]> git.ipfire.org Git - people/ummeegge/ipfire-2.x.git/commit
Finit_field_DH-parameter: Add ffdhe 4096 bit standard group like published in RFC7919 ovpn_static_dh_RFC7919
authorErik Kapfer <erik.kapfer@ipfire.org>
Thu, 27 Jan 2022 18:43:15 +0000 (19:43 +0100)
committerErik Kapfer <erik.kapfer@ipfire.org>
Thu, 27 Jan 2022 18:43:15 +0000 (19:43 +0100)
commit2ccc799f8bd6a12c3edab5f1a89fab4d2cd05ea8
tree25e367392d7934f7cafa9ef828da0572d5fafa57
parente22b42571a0e5b7db76910c40dde099dfa961287
Finit_field_DH-parameter: Add ffdhe 4096 bit standard group like published in RFC7919

- Deleted Diffie-Hellman generation while PKI creation in ovpnmain.cgi (save imense time).
- Deleted Diffie-Hellman upload and generation section in ovpnmain.cgi
- Set static Diffie-Hellman parameter since custom ones are possibly abusable --> https://datatracker.ietf.org/doc/html/rfc7919.
- Standard Diffie-Hellman group will be added from -->
https://wiki.openssl.org/index.php/Diffie-Hellman_parameters#RFC_7919_Groups (static const char g_ffdhe4096_sz)
and integrated into the system while compilation of OpenSSL .
- New Diffie-Hellman location for OpenVPN is /etc/ssl/ffdhe4096.pem .

Update OpenVPN configurations converter Code for install.sh:

if pgrep -a openvpn | grep server.conf >/dev/null; then
     /usr/local/bin/openvpnctrl -k
     sed -i 's|/var/ipfire/ovpn/ca/dh1024.pem|/etc/ssl/ffdhe4096.pem|' /var/ipfire/ovpn/server.conf
     /usr/local/bin/openvpnctrl -s
else
     if [ -f /var/ipfire/ovpn/server.conf ]; then
          sed -i 's|/var/ipfire/ovpn/ca/dh1024.pem|/etc/ssl/ffdhe4096.pem|' /var/ipfire/ovpn/server.conf
     fi
fi

if pgrep -a openvpn | grep n2nconf >/dev/null; then
     /usr/local/bin/openvpnctrl -kn2n
     sed -i 's|/var/ipfire/ovpn/ca/dh1024.pem|/etc/ssl/ffdhe4096.pem|' /var/ipfire/ovpn/n2nconf/*/*.conf
     /usr/local/bin/openvpnctrl -sn2n
else
     if [ -f "/var/ipfire/ovpn/n2nconf/*/*.conf" ]; then
          sed -i 's|/var/ipfire/ovpn/ca/dh1024.pem|/etc/ssl/ffdhe4096.pem|' /var/ipfire/ovpn/n2nconf/*/*.conf
     fi
fi

rm -f /var/ipfire/ca/dh1024.pem

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
config/rootfiles/common/openssl
config/ssl/ffdhe4096.pem [new file with mode: 0644]
html/cgi-bin/ovpnmain.cgi
langs/de/cgi-bin/de.pl
langs/en/cgi-bin/en.pl
lfs/openssl