled' => 'Aktiviere asynchrones Schreiben des Syslogs', +'bit' => 'Bit', 'Choose Rule' => 'Wählen Sie eine der untenstehenden Regeln aus.', 'Class' => 'Klasse', 'Class was deleted' => 'wurde mit eventuell vorhandenen Unterklassen gelöscht', +'Client status and controlc' => 'Client-Status und -Kontrolle', 'ConnSched action' => 'Aktion:', 'ConnSched add action' => 'Aktion hinzufügen', 'ConnSched change profile title' => 'Wechsle zu Profil:', @@ -34,8 +36,7 @@ 'Local VPN IP' => 'Internes Netzwerk (GREEN)', 'MB read' => 'MB gelesen', 'MB written' => 'MB geschrieben', -'MTU' => 'MTU Size', -'Number of Countries for the pie chart' => 'Anzahl der angezeigten Länder im Diagramm', +'MTU' => 'MTU Size:', 'Number of IPs for the pie chart' => 'Anzahl der angezeigten IPs im Diagramm', 'Number of Ports for the pie chart' => 'Anzahl der angezeigten Ports im Diagramm', 'OVPN' => 'OpenVPN', @@ -656,8 +657,7 @@ 'device' => 'Gerät', 'devices on blue' => 'Geräte auf Blau', 'dh' => 'Diffie-Hellman Key', -'dh key warn' => 'Keys mit 1024 und 2048 Bit können mehreren Minuten, 3072 und 4096 Bit bis zu mehreren Stunden dauern. Bitte haben sie Geduld.', -'dh name is invalid' => 'Name ist ungültig, bitte "dh1024.pem" verwenden.', +'dh key warn' => 'Keys mit 1024 und 2048 Bit können mehrere Minuten, 3072 und 4096 Bit bis zu mehreren Stunden dauern. Bitte haben sie Geduld.', 'dhcp advopt add' => 'DHCP Option hinzufügen', 'dhcp advopt added' => 'DHCP Option hinzugefügt', 'dhcp advopt blank value' => 'Wert für DHCP Option darf nicht leer sein', @@ -687,6 +687,7 @@ 'dhcp server disabled' => 'DHCP-Server deaktiviert. Angehalten.', 'dhcp server enabled' => 'DHCP-Server aktiviert. Starte neu.', 'dhcp-options' => 'DHCP push Optionen', +'dh name is invalid' => 'Name ist ungültig, bitte "dh1024.pem" verwenden.', 'dial' => 'Verbinden', 'dial profile' => 'Verbinde mit Profil', 'dial user password' => 'Passwort für Benutzer "dial":', @@ -730,7 +731,8 @@ 'dns proxy server' => 'DNS-Proxyserver', 'dns saved' => 'Erfolgreich gespeichert!', 'dns saved txt' => 'Die beiden eingegebenen DNS-Server-Adressen wurde erfolgreich gespeichert.
Um die Änderung wirksam zu machen, müssen Sie neustarten oder wiederverbinden!', -'dns server' => 'DNS Server', +'dns server' => 'DNS-Server', +'dns servers' => 'DNS-Server', 'dns title' => 'Domain Name System', 'dnsforward' => 'DNS-Weiterleitung', 'dnsforward add a new entry' => 'Neuen Eintrag hinzufügen', @@ -754,6 +756,7 @@ 'donation-text' => 'IPFire wird von Freiwilligen in ihrer Freizeit betrieben und auch betreut. Um dieses Projekt am Laufen zu halten, entstehen uns natürlich auch Kosten. Wenn Sie uns unterstützen wollen, würden wir uns über eine kleine Spende sehr freuen.', 'dos charset' => 'DOS Charset', 'down and up speed' => 'Geben Sie bitte hier ihre Download- bzw. Upload-Geschwindigkeit ein
und klicken Sie danach auf Speichern.', +'downlink' => 'Downlink', 'downlink speed' => 'Downlink-Geschwindigkeit (kBit/sek)', 'downlink std class' => 'Downloadstandardklasse', 'download' => 'herunterladen', @@ -899,13 +902,13 @@ 'firewall log' => 'Firewall-Protokoll', 'firewall log viewer' => 'Betrachter der Firewall-Logdateien', 'firewall logs' => 'Firewall-Logdateien', -'firewall logs country' => 'Fw-Logdiagramme (Land)', 'firewall logs ip' => 'Fw-Logdiagramme (IP)', 'firewall logs port' => 'Fw-Logdiagramme (Port)', 'firewall rules' => 'Firewallregeln', 'firewallhits' => 'Firewalltreffer', 'firmware' => 'Firmware', 'firmware upload' => 'Hochladen der Firmware/Treiber', +'first' => 'Erste', 'fixed ip lease added' => 'Feste IP-Zuordnung hinzugefügt', 'fixed ip lease modified' => 'Feste IP-Zuordnung geändert', 'fixed ip lease removed' => 'Feste IP-Zuordnung gelöscht', @@ -1319,6 +1322,7 @@ 'lan' => 'LAN', 'lang' => 'de', 'languagepurpose' => 'Wählen Sie eine Sprache, in der IPFire angezeigt werden soll:', +'last' => 'Letzte', 'last activity' => 'Letzte Aktivität', 'lateprompting' => 'Late prompting', 'lease expires' => 'Zuordnung verfällt', @@ -1510,7 +1514,6 @@ 'network traffic graphs others' => 'Netzwerk (sonstige)', 'network updated' => 'Benutzerdefiniertes Netzwerk aktualisiert', 'networks settings' => 'Firewall - Netzwerkeinstellungen', -'never' => 'Nie', 'new optionsfw later' => 'Einige Einstellungen werden erst nach einem Neustart aktiv', 'new optionsfw must boot' => 'Sie müssen Ihren IPFire neu starten', 'newer' => 'Neuer', @@ -1621,19 +1624,18 @@ 'outgoing traffic in bytes per second' => 'Abgehender Verkehr', 'override mtu' => 'Überschreibe Standard MTU', 'ovpn' => 'OpenVPN', +'ovpn crypt options' => 'Kryptografieoptionen', 'ovpn con stat' => 'OpenVPN Verbindungs-Statistik', 'ovpn config' => 'OVPN-Konfiguration', -'ovpn crypt options' => 'Kryptografieoptionen', 'ovpn device' => 'OpenVPN-Gerät:', 'ovpn dh' => 'Diffie-Hellman Key Länge', 'ovpn dh name' => 'Diffie-Hellman Key Name', 'ovpn dl' => 'OVPN-Konfiguration downloaden', -'ovpn engines' => 'Krypto Engine', 'ovpn errmsg green already pushed' => 'Route für grünes Netzwerk wird immer gesetzt', 'ovpn errmsg invalid ip or mask' => 'Ungültige Netzwerk-Adresse oder Subnetzmaske', 'ovpn generating the root and host certificates' => 'Die Erzeugung der Root- und Host-Zertifikate kann lange Zeit dauern.', -'ovpn ha' => 'Hash Algorithmus', 'ovpn hmac' => 'HMAC Optionen', +'ovpn ha' => 'Hash Algorithmus', 'ovpn log' => 'OVPN-Log', 'ovpn mgmt in root range' => 'Ein Port von 1024 oder höher ist erforderlich.', 'ovpn mtu-disc' => 'Path MTU Discovery', @@ -1648,14 +1650,12 @@ 'ovpn on orange' => 'OpenVPN auf ORANGE:', 'ovpn on red' => 'OpenVPN auf ROT:', 'ovpn port in root range' => 'Ein Port von 1024 oder höher ist erforderlich.', -'ovpn reneg sec' => 'Session Key Lifetime', 'ovpn routes push' => 'Routen (eine pro Zeile) z.b. 192.168.10.0/255.255.255.0 192.168.20.0/24', 'ovpn routes push options' => 'Route push Optionen', -'ovpn server status' => 'OpenVPN-Server-Status:', +'ovpn server status' => 'OpenVPN-Server-Status', 'ovpn subnet' => 'OpenVPN-Subnetz:', 'ovpn subnet is invalid' => 'Das OpenVPN-Subnetz ist ungültig.', 'ovpn subnet overlap' => 'OpenVPNSubnetz überschneidet sich mit ', -'ovpn_fastio' => 'Fast-IO', 'ovpn_fragment' => 'Fragmentgrösse', 'ovpn_mssfix' => 'MSSFIX-Grösse', 'ovpn_mtudisc' => 'MTU-Discovery', @@ -1932,7 +1932,6 @@ 'source ip' => 'Quell-IP-Adresse', 'source ip and port' => 'Quell-IP:Port', 'source ip bad' => 'Ungültige Quell-IP-Adresse.', -'source ip country' => 'Quell-IP-Adresse Land', 'source ip in use' => 'Benutzte Quell-IP:', 'source ip or net' => 'Quellen-IP oder Netz', 'source net' => 'Quell-Netz', @@ -2224,6 +2223,7 @@ 'updxlrtr weekly' => 'wöchentlich', 'updxlrtr year' => 'einem Jahr', 'upgrade' => 'upgrade', +'uplink' => 'Uplink', 'uplink speed' => 'Uplink-Geschwindigkeit (kBit/sek)', 'uplink std class' => 'Uploadstandardklasse', 'upload' => 'Hochladen', @@ -2480,6 +2480,7 @@ 'vpn aggrmode' => 'IKE Aggressive Mode zugelassen. Wenn möglich, vermeiden (preshared Schlüssel wird im Klartext übertragen)!', 'vpn altname syntax' => 'Der Subjekt Alternativ Name ist eine durch Komma getrennte Liste von Email, DNS, URI, RID und IP Objekten.
Email: eine Email Adresse. Syntax Email: \'copy\' benutzt die Email Adresse aus dem Zertifikatfeld.
DNS: ein gültiger Domain Name.
URI: eine gültige URI.
RID: Registriertes Objekt Identifikation.
IP: eine IP Adresse.
Bitte beachten: der Zeichensatz ist eingeschränkt und die Groß-/Kleinschreibung ist entscheidend.
Beispiel:
email:info@ipfire.org,email:copy,DNS:www.ipfire.org,IP:127.0.0.1,URI:http://url/nach/irgendwo', 'vpn auth-dn' => 'Peer wird identifiziert durch entweder ein IPV4_ADDR, FQDN, USER_FQDN oder DER_ASN1_DN string in Remote ID Feld', +'vpn configuration main' => 'VPN-Konfiguration', 'vpn delayed start' => 'Verzögerung bevor VPN gestartet wird (Sekunden)', 'vpn delayed start help' => 'Falls notwendig, kann diese Verzögerung dazu verwendet werden, um Dynamic-DNS-Updates ordnungsgemäß anzuwenden. 60 ist ein gängiger Wert, wenn ROT (RED) eine dynamische IP Adresse ist.', 'vpn incompatible use of defaultroute' => 'Hostname=%defaultroute nicht zulässig', diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index 46f5625c15..a683b5c315 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -7,9 +7,11 @@ 'Add Rule' => 'Add rule', 'Add a route' => 'Add a route', 'Async logging enabled' => 'Enable asynchronous writing of the syslog file', +'bit' => 'bit', 'Choose Rule' => 'Choose one of the following rules.', 'Class' => 'Class', 'Class was deleted' => 'with potential subclasses was deleted', +'Client status and controlc' => 'Client status and control:', 'ConnSched action' => 'Action:', 'ConnSched add action' => 'Add action', 'ConnSched change profile title' => 'Change to profile:', @@ -35,7 +37,6 @@ 'MB read' => 'MB read', 'MB written' => 'MB written', 'MTU' => 'MTU size:', -'Number of Countries for the pie chart' => 'Number of Countries for the pie chart', 'Number of IPs for the pie chart' => 'Number of IPs for the pie chart', 'Number of Ports for the pie chart' => 'Number of ports for the pie chart', 'OVPN' => 'OpenVPN', @@ -419,7 +420,7 @@ 'behind a proxy' => 'Behind a proxy:', 'bewan adsl pci st' => 'TO BE REMOVED', 'bewan adsl usb' => 'TO BE REMOVED', -'bit' => 'bit', +'bit' => 'Bit', 'bitrate' => 'Bitrate', 'bleeding rules' => 'Bleeding Edge Snort Rules', 'blue' => 'BLUE', @@ -678,8 +679,6 @@ 'device' => 'Device', 'devices on blue' => 'Devices on BLUE', 'dh' => 'Diffie-Hellman Key', -'dh key warn' => 'Keys with 1024 and 2048 bit takes up to several minutes, 3072 and 4096 bit might needs several hours. Please be patient.', -'dh name is invalid' => 'Name ist ungŸltig, bitte "dh1024.pem" verwenden.', 'dhcp advopt add' => 'Add a DHCP option', 'dhcp advopt added' => 'DHCP option added', 'dhcp advopt blank value' => 'DHCP Option value cannot be empty.', @@ -711,6 +710,8 @@ 'dhcp server enabled' => 'DHCP server enabled. Restarting.', 'dhcp server enabled on blue interface' => 'DHCP server enabled on BLUE interface', 'dhcp-options' => 'DHCP push options', +'dh key warn' => 'Keys with 1024 and 2048 bit takes up to several minutes, 3072 and 4096 bit might needs several hours. Please be patient.', +'dh name is invalid' => 'Name is invalid, please use "dh1024.pem".', 'dial' => 'Connect', 'dial profile' => 'Connect with profile', 'dial user password' => 'Dial user password:', @@ -755,6 +756,7 @@ 'dns saved' => 'Successfully saved!', 'dns saved txt' => 'The two entered DNS server addresses have been saved successfully.
You have to reboot or reconnect that the changes have effect!', 'dns server' => 'DNS Server', +'dns servers' => 'DNS Servers', 'dns title' => 'Domain Name System', 'dnsforward' => 'DNS Forwarding', 'dnsforward add a new entry' => 'Add a new entry', @@ -779,6 +781,7 @@ 'done' => 'Do it', 'dos charset' => 'DOS Charset', 'down and up speed' => 'Enter your Down- and Uplink-Speed
and then press Save.', +'downlink' => 'Downlink', 'downlink speed' => 'Downlink speed (kbit/sec)', 'downlink std class' => 'downlink standard class', 'download' => 'download', @@ -927,11 +930,11 @@ 'firewall logs' => 'Firewall Logs', 'firewall logs ip' => 'Fw-Loggraphs (IP)', 'firewall logs port' => 'Fw-Loggraphs (Port)', -'firewall logs country' => 'Fw-Loggraphs (Country)', 'firewall rules' => 'Firewall Rules', 'firewallhits' => 'firewallhits', 'firmware' => 'Firmware', 'firmware upload' => 'Upload Firmware/Drivers', +'first' => 'First', 'fixed ip lease added' => 'Fixed IP lease added', 'fixed ip lease modified' => 'Fixed IP lease modified', 'fixed ip lease removed' => 'Fixed IP lease removed', @@ -1348,6 +1351,7 @@ 'lan' => 'LAN', 'lang' => 'en', 'languagepurpose' => 'Select the language you wish IPFire to display in:', +'last' => 'Last', 'last activity' => 'Last Activity', 'lateprompting' => 'Lateprompting', 'lease expires' => 'Lease expires', @@ -1539,7 +1543,6 @@ 'network traffic graphs others' => 'Network (others)', 'network updated' => 'Custom Network updated', 'networks settings' => 'Firewall - Network settings', -'never' => 'Never', 'new optionsfw later' => 'Some options need a reboot to take effect', 'new optionsfw must boot' => 'You must reboot your IPFire', 'newer' => 'Newer', @@ -1653,12 +1656,11 @@ 'ovpn' => 'OpenVPN', 'ovpn con stat' => 'OpenVPN Connection Statistics', 'ovpn config' => 'OVPN-Config', -'ovpn crypt options' => 'Cryptographic options', 'ovpn device' => 'OpenVPN device:', 'ovpn dh' => 'Diffie-Hellman key lenght', 'ovpn dh name' => 'Diffie-Hellman key name', 'ovpn dl' => 'OVPN-Config Download', -'ovpn engines' => 'Crypto engine', +'ovpn crypt options' => 'Cryptographic options', 'ovpn errmsg green already pushed' => 'Route for green network is always set', 'ovpn errmsg invalid ip or mask' => 'Invalid network-address or subnetmask', 'ovpn generating the root and host certificates' => 'Generating the root and host certifictae can take a long time.', @@ -1678,7 +1680,6 @@ 'ovpn on orange' => 'OpenVPN on ORANGE:', 'ovpn on red' => 'OpenVPN on RED:', 'ovpn port in root range' => 'A port number of 1024 or higher is required.', -'ovpn reneg sec' => 'Session key lifetime:', 'ovpn routes push' => 'Routes (one per line) e.g. 192.168.10.0/255.255.255.0 192.168.20.0/24', 'ovpn routes push options' => 'Route push options', 'ovpn server status' => 'Current OpenVPN server status:', @@ -1967,7 +1968,6 @@ 'source ip' => 'Source IP', 'source ip and port' => 'Source IP: Port', 'source ip bad' => 'Not a valid IP address or a network address.', -'source ip country' => 'Source IP Country', 'source ip in use' => 'Source IP in use:', 'source ip or net' => 'Source IP or Net', 'source net' => 'Source Net', @@ -2262,6 +2262,7 @@ 'updxlrtr weekly' => 'weekly', 'updxlrtr year' => 'one year', 'upgrade' => 'upgrade', +'uplink' => 'Uplink', 'uplink speed' => 'Uplink speed (kbit/sec)', 'uplink std class' => 'uplink standard class', 'upload' => 'Upload', @@ -2519,6 +2520,7 @@ 'vpn aggrmode' => 'IKE aggressive mode allowed. Avoid if possible (preshared key is transmitted in clear text)!', 'vpn altname syntax' => 'SubjectAltName is a comma separated list of e-mail, dns, uri, rid and ip objects.
email:an email address. Syntax email:copy takes the email field from the cert to be used.
DNS:a valid domain name.
URI:any valid uri.
RID:registered object identifier.
IP:an IP address.
Note:charset is limited and case is significant.
Example:
e-mail:ipfire@foo.org,email:copy,DNS:www.ipfire.org,IP:127.0.0.1,URI:http://url/to/something', 'vpn auth-dn' => 'Peer is identified by either IPV4_ADDR, FQDN, USER_FQDN or DER_ASN1_DN string in remote ID field', +'vpn configuration main' => 'VPN Configuration', 'vpn delayed start' => 'Delay before launching VPN (seconds)', 'vpn delayed start help' => 'If required, this delay can be used to allow dynamic DNS updates to propagate properly. 60 is a common value when RED is a dynamic IP.', 'vpn incompatible use of defaultroute' => 'hostname=%defaultroute not allowed',