webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-22 17:02:58 +02:00
Code Issues Packages Projects Releases Wiki Activity

OpenVPN: x509 and DH-parameter check with Warnings and error messages in WUI

Browse Source 
Changes includes:
Own crypto warning and error message in WUI (can be extended to configuration too).
Check if DH-parameter is < 2048 bit with an error message and howto fix it.
Check if md5 is still in use with an error message and suggestion how to proceed further to fix it.
Check for soon needed RFC3280 TLS rules compliants and suggestion how to proceed further to fix it.
Disabled 1024 bit DH-parameter upload.
Changed de and en language files for DH-parameter upload (deleted 1024 bit).
Added explanations to de and en language files for the above changes.
Fixed Typo in en language file.

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This commit is contained in:
Erik Kapfer
2018-06-27 09:34:21 +02:00
committed by Michael Tremer
parent 55d590518d
commit 400c8afd98
3 changed files with 74 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

61
html/cgi-bin/ovpnmain.cgi
View File

@@ -64,6 +64,8 @@ my %cahash=();
my %selected=();
my $warnmessage = '';
my $errormessage = '';
my $cryptoerror = '';
my $cryptowarning = '';
my %settings=();
my $routes_push_file = '';
my $confighost="${General::swroot}/fwhosts/customhosts";
@@ -97,6 +99,8 @@ $cgiparams{'DCIPHER'} = '';
$cgiparams{'DAUTH'} = '';
$cgiparams{'TLSAUTH'} = '';
$routes_push_file = "${General::swroot}/ovpn/routes_push";
# Perform crypto and configration test
&pkiconfigcheck;
# Add CCD files if not already presant
unless (-e $routes_push_file) {
@@ -199,6 +203,45 @@ sub deletebackupcert
}
}
###
### Check for PKI and configure problems
###
sub pkiconfigcheck
{
# Warning if DH parameter is 1024 bit
if (-f "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}") {
my $dhparameter = `/usr/bin/openssl dhparam -text -in ${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}`;
my @dhbit = ($dhparameter =~ /(\d+)/);
if ($1 < 2048) {
$cryptoerror = "$Lang::tr{'ovpn error dh'}";
goto CRYPTO_ERROR;
}
}
# Warning if md5 is in usage
if (-f "${General::swroot}/ovpn/certs/servercert.pem") {
my $signature = `/usr/bin/openssl x509 -noout -text -in ${General::swroot}/ovpn/certs/servercert.pem`;
if ($signature =~ /md5WithRSAEncryption/) {
$cryptoerror = "$Lang::tr{'ovpn error md5'}";
goto CRYPTO_ERROR;
}
}
CRYPTO_ERROR:
# Warning if certificate is not compliant to RFC3280 TLS rules
if (-f "${General::swroot}/ovpn/certs/servercert.pem") {
my $extendkeyusage = `/usr/bin/openssl x509 -noout -text -in ${General::swroot}/ovpn/certs/servercert.pem`;
if ($extendkeyusage !~ /TLS Web Server Authentication/) {
$cryptowarning = "$Lang::tr{'ovpn warning rfc3280'}";
goto CRYPTO_WARNING;
}
}
CRYPTO_WARNING:
}
sub writeserverconf {
my %sovpnsettings = ();
my @temp = ();
@@ -1069,7 +1112,7 @@ unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General
close(CLIENTCONF);
}
###
### Save main settings
###
@@ -1336,7 +1379,7 @@ END
goto UPLOADCA_ERROR;
}
my $temp = `/usr/bin/openssl dhparam -text -in $filename`;
if ($temp !~ /DH Parameters: \((1024|2048|3072|4096) bit\)/) {
if ($temp !~ /DH Parameters: \((2048|3072|4096) bit\)/) {
$errormessage = $Lang::tr{'not a valid dh key'};
unlink ($filename);
goto UPLOADCA_ERROR;
@@ -5135,6 +5178,20 @@ END
&Header::closebox();
}
if ($cryptoerror) {
&Header::openbox('100%', 'LEFT', $Lang::tr{'crypto error'});
print "<class name='base'>$cryptoerror";
print "&nbsp;</class>";
&Header::closebox();
}
if ($cryptowarning) {
&Header::openbox('100%', 'LEFT', $Lang::tr{'crypto warning'});
print "<class name='base'>$cryptowarning";
print "&nbsp;</class>";
&Header::closebox();
}
if ($warnmessage) {
&Header::openbox('100%', 'LEFT', $Lang::tr{'warning messages'});
print "$warnmessage<br>";