From mboxrd@z Thu Jan  1 00:00:00 1970
From: Erik Kapfer <ummeegge@ipfire.org>
To: development@lists.ipfire.org
Subject: [PATCH 1/2] ovpn: Generate ta.key before dh-parameter
Date: Wed, 18 Sep 2019 07:03:33 +0200
Message-ID: <20190918050334.10792-1-ummeegge@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============2625355025416835034=="
List-Id: <development.lists.ipfire.org>

--===============2625355025416835034==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Fixes: #11964 and #12157

If slow boards or/and boards with low entropy needs too long to generate the =
DH-parameter, ovpnmain.cgi can get into a
"Script timed out before returning headers" and no further OpenSSl commands w=
ill be executed after dhparam is finished.
Since the ta.key are created after the DH-parameter, it won=C2=B4t be produce=
d in that case.
To prevent this, the DH-parameter will now be generated at the end.

Signed-off-by: Erik Kapfer <ummeegge(a)ipfire.org>
---
 html/cgi-bin/ovpnmain.cgi | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi
index 439390228..5de80b269 100644
--- a/html/cgi-bin/ovpnmain.cgi
+++ b/html/cgi-bin/ovpnmain.cgi
@@ -1947,6 +1947,13 @@ END
 #	} else {
 #	    &cleanssldatabase();
 	}
+	# Create ta.key for tls-auth
+	system('/usr/sbin/openvpn', '--genkey', '--secret', "${General::swroot}/ovp=
n/certs/ta.key");
+	if ($?) {
+	    $errormessage =3D "$Lang::tr{'openssl produced an error'}: $?";
+	    &cleanssldatabase();
+	    goto ROOTCERT_ERROR;
+	}
 	# Create Diffie Hellmann Parameter
 	system('/usr/bin/openssl', 'dhparam', '-out', "${General::swroot}/ovpn/ca/d=
h1024.pem", "$cgiparams{'DHLENGHT'}");
 	if ($?) {
@@ -1961,13 +1968,6 @@ END
 #	} else {
 #	    &cleanssldatabase();
 	}
-	# Create ta.key for tls-auth
-	system('/usr/sbin/openvpn', '--genkey', '--secret', "${General::swroot}/ovp=
n/certs/ta.key");
-	if ($?) {
-	    $errormessage =3D "$Lang::tr{'openssl produced an error'}: $?";
-	    &cleanssldatabase();
-	    goto ROOTCERT_ERROR;
-	}
 	goto ROOTCERT_SUCCESS;
     }
     ROOTCERT_ERROR:
--=20
2.12.2


--===============2625355025416835034==--