ipsec: Allow selection of ESP group type

If a connection is edited, the IKE group types will be used instead.

Fixes #10860

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Tested-by: Wolfgang Apolinarski <wolfgang.apolinarski@web.de>

diff --git a/doc/language_issues.de b/doc/language_issues.de
index 90accb3c006af286c1d56470df931d1734683a65..0d86987569b50cb9ec384043929960d4a2335f83 100644 (file)
--- a/doc/language_issues.de
+++ b/doc/language_issues.de
@@ -644,6 +644,7 @@ WARNING: untranslated string: fwhost cust geoipgrp
 WARNING: untranslated string: fwhost err hostip
 WARNING: untranslated string: ike lifetime should be between 1 and 8 hours
 WARNING: untranslated string: no data
+WARNING: untranslated string: none
 WARNING: untranslated string: qos add subclass
 WARNING: untranslated string: route config changed
 WARNING: untranslated string: routing config added

diff --git a/doc/language_issues.es b/doc/language_issues.es
index 9910db6a0c1979a75885a9aab06994f209a6d350..2a502006b96ba0a113b8837dfb9d10db0988e172 100644 (file)
--- a/doc/language_issues.es
+++ b/doc/language_issues.es
@@ -917,6 +917,7 @@ WARNING: untranslated string: most preferred
 WARNING: untranslated string: nameserver
 WARNING: untranslated string: no data
 WARNING: untranslated string: no hardware random number generator
+WARNING: untranslated string: none
 WARNING: untranslated string: not a valid dh key
 WARNING: untranslated string: notice
 WARNING: untranslated string: openvpn default

diff --git a/doc/language_issues.fr b/doc/language_issues.fr
index ef01a1e106e5b4f2c561b06a1179201031e3b11f..aa4951d80e9f2c73f9269ab97efa0b38ffdba38c 100644 (file)
--- a/doc/language_issues.fr
+++ b/doc/language_issues.fr
@@ -932,6 +932,7 @@ WARNING: untranslated string: most preferred
 WARNING: untranslated string: nameserver
 WARNING: untranslated string: no data
 WARNING: untranslated string: no hardware random number generator
+WARNING: untranslated string: none
 WARNING: untranslated string: not a valid dh key
 WARNING: untranslated string: notice
 WARNING: untranslated string: ntp common settings

diff --git a/doc/language_issues.it b/doc/language_issues.it
index 522fee3ba53bbb0581489d612fec0e33d1218d34..1669e79f6d5a59ab92e78b4f18c84b68b2e6f671 100644 (file)
--- a/doc/language_issues.it
+++ b/doc/language_issues.it
@@ -705,6 +705,7 @@ WARNING: untranslated string: masquerading disabled
 WARNING: untranslated string: masquerading enabled
 WARNING: untranslated string: messages
 WARNING: untranslated string: no data
+WARNING: untranslated string: none
 WARNING: untranslated string: outgoing compression in bytes per second
 WARNING: untranslated string: outgoing overhead in bytes per second
 WARNING: untranslated string: ovpn add conf

diff --git a/doc/language_issues.nl b/doc/language_issues.nl
index e7d8e08eaef9825c0f2be6cbd3cca3ebfb01e2ce..11d76577bb56f6b17e8d5f9a4f7d808a229425f8 100644 (file)
--- a/doc/language_issues.nl
+++ b/doc/language_issues.nl
@@ -737,6 +737,7 @@ WARNING: untranslated string: modem status
 WARNING: untranslated string: monitor interface
 WARNING: untranslated string: nameserver
 WARNING: untranslated string: no data
+WARNING: untranslated string: none
 WARNING: untranslated string: not a valid dh key
 WARNING: untranslated string: outgoing compression in bytes per second
 WARNING: untranslated string: outgoing overhead in bytes per second

diff --git a/doc/language_issues.pl b/doc/language_issues.pl
index 9910db6a0c1979a75885a9aab06994f209a6d350..2a502006b96ba0a113b8837dfb9d10db0988e172 100644 (file)
--- a/doc/language_issues.pl
+++ b/doc/language_issues.pl
@@ -917,6 +917,7 @@ WARNING: untranslated string: most preferred
 WARNING: untranslated string: nameserver
 WARNING: untranslated string: no data
 WARNING: untranslated string: no hardware random number generator
+WARNING: untranslated string: none
 WARNING: untranslated string: not a valid dh key
 WARNING: untranslated string: notice
 WARNING: untranslated string: openvpn default

diff --git a/doc/language_issues.ru b/doc/language_issues.ru
index 95caaa53f10eb82bb0d2133b19eb2ee346f7af16..d2215b6df4476d39a7ae65b5b3da57d1163cc6e5 100644 (file)
--- a/doc/language_issues.ru
+++ b/doc/language_issues.ru
@@ -917,6 +917,7 @@ WARNING: untranslated string: most preferred
 WARNING: untranslated string: nameserver
 WARNING: untranslated string: no data
 WARNING: untranslated string: no hardware random number generator
+WARNING: untranslated string: none
 WARNING: untranslated string: not a valid dh key
 WARNING: untranslated string: notice
 WARNING: untranslated string: openvpn default

diff --git a/doc/language_issues.tr b/doc/language_issues.tr
index d57c721a1eb5888c0a63d6ebf1dc474b8ff2a5a4..a9d633273bdc5642b09cd9a679e68f318c05f346 100644 (file)
--- a/doc/language_issues.tr
+++ b/doc/language_issues.tr
@@ -684,6 +684,7 @@ WARNING: untranslated string: incoming compression in bytes per second
 WARNING: untranslated string: incoming overhead in bytes per second
 WARNING: untranslated string: invalid input for valid till days
 WARNING: untranslated string: no data
+WARNING: untranslated string: none
 WARNING: untranslated string: outgoing compression in bytes per second
 WARNING: untranslated string: outgoing overhead in bytes per second
 WARNING: untranslated string: ovpn add conf

diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi
index 218dafa26814624dd2e3358cf661c3e7566a8087..8c44b7e93a392babefcac16380b145156e217006 100644 (file)
--- a/html/cgi-bin/vpnmain.cgi
+++ b/html/cgi-bin/vpnmain.cgi
@@ -329,7 +329,13 @@ sub writeipsecfiles {
        if ($lconfighash{$key}[21] && $lconfighash{$key}[22]) {
                my @encs   = split('\|', $lconfighash{$key}[21]);
                my @ints   = split('\|', $lconfighash{$key}[22]);
-               my @groups = split('\|', $lconfighash{$key}[20]);
+               my @groups = split('\|', $lconfighash{$key}[23]);
+
+               # Use IKE grouptype if no ESP group type has been selected
+               # (for backwards compatibility)
+               if ($lconfighash{$key}[23] eq "") {
+                       @groups = split('\|', $lconfighash{$key}[20]);
+               }
 
                my @algos = &make_algos("esp", \@encs, \@ints, \@groups, ($pfs eq "on"));
                print CONF "\tesp=" . join(",", @algos);
@@ -1270,6 +1276,9 @@ END
        $cgiparams{'ESP_ENCRYPTION'}    = $confighash{$cgiparams{'KEY'}}[21];
        $cgiparams{'ESP_INTEGRITY'}     = $confighash{$cgiparams{'KEY'}}[22];
        $cgiparams{'ESP_GROUPTYPE'}     = $confighash{$cgiparams{'KEY'}}[23];
+       if ($cgiparams{'ESP_GROUPTYPE'} eq "") {
+               $cgiparams{'ESP_GROUPTYPE'} = $cgiparams{'IKE_GROUPTYPE'};
+       }
        $cgiparams{'ESP_KEYLIFE'}       = $confighash{$cgiparams{'KEY'}}[17];
        $cgiparams{'COMPRESSION'}       = $confighash{$cgiparams{'KEY'}}[13];
        $cgiparams{'ONLY_PROPOSED'}     = $confighash{$cgiparams{'KEY'}}[24];
@@ -1865,7 +1874,7 @@ END
        $cgiparams{'IKE_LIFETIME'}   = '3';             #[16];
        $cgiparams{'ESP_ENCRYPTION'} = 'aes256gcm128|aes256gcm96|aes256gcm64|aes256|aes192gcm128|aes192gcm96|aes192gcm64|aes192|aes128gcm128|aes128gcm96|aes128gcm64|aes128';   #[21];
        $cgiparams{'ESP_INTEGRITY'}  = 'sha2_512|sha2_256|sha1';        #[22];
-       $cgiparams{'ESP_GROUPTYPE'}  = '';              #[23];
+       $cgiparams{'ESP_GROUPTYPE'}  = '4096|3072|2048|1536|1024';              #[23];
        $cgiparams{'ESP_KEYLIFE'}    = '1';             #[17];
        $cgiparams{'COMPRESSION'}    = 'on';            #[13];
        $cgiparams{'ONLY_PROPOSED'}  = 'off';           #[24];
@@ -2175,13 +2184,17 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
                goto ADVANCED_ERROR;
            }
        }
-       if ($cgiparams{'ESP_GROUPTYPE'} ne '' &&
-           $cgiparams{'ESP_GROUPTYPE'} !~  /^ecp(192|224|256|384|512)(bp)?$/ &&
-           $cgiparams{'ESP_GROUPTYPE'} !~  /^modp(1024|1536|2048|2048s(256|224|160)|3072|4096|6144|8192)$/) {
+       @temp = split('\|', $cgiparams{'ESP_GROUPTYPE'});
+       if ($#temp < 0) {
            $errormessage = $Lang::tr{'invalid input'};
            goto ADVANCED_ERROR;
        }
-
+       foreach my $val (@temp) {
+           if ($val !~ /^(e521|e384|e256|e224|e192|e512bp|e384bp|e256bp|e224bp|1024|1536|2048|2048s256|2048s224|2048s160|3072|4096|6144|8192|none)$/) {
+               $errormessage = $Lang::tr{'invalid input'};
+               goto ADVANCED_ERROR;
+           }
+       }
        if ($cgiparams{'ESP_KEYLIFE'} !~ /^\d+$/) {
            $errormessage = $Lang::tr{'invalid input for esp keylife'};
            goto ADVANCED_ERROR;
@@ -2244,6 +2257,9 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
        $cgiparams{'ESP_ENCRYPTION'} = $confighash{$cgiparams{'KEY'}}[21];
        $cgiparams{'ESP_INTEGRITY'}  = $confighash{$cgiparams{'KEY'}}[22];
        $cgiparams{'ESP_GROUPTYPE'}  = $confighash{$cgiparams{'KEY'}}[23];
+       if ($cgiparams{'ESP_GROUPTYPE'} eq "") {
+               $cgiparams{'ESP_GROUPTYPE'} = $cgiparams{'IKE_GROUPTYPE'};
+       }
        $cgiparams{'ESP_KEYLIFE'}    = $confighash{$cgiparams{'KEY'}}[17];
        $cgiparams{'COMPRESSION'}    = $confighash{$cgiparams{'KEY'}}[13];
        $cgiparams{'ONLY_PROPOSED'}  = $confighash{$cgiparams{'KEY'}}[24];
@@ -2333,7 +2349,17 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
     $checked{'ESP_INTEGRITY'}{'aesxcbc'} = '';
     @temp = split('\|', $cgiparams{'ESP_INTEGRITY'});
     foreach my $key (@temp) {$checked{'ESP_INTEGRITY'}{$key} = "selected='selected'"; }
-    $checked{'ESP_GROUPTYPE'}{$cgiparams{'ESP_GROUPTYPE'}} = "selected='selected'";
+    $checked{'ESP_GROUPTYPE'}{'768'} = '';
+    $checked{'ESP_GROUPTYPE'}{'1024'} = '';
+    $checked{'ESP_GROUPTYPE'}{'1536'} = '';
+    $checked{'ESP_GROUPTYPE'}{'2048'} = '';
+    $checked{'ESP_GROUPTYPE'}{'3072'} = '';
+    $checked{'ESP_GROUPTYPE'}{'4096'} = '';
+    $checked{'ESP_GROUPTYPE'}{'6144'} = '';
+    $checked{'ESP_GROUPTYPE'}{'8192'} = '';
+    $checked{'ESP_GROUPTYPE'}{'none'} = '';
+    @temp = split('\|', $cgiparams{'ESP_GROUPTYPE'});
+    foreach my $key (@temp) {$checked{'ESP_GROUPTYPE'}{$key} = "selected='selected'"; }
 
     $checked{'COMPRESSION'} = $cgiparams{'COMPRESSION'} eq 'on' ? "checked='checked'" : '' ;
     $checked{'ONLY_PROPOSED'} = $cgiparams{'ONLY_PROPOSED'} eq 'on' ? "checked='checked'" : '' ;
@@ -2494,7 +2520,30 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
                                        <option value='1024' $checked{'IKE_GROUPTYPE'}{'1024'}>MODP-1024</option>
                                </select>
                        </td>
-                       <td></td>
+                       <td class='boldbase'>
+                               <select name='ESP_GROUPTYPE' multiple='multiple' size='6' style='width: 100%'>
+                                       <option value='e521' $checked{'ESP_GROUPTYPE'}{'e521'}>ECP-521 (NIST)</option>
+                                       <option value='e512bp' $checked{'ESP_GROUPTYPE'}{'e512bp'}>ECP-512 (Brainpool)</option>
+                                       <option value='e384' $checked{'ESP_GROUPTYPE'}{'e384'}>ECP-384 (NIST)</option>
+                                       <option value='e384bp' $checked{'ESP_GROUPTYPE'}{'e384bp'}>ECP-384 (Brainpool)</option>
+                                       <option value='e256' $checked{'ESP_GROUPTYPE'}{'e256'}>ECP-256 (NIST)</option>
+                                       <option value='e256bp' $checked{'ESP_GROUPTYPE'}{'e256bp'}>ECP-256 (Brainpool)</option>
+                                       <option value='e224' $checked{'ESP_GROUPTYPE'}{'e224'}>ECP-224 (NIST)</option>
+                                       <option value='e224bp' $checked{'ESP_GROUPTYPE'}{'e224bp'}>ECP-224 (Brainpool)</option>
+                                       <option value='e192' $checked{'ESP_GROUPTYPE'}{'e192'}>ECP-192 (NIST)</option>
+                                       <option value='8192' $checked{'ESP_GROUPTYPE'}{'8192'}>MODP-8192</option>
+                                       <option value='6144' $checked{'ESP_GROUPTYPE'}{'6144'}>MODP-6144</option>
+                                       <option value='4096' $checked{'ESP_GROUPTYPE'}{'4096'}>MODP-4096</option>
+                                       <option value='3072' $checked{'ESP_GROUPTYPE'}{'3072'}>MODP-3072</option>
+                                       <option value='2048s256' $checked{'ESP_GROUPTYPE'}{'2048s256'}>MODP-2048/256</option>
+                                       <option value='2048s224' $checked{'ESP_GROUPTYPE'}{'2048s224'}>MODP-2048/224</option>
+                                       <option value='2048s160' $checked{'ESP_GROUPTYPE'}{'2048s160'}>MODP-2048/160</option>
+                                       <option value='2048' $checked{'ESP_GROUPTYPE'}{'2048'}>MODP-2048</option>
+                                       <option value='1536' $checked{'ESP_GROUPTYPE'}{'1536'}>MODP-1536</option>
+                                       <option value='1024' $checked{'ESP_GROUPTYPE'}{'1024'}>MODP-1024</option>
+                                       <option value='none' $checked{'ESP_GROUPTYPE'}{'none'}>- $Lang::tr{'none'} -</option>
+                               </select>
+                       </td>
                </tr>
        </tbody>
     </table>
@@ -3039,6 +3088,14 @@ sub make_algos($$$$$) {
                                        if (!$is_aead) {
                                                push(@algo, $int);
                                        }
+
+                                       if ($grp eq "none") {
+                                               # noop
+                                       } elsif ($grp =~ m/^e(.*)$/) {
+                                               push(@algo, "ecp$1");
+                                       } else {
+                                               push(@algo, "modp$grp");
+                                       }
                                }
 
                                push(@algos, join("-", @algo));

diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl
index 7964644b78f1bf097b5e3060f6d2f70a026a8559..af7fda947e2b15c3ace8d0de4c0d28cecdaf660d 100644 (file)
--- a/langs/en/cgi-bin/en.pl
+++ b/langs/en/cgi-bin/en.pl
@@ -1645,6 +1645,7 @@
 'no modem selected' => 'No modem selected',
 'no set selected' => 'No set was selected',
 'no time limit' => 'unlimited time',
+'none' => 'none',
 'none found' => 'none found',
 'nonetworkname' => 'No Network Name entered',
 'noservicename' => 'No Service Name entered',