From mboxrd@z Thu Jan  1 00:00:00 1970
From: IT Superhack <itsuperhack@web.de>
To: development@lists.ipfire.org
Subject: [PATCH] Disallow OpenVPN DH params less than 1024 bits
Date: Mon, 23 Nov 2015 15:18:23 +0100
Message-ID: <5653202F.1050604@web.de>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============0083561235342375003=="
List-Id: <development.lists.ipfire.org>

--===============0083561235342375003==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit

The OpenVPN CGI offers to create a DH param. The patch below disables
the generation of 1024 bit params and marks 2048 bit params as
weak/insecure.

It is recommended to use DH params with at least 3072 bits, shorter ones
are considered as insecure. The patch does not affect systems where
already DH params were created.

Sorry for the crappy line breaks by my mail agent, but it cannot switch
this off and git send-email does not work on my system (starttls issues).

Signed-off-by: Timmothy Wilson <itsuperhack(a)web.de>
---
 html/cgi-bin/ovpnmain.cgi | 3 +--
 langs/de/cgi-bin/de.pl    | 1 +
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi
index 62af54e..4813128 100644
--- a/html/cgi-bin/ovpnmain.cgi
+++ b/html/cgi-bin/ovpnmain.cgi
@@ -1313,8 +1313,7 @@ END
 		<form method='post'><input type='hidden' name='AREUSURE' value='yes' />
 		<input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
 			<select name='DHLENGHT'>
-				<option value='1024' $selected{'DHLENGHT'}{'1024'}>1024
$Lang::tr{'bit'}</option>
-				<option value='2048' $selected{'DHLENGHT'}{'2048'}>2048
$Lang::tr{'bit'}</option>
+				<option value='2048' $selected{'DHLENGHT'}{'2048'}>2048
$Lang::tr{'bit'} ($Lang::tr{'insecure'})</option>
 				<option value='3072' $selected{'DHLENGHT'}{'3072'}>3072
$Lang::tr{'bit'}</option>
 				<option value='4096' $selected{'DHLENGHT'}{'4096'}>4096
$Lang::tr{'bit'}</option>
 			</select>
diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl
index 2bca854..bfed92b 100644
--- a/langs/de/cgi-bin/de.pl
+++ b/langs/de/cgi-bin/de.pl
@@ -1291,6 +1291,7 @@
 'incorrect password' => 'Fehlerhaftes Passwort',
 'info' => 'Info',
 'init string' => 'Initialisierung:',
+'insecure' => 'unsicher',
 'insert floppy' => 'Legen Sie eine formatierte Diskette in das
Floppy-Laufwerk in IPFire und klicken auf <i>Datensicherung auf
Diskette</i>, um die Systemeinstellungen zu sichern.  Überprüfen Sie das
Ergebnis sorgfältig, um sicher zu sein, dass die Datensicherung
vollständig und erfolgreich abgeschlossen wurde.',
 'install' => 'Installieren',
 'install new update' => 'Installiere neues Update:',
-- 
1.8.4.5



--===============0083561235342375003==
Content-Type: application/pgp-signature
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="signature.asc"
MIME-Version: 1.0

LS0tLS1CRUdJTiBQR1AgU0lHTkFUVVJFLS0tLS0KCmlRRWNCQUVCQ2dBR0JRSldVeUExQUFvSkVP
eUxhMUM1RWF6cmhaSUlBTG9YSnp3RTlDUzB4dVpxcW9hS3Y1Qm0KazdMcndpc3RINmVCUXYyS2JZ
cXZaV3VRdmE5OTFhNUtrQWFNSWdOWExDZUFEZTVrTmJJMmtXVTcrV0IyekhwRQoxT2NiK2c0aUVO
VVpSWmlJQy9vUEluZWNUVDg3NFBBekhFRjJHSEtsMVdCUVZGTEEyK21jbE5USUdVQy9CcHFyCjRU
SE1lcC9VNGtKQjh2QXN0UHVyUENjMm96ZW5BWjdPSGQ3NytxODY1cmFwWTVVUnlxQ3B2TGZhUGlF
Ni84NjEKY2FOaFVwZEFaQmNPY0ZWZTdoL2hFenBWemtkdjFzU1JpV0wvdGIxbWQ1U1FxTFpQdGR1
azdlMjFGYzl6L0U0bApBclNpc09aSnVucG5Pd3ZTTk9RM3c5VGZMK1ZDSitIbnpsWFRiaHgySzNj
OVFYVjdwM3pDYTZjRDhhb2dYemM9Cj1xQ3YzCi0tLS0tRU5EIFBHUCBTSUdOQVRVUkUtLS0tLQo=

--===============0083561235342375003==--