From ba1f99cd6d8915bcaa84c10baab070cd8ccf0d99 Mon Sep 17 00:00:00 2001
From: Sean McBride <sean@rogue-research.com>
Date: Sat, 21 Apr 2018 16:43:32 -0400
Subject: [PATCH] Improve/add help messages warning about bad security choices

---
 src/usr/local/www/vpn_ipsec_phase1.php |  1 +
 src/usr/local/www/vpn_ipsec_phase2.php | 14 ++++++++++----
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/src/usr/local/www/vpn_ipsec_phase1.php b/src/usr/local/www/vpn_ipsec_phase1.php
index 887c77676c..92a2836160 100644
--- a/src/usr/local/www/vpn_ipsec_phase1.php
+++ b/src/usr/local/www/vpn_ipsec_phase1.php
@@ -851,6 +851,7 @@ foreach($pconfig['encryption']['item'] as $key => $p1enc) {
 	$section->add($group);
 	$counter += 1;
 }
+$section->setHelp('Note: Blowfish, 3DES, CAST128, MD5, SHA1, and DH groups 1, 2, 22, 23, and 24 provide weak security and should be avoided.');
 $form->add($section);
 
 $btnaddopt = new Form_Button(
diff --git a/src/usr/local/www/vpn_ipsec_phase2.php b/src/usr/local/www/vpn_ipsec_phase2.php
index f69b55b370..87ba466cf4 100644
--- a/src/usr/local/www/vpn_ipsec_phase2.php
+++ b/src/usr/local/www/vpn_ipsec_phase2.php
@@ -595,7 +595,7 @@ $section->addInput(new Form_Select(
 	'*Protocol',
 	$pconfig['proto'],
 	$p2_protos
-))->setHelp('ESP is encryption, AH is authentication only.');
+))->setHelp('Encapsulating Security Payload (ESP) is encryption, Authentication Header (AH) is authentication only.');
 
 $i = 0;
 $rows = count($p2_ealgos) - 1;
@@ -632,7 +632,7 @@ foreach ($p2_ealgos as $algo => $algodata) {
 
 
 	if ($i == $rows) {
-		$group->setHelp('Use 3DES for best compatibility or for a hardware crypto accelerator card. Blowfish is usually the fastest in software encryption.');
+		$group->setHelp('Note: Blowfish, 3DES, and CAST128 provide weak security and should be avoided.');
 	}
 
 	$i++;
@@ -650,6 +650,8 @@ foreach ($p2_halgos as $algo => $algoname) {
 		(empty($pconfig['halgos']) ? '' : in_array($algo, $pconfig['halgos'])),
 		$algo
 	))->addClass('multi')->setAttribute('id');
+
+	$group->setHelp('Note: MD5 and SHA1 provide weak security and should be avoided.');
 }
 
 $section->add($group);
@@ -661,14 +663,18 @@ $section->addInput(new Form_Select(
 	'PFS key group',
 	$pconfig['pfsgroup'],
 	$sm ? $p2_pfskeygroups:array()
-))->setHelp($sm ? '':'Set globally in mobile client options');
+));
+
+$helpstr = $sm ? '':'Set globally in mobile client options. ';
+$helpstr .= 'Note: Groups 1, 2, 22, 23, and 24 provide weak security and should be avoided.';
+$section->setHelp($helpstr);
 
 $section->addInput(new Form_Input(
 	'lifetime',
 	'Lifetime',
 	'number',
 	$pconfig['lifetime']
-))->setHelp('Seconds');
+))->setHelp('Specifies how often the connection must be rekeyed, in seconds');
 
 $form->add($section);