vpnmain.cgi: Fix wrong cipher suite generation when PFS is disabled

Fixes: #12091
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi
index ecf860d85b5ab90ab4036547677f5d4c1b19b59a..4b737b3a8265911fb5581c2906749dc89861f707 100644 (file)
--- a/html/cgi-bin/vpnmain.cgi
+++ b/html/cgi-bin/vpnmain.cgi
@@ -3331,14 +3331,14 @@ sub make_algos($$$$$) {
                                                push(@algo, "modp$grp");
                                        }
 
-                               } elsif ($mode eq "esp" && $pfs) {
+                               } elsif ($mode eq "esp") {
                                        my $is_aead = ($enc =~ m/[cg]cm/);
 
                                        if (!$is_aead) {
                                                push(@algo, $int);
                                        }
 
-                                       if ($grp eq "none") {
+                                       if ($pfs || $grp eq "none") {
                                                # noop
                                        } elsif ($grp =~ m/^e(.*)$/) {
                                                push(@algo, "ecp$1");