mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add input validation to prevent the use of AES > 128 where glxsb is enabled. Ticket #4361

Browse Source
This commit is contained in:
Chris Buechler 2015-01-31 16:30:19 -06:00
parent fdc9ac09ef
commit 76a9ad942e
2 changed files with 16 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
usr/local/www/vpn_ipsec_phase1.php
View File

@ -328,6 +328,13 @@ if ($_POST) {
if (!empty($pconfig['iketype']) && $pconfig['iketype'] != "ikev1" && $pconfig['iketype'] != "ikev2" && $pconfig['iketype'] != "auto")
$input_errors[] = gettext("Valid arguments for IKE type is v1 or v2 or auto");
if (!empty($_POST['ealgo']) && isset($config['system']['crypto_hardware'])) {
if ($config['system']['crypto_hardware'] == "glxsb") {
if ($_POST['ealgo'] == "aes" && $_POST['ealgo_keylen'] != "128")
$input_errors[] = gettext("Only 128 bit AES can be used where the glxsb crypto accelerator is enabled.");
}
}
/* build our encryption algorithms array */
$pconfig['ealgo'] = array();

12
usr/local/www/vpn_ipsec_phase2.php
View File

@ -142,7 +142,7 @@ if ($_POST) {
}
do_input_validation($_POST, $reqdfields, $reqdfieldsn, $input_errors);
if(($pconfig['mode'] == "tunnel") || ($pconfig['mode'] == "tunnel6"))
{
switch ($pconfig['localid_type']) {
@ -300,8 +300,14 @@ if ($_POST) {
if (!count($ealgos)) {
$input_errors[] = gettext("At least one encryption algorithm must be selected.");
} else {
if (empty($pconfig['halgos'])) {
foreach ($ealgos as $ealgo) {
foreach ($ealgos as $ealgo) {
if (isset($config['system']['crypto_hardware'])) {
if ($config['system']['crypto_hardware'] == "glxsb") {
if ($ealgo['name'] == "aes" && $ealgo['keylen'] != "128")
$input_errors[] = gettext("Only 128 bit AES can be used where the glxsb crypto accelerator is enabled.");
}
}
if (empty($pconfig['halgos'])) {
if (!strpos($ealgo['name'], "gcm")) {
$input_errors[] = gettext("At least one hashing algorithm needs to be selected.");
break;