From mboxrd@z Thu Jan  1 00:00:00 1970
From: Michael Tremer <michael.tremer@ipfire.org>
To: development@lists.ipfire.org
Subject: Re: [PATCH] ipsec: Allow selection of ESP group type
Date: Sat, 13 Jun 2015 15:29:08 +0200
Message-ID: <1434202148.25208.276.camel@ipfire.org>
In-Reply-To: <1433269444-8615-1-git-send-email-michael.tremer@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============4051826513910989379=="
List-Id: <development.lists.ipfire.org>

--===============4051826513910989379==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Has anyone got any more feedback for this? Otherwise I would like to
merge this patch for Core Update 92.

Tested-by: Wolfgang Apolinarski <wolfgang.apolinarski(a)web.de>

https://bugzilla.ipfire.org/show_bug.cgi?id=3D10860

-Michael

On Tue, 2015-06-02 at 20:24 +0200, Michael Tremer wrote:
> If a connection is edited, the IKE group types will be used instead.
>=20
> Fixes #10860
>=20
> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
> ---
>  doc/language_issues.de   |  1 +
>  doc/language_issues.es   |  1 +
>  doc/language_issues.fr   |  1 +
>  doc/language_issues.it   |  1 +
>  doc/language_issues.nl   |  1 +
>  doc/language_issues.pl   |  1 +
>  doc/language_issues.ru   |  1 +
>  doc/language_issues.tr   |  1 +
>  html/cgi-bin/vpnmain.cgi | 73 ++++++++++++++++++++++++++++++++++++++++++--=
----
>  langs/en/cgi-bin/en.pl   |  1 +
>  10 files changed, 74 insertions(+), 8 deletions(-)
>=20
> diff --git a/doc/language_issues.de b/doc/language_issues.de
> index 90accb3c006a..0d86987569b5 100644
> --- a/doc/language_issues.de
> +++ b/doc/language_issues.de
> @@ -644,6 +644,7 @@ WARNING: untranslated string: fwhost cust geoipgrp
>  WARNING: untranslated string: fwhost err hostip
>  WARNING: untranslated string: ike lifetime should be between 1 and 8 hours
>  WARNING: untranslated string: no data
> +WARNING: untranslated string: none
>  WARNING: untranslated string: qos add subclass
>  WARNING: untranslated string: route config changed
>  WARNING: untranslated string: routing config added
> diff --git a/doc/language_issues.es b/doc/language_issues.es
> index fe8b726243ab..b0c066f644a3 100644
> --- a/doc/language_issues.es
> +++ b/doc/language_issues.es
> @@ -917,6 +917,7 @@ WARNING: untranslated string: most preferred
>  WARNING: untranslated string: nameserver
>  WARNING: untranslated string: no data
>  WARNING: untranslated string: no hardware random number generator
> +WARNING: untranslated string: none
>  WARNING: untranslated string: not a valid dh key
>  WARNING: untranslated string: notice
>  WARNING: untranslated string: openvpn default
> diff --git a/doc/language_issues.fr b/doc/language_issues.fr
> index fee481d25bb0..b13969b01705 100644
> --- a/doc/language_issues.fr
> +++ b/doc/language_issues.fr
> @@ -932,6 +932,7 @@ WARNING: untranslated string: most preferred
>  WARNING: untranslated string: nameserver
>  WARNING: untranslated string: no data
>  WARNING: untranslated string: no hardware random number generator
> +WARNING: untranslated string: none
>  WARNING: untranslated string: not a valid dh key
>  WARNING: untranslated string: notice
>  WARNING: untranslated string: ntp common settings
> diff --git a/doc/language_issues.it b/doc/language_issues.it
> index 2f61cb61b17c..c133fec1b84f 100644
> --- a/doc/language_issues.it
> +++ b/doc/language_issues.it
> @@ -705,6 +705,7 @@ WARNING: untranslated string: masquerading disabled
>  WARNING: untranslated string: masquerading enabled
>  WARNING: untranslated string: messages
>  WARNING: untranslated string: no data
> +WARNING: untranslated string: none
>  WARNING: untranslated string: outgoing compression in bytes per second
>  WARNING: untranslated string: outgoing overhead in bytes per second
>  WARNING: untranslated string: ovpn add conf
> diff --git a/doc/language_issues.nl b/doc/language_issues.nl
> index fadc79272f9b..692420e6b30b 100644
> --- a/doc/language_issues.nl
> +++ b/doc/language_issues.nl
> @@ -737,6 +737,7 @@ WARNING: untranslated string: modem status
>  WARNING: untranslated string: monitor interface
>  WARNING: untranslated string: nameserver
>  WARNING: untranslated string: no data
> +WARNING: untranslated string: none
>  WARNING: untranslated string: not a valid dh key
>  WARNING: untranslated string: outgoing compression in bytes per second
>  WARNING: untranslated string: outgoing overhead in bytes per second
> diff --git a/doc/language_issues.pl b/doc/language_issues.pl
> index fe8b726243ab..b0c066f644a3 100644
> --- a/doc/language_issues.pl
> +++ b/doc/language_issues.pl
> @@ -917,6 +917,7 @@ WARNING: untranslated string: most preferred
>  WARNING: untranslated string: nameserver
>  WARNING: untranslated string: no data
>  WARNING: untranslated string: no hardware random number generator
> +WARNING: untranslated string: none
>  WARNING: untranslated string: not a valid dh key
>  WARNING: untranslated string: notice
>  WARNING: untranslated string: openvpn default
> diff --git a/doc/language_issues.ru b/doc/language_issues.ru
> index a9e900134b79..f23b103e1642 100644
> --- a/doc/language_issues.ru
> +++ b/doc/language_issues.ru
> @@ -917,6 +917,7 @@ WARNING: untranslated string: most preferred
>  WARNING: untranslated string: nameserver
>  WARNING: untranslated string: no data
>  WARNING: untranslated string: no hardware random number generator
> +WARNING: untranslated string: none
>  WARNING: untranslated string: not a valid dh key
>  WARNING: untranslated string: notice
>  WARNING: untranslated string: openvpn default
> diff --git a/doc/language_issues.tr b/doc/language_issues.tr
> index d94953a84d93..8ec9e31295ec 100644
> --- a/doc/language_issues.tr
> +++ b/doc/language_issues.tr
> @@ -684,6 +684,7 @@ WARNING: untranslated string: incoming compression in b=
ytes per second
>  WARNING: untranslated string: incoming overhead in bytes per second
>  WARNING: untranslated string: invalid input for valid till days
>  WARNING: untranslated string: no data
> +WARNING: untranslated string: none
>  WARNING: untranslated string: outgoing compression in bytes per second
>  WARNING: untranslated string: outgoing overhead in bytes per second
>  WARNING: untranslated string: ovpn add conf
> diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi
> index 94900765f523..6458bf251920 100644
> --- a/html/cgi-bin/vpnmain.cgi
> +++ b/html/cgi-bin/vpnmain.cgi
> @@ -327,7 +327,13 @@ sub writeipsecfiles {
>  	if ($lconfighash{$key}[21] && $lconfighash{$key}[22]) {
>  		my @encs   =3D split('\|', $lconfighash{$key}[21]);
>  		my @ints   =3D split('\|', $lconfighash{$key}[22]);
> -		my @groups =3D split('\|', $lconfighash{$key}[20]);
> +		my @groups =3D split('\|', $lconfighash{$key}[23]);
> +
> +		# Use IKE grouptype if no ESP group type has been selected
> +		# (for backwards compatibility)
> +		if ($lconfighash{$key}[23] eq "") {
> +			@groups =3D split('\|', $lconfighash{$key}[20]);
> +		}
> =20
>  		my @algos =3D &make_algos("esp", \@encs, \@ints, \@groups, ($pfs eq "on"=
));
>  		print CONF "\tesp=3D" . join(",", @algos);
> @@ -1260,6 +1266,9 @@ END
>  	$cgiparams{'ESP_ENCRYPTION'} 	=3D $confighash{$cgiparams{'KEY'}}[21];
>  	$cgiparams{'ESP_INTEGRITY'}  	=3D $confighash{$cgiparams{'KEY'}}[22];
>  	$cgiparams{'ESP_GROUPTYPE'}  	=3D $confighash{$cgiparams{'KEY'}}[23];
> +	if ($cgiparams{'ESP_GROUPTYPE'} eq "") {
> +		$cgiparams{'ESP_GROUPTYPE'} =3D $cgiparams{'IKE_GROUPTYPE'};
> +	}
>  	$cgiparams{'ESP_KEYLIFE'}    	=3D $confighash{$cgiparams{'KEY'}}[17];
>  	$cgiparams{'COMPRESSION'}    	=3D $confighash{$cgiparams{'KEY'}}[13];
>  	$cgiparams{'ONLY_PROPOSED'}  	=3D $confighash{$cgiparams{'KEY'}}[24];
> @@ -1855,7 +1864,7 @@ END
>  	$cgiparams{'IKE_LIFETIME'}   =3D '3';		#[16];
>  	$cgiparams{'ESP_ENCRYPTION'} =3D 'aes256gcm128|aes256gcm96|aes256gcm64|ae=
s256|aes192gcm128|aes192gcm96|aes192gcm64|aes192|aes128gcm128|aes128gcm96|aes=
128gcm64|aes128';	#[21];
>  	$cgiparams{'ESP_INTEGRITY'}  =3D 'sha2_512|sha2_256|sha1';	#[22];
> -	$cgiparams{'ESP_GROUPTYPE'}  =3D '';		#[23];
> +	$cgiparams{'ESP_GROUPTYPE'}  =3D '4096|3072|2048|1536|1024';		#[23];
>  	$cgiparams{'ESP_KEYLIFE'}    =3D '1';		#[17];
>  	$cgiparams{'COMPRESSION'}    =3D 'on';		#[13];
>  	$cgiparams{'ONLY_PROPOSED'}  =3D 'off';		#[24];
> @@ -2165,13 +2174,17 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) =
||
>  		goto ADVANCED_ERROR;
>  	    }
>  	}
> -	if ($cgiparams{'ESP_GROUPTYPE'} ne '' &&
> -	    $cgiparams{'ESP_GROUPTYPE'} !~  /^ecp(192|224|256|384|512)(bp)?$/ &&
> -	    $cgiparams{'ESP_GROUPTYPE'} !~  /^modp(1024|1536|2048|2048s(256|224|1=
60)|3072|4096|6144|8192)$/) {
> +	@temp =3D split('\|', $cgiparams{'ESP_GROUPTYPE'});
> +	if ($#temp < 0) {
>  	    $errormessage =3D $Lang::tr{'invalid input'};
>  	    goto ADVANCED_ERROR;
>  	}
> -
> +	foreach my $val (@temp) {
> +	    if ($val !~ /^(e521|e384|e256|e224|e192|e512bp|e384bp|e256bp|e224bp|1=
024|1536|2048|2048s256|2048s224|2048s160|3072|4096|6144|8192|none)$/) {
> +		$errormessage =3D $Lang::tr{'invalid input'};
> +		goto ADVANCED_ERROR;
> +	    }
> +	}
>  	if ($cgiparams{'ESP_KEYLIFE'} !~ /^\d+$/) {
>  	    $errormessage =3D $Lang::tr{'invalid input for esp keylife'};
>  	    goto ADVANCED_ERROR;
> @@ -2234,6 +2247,9 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
>  	$cgiparams{'ESP_ENCRYPTION'} =3D $confighash{$cgiparams{'KEY'}}[21];
>  	$cgiparams{'ESP_INTEGRITY'}  =3D $confighash{$cgiparams{'KEY'}}[22];
>  	$cgiparams{'ESP_GROUPTYPE'}  =3D $confighash{$cgiparams{'KEY'}}[23];
> +	if ($cgiparams{'ESP_GROUPTYPE'} eq "") {
> +		$cgiparams{'ESP_GROUPTYPE'} =3D $cgiparams{'IKE_GROUPTYPE'};
> +	}
>  	$cgiparams{'ESP_KEYLIFE'}    =3D $confighash{$cgiparams{'KEY'}}[17];
>  	$cgiparams{'COMPRESSION'}    =3D $confighash{$cgiparams{'KEY'}}[13];
>  	$cgiparams{'ONLY_PROPOSED'}  =3D $confighash{$cgiparams{'KEY'}}[24];
> @@ -2323,7 +2339,17 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
>      $checked{'ESP_INTEGRITY'}{'aesxcbc'} =3D '';
>      @temp =3D split('\|', $cgiparams{'ESP_INTEGRITY'});
>      foreach my $key (@temp) {$checked{'ESP_INTEGRITY'}{$key} =3D "selected=
=3D'selected'"; }
> -    $checked{'ESP_GROUPTYPE'}{$cgiparams{'ESP_GROUPTYPE'}} =3D "selected=
=3D'selected'";
> +    $checked{'ESP_GROUPTYPE'}{'768'} =3D '';
> +    $checked{'ESP_GROUPTYPE'}{'1024'} =3D '';
> +    $checked{'ESP_GROUPTYPE'}{'1536'} =3D '';
> +    $checked{'ESP_GROUPTYPE'}{'2048'} =3D '';
> +    $checked{'ESP_GROUPTYPE'}{'3072'} =3D '';
> +    $checked{'ESP_GROUPTYPE'}{'4096'} =3D '';
> +    $checked{'ESP_GROUPTYPE'}{'6144'} =3D '';
> +    $checked{'ESP_GROUPTYPE'}{'8192'} =3D '';
> +    $checked{'ESP_GROUPTYPE'}{'none'} =3D '';
> +    @temp =3D split('\|', $cgiparams{'ESP_GROUPTYPE'});
> +    foreach my $key (@temp) {$checked{'ESP_GROUPTYPE'}{$key} =3D "selected=
=3D'selected'"; }
> =20
>      $checked{'COMPRESSION'} =3D $cgiparams{'COMPRESSION'} eq 'on' ? "check=
ed=3D'checked'" : '' ;
>      $checked{'ONLY_PROPOSED'} =3D $cgiparams{'ONLY_PROPOSED'} eq 'on' ? "c=
hecked=3D'checked'" : '' ;
> @@ -2484,7 +2510,30 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
>  					<option value=3D'1024' $checked{'IKE_GROUPTYPE'}{'1024'}>MODP-1024</o=
ption>
>  				</select>
>  			</td>
> -			<td></td>
> +			<td class=3D'boldbase'>
> +				<select name=3D'ESP_GROUPTYPE' multiple=3D'multiple' size=3D'6' style=
=3D'width: 100%'>
> +					<option value=3D'e521' $checked{'ESP_GROUPTYPE'}{'e521'}>ECP-521 (NIS=
T)</option>
> +					<option value=3D'e512bp' $checked{'ESP_GROUPTYPE'}{'e512bp'}>ECP-512 =
(Brainpool)</option>
> +					<option value=3D'e384' $checked{'ESP_GROUPTYPE'}{'e384'}>ECP-384 (NIS=
T)</option>
> +					<option value=3D'e384bp' $checked{'ESP_GROUPTYPE'}{'e384bp'}>ECP-384 =
(Brainpool)</option>
> +					<option value=3D'e256' $checked{'ESP_GROUPTYPE'}{'e256'}>ECP-256 (NIS=
T)</option>
> +					<option value=3D'e256bp' $checked{'ESP_GROUPTYPE'}{'e256bp'}>ECP-256 =
(Brainpool)</option>
> +					<option value=3D'e224' $checked{'ESP_GROUPTYPE'}{'e224'}>ECP-224 (NIS=
T)</option>
> +					<option value=3D'e224bp' $checked{'ESP_GROUPTYPE'}{'e224bp'}>ECP-224 =
(Brainpool)</option>
> +					<option value=3D'e192' $checked{'ESP_GROUPTYPE'}{'e192'}>ECP-192 (NIS=
T)</option>
> +					<option value=3D'8192' $checked{'ESP_GROUPTYPE'}{'8192'}>MODP-8192</o=
ption>
> +					<option value=3D'6144' $checked{'ESP_GROUPTYPE'}{'6144'}>MODP-6144</o=
ption>
> +					<option value=3D'4096' $checked{'ESP_GROUPTYPE'}{'4096'}>MODP-4096</o=
ption>
> +					<option value=3D'3072' $checked{'ESP_GROUPTYPE'}{'3072'}>MODP-3072</o=
ption>
> +					<option value=3D'2048s256' $checked{'ESP_GROUPTYPE'}{'2048s256'}>MODP=
-2048/256</option>
> +					<option value=3D'2048s224' $checked{'ESP_GROUPTYPE'}{'2048s224'}>MODP=
-2048/224</option>
> +					<option value=3D'2048s160' $checked{'ESP_GROUPTYPE'}{'2048s160'}>MODP=
-2048/160</option>
> +					<option value=3D'2048' $checked{'ESP_GROUPTYPE'}{'2048'}>MODP-2048</o=
ption>
> +					<option value=3D'1536' $checked{'ESP_GROUPTYPE'}{'1536'}>MODP-1536</o=
ption>
> +					<option value=3D'1024' $checked{'ESP_GROUPTYPE'}{'1024'}>MODP-1024</o=
ption>
> +					<option value=3D'none' $checked{'ESP_GROUPTYPE'}{'none'}>- $Lang::tr{=
'none'} -</option>
> +				</select>
> +			</td>
>  		</tr>
>  	</tbody>
>      </table>
> @@ -3029,6 +3078,14 @@ sub make_algos($$$$$) {
>  					if (!$is_aead) {
>  						push(@algo, $int);
>  					}
> +
> +					if ($grp eq "none") {
> +						# noop
> +					} elsif ($grp =3D~ m/^e(.*)$/) {
> +						push(@algo, "ecp$1");
> +					} else {
> +						push(@algo, "modp$grp");
> +					}
>  				}
> =20
>  				push(@algos, join("-", @algo));
> diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl
> index 43601c86eb22..19f5fdd1be94 100644
> --- a/langs/en/cgi-bin/en.pl
> +++ b/langs/en/cgi-bin/en.pl
> @@ -1645,6 +1645,7 @@
>  'no modem selected' =3D> 'No modem selected',
>  'no set selected' =3D> 'No set was selected',
>  'no time limit' =3D> 'unlimited time',
> +'none' =3D> 'none',
>  'none found' =3D> 'none found',
>  'nonetworkname' =3D> 'No Network Name entered',
>  'noservicename' =3D> 'No Service Name entered',

--===============4051826513910989379==
Content-Type: application/pgp-signature
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="signature.asc"
MIME-Version: 1.0

LS0tLS1CRUdJTiBQR1AgU0lHTkFUVVJFLS0tLS0KVmVyc2lvbjogR251UEcgdjIKCmlRSWNCQUFC
Q2dBR0JRSlZmREFuQUFvSkVJQjU4UDl2a0FrSG43c1FBSWJhcE4vK3Y1WnBqNlorcndEYTFZcFAK
bTVLOGhqaXBpMzNxMHh0VzNBSEowVlo0ZnJSdGlLYzdzRVJBNnRUT2Zvcy9NVnB5cCtuVE55Slcw
MXA2djUvZgpJenF6dHVrOTVQQ0N0OExQRDRCUFZCQXlCdldEQ2pyWHJHaGRKVk90bkM0MnlxVGtp
MmwrTFV6RUtoVXZ6Z1UxCkhLR2E4UlJpSTd3b3Z5TjZUVkhvNDdOOER2WVhpVkR1K1diWWxSOWJo
bThMRFpsRHRlQkFSOTNkR2k4a0xBckgKUFBFU29uU0k3U0xsMGJnSy9TRlppbWFBWGQzVWk0c2hq
dzBJdE1yeThIZzdPMDU3SkNxVDV0bzRyR05JN1dwLwpEU3Q3QzJMS1o5Szl6NVdTU2traXpMTitZ
Wkc1WDlBSjBGN3NWdU9rYWZSR3NSYVNXUkxMYUFWeWQ3dzluRytOClhwSDZsbGwzcmw3K3E0WWhq
d3V6czdVRXhnQkMySlFGQjNkSGhQOU9nSmFuV21EcWdGRkJ2TzVzZC9nenk1aHAKUzJlcTVKNDB0
ODBVekV3U3pFTFkvTXkxd0plbjRLT3hPTnV1VEg0SnNQbFJpZk5kWDlTNElFS0MvUWdiMUplMApw
eGpUak9mcFZ3WSt4VXlMdm1KWGpjeE44VHF6YU13OERkdnpnYnBKN3M1YW1JUVZrWXJSbjdIMEZL
djhscUpDCkJOelRwMncyVnJVQnFMZng4MGFtcjlub3orZ2RJd1dVM1VuOFJCTUczYTZoZTAwa3pB
dmhabVRMR0J2TmdPVkgKMjNrQUoxRmJDSnNnQXZFWUF0R2YwLzc3UFlYTDR4aWhJdXl3WDcxSVYv
NmVabC9BendpMGpMM3RMeG95UXc2cwpvL1BiY05rQmUvaGZKMWJBYWtTQQo9T1pPUgotLS0tLUVO
RCBQR1AgU0lHTkFUVVJFLS0tLS0K

--===============4051826513910989379==--