mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Modify the OpenVPN server configuration to allow the DH parameter length

Browse Source 
to be specified. Upgraded 1.2.x configurations will default to 1024 bits.
This commit is contained in:
Matthew Grooms 2008-09-09 20:32:56 +00:00
parent 15b414e6b4
commit fe787fc761
3 changed files with 32 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
etc/inc/config.inc
View File

@ -1758,6 +1758,7 @@ endif;
unset($server['auth_method']);
/* modify configuration values */
$server['dh_length'] = 1024;
unset($server['dh_params']);
if (!$server['interface'])
$server['interface'] = 'wan';

5
etc/inc/openvpn.inc
View File

@ -62,6 +62,9 @@ $openvpn_prots = array("UDP", "TCP");
* -mgrooms
*/
$openvpn_dh_lengths = array(
1024, 2048, 4096 );
$openvpn_server_modes = array(
'p2p_tls' => "Peer to Peer ( SSL/TLS )",
'p2p_shared_key' => "Peer to Peer ( Shared Key )",
@ -446,7 +449,7 @@ function openvpn_reconfigure($mode,& $settings) {
openvpn_add_keyfile($cert['crt'], $conf, $mode_id, "cert");
openvpn_add_keyfile($cert['prv'], $conf, $mode_id, "key");
if ($mode == 'server')
$conf .= "dh {$g['etc_path']}/dh-parameters.2048\n";
$conf .= "dh {$g['etc_path']}/dh-parameters.{$settings['dh_length']}\n";
if ($settings['crl'])
openvpn_add_keyfile($settings['crl'], $conf, $mode_id, "crl-verify");
if ($settings['tls'])

31
usr/local/www/vpn_openvpn_server.php
View File

@ -69,6 +69,7 @@ if($_GET['act']=="new"){
$pconfig['autokey_enable'] = "yes";
$pconfig['tlsauth_enable'] = "yes";
$pconfig['autotls_enable'] = "yes";
$pconfig['dh_length'] = 1024;
$pconfig['interface'] = "wan";
$pconfig['local_port'] = openvpn_port_next('UDP');
$pconfig['pool_enable'] = "yes";
@ -86,12 +87,13 @@ if($_GET['act']=="edit"){
$pconfig['description'] = $a_server[$id]['description'];
if ($pconfig['mode'] != "p2p_shared_key") {
$pconfig['caref'] = $a_server[$id]['caref'];
$pconfig['certref'] = $a_server[$id]['certref'];
if ($a_server[$id]['tls']) {
$pconfig['tlsauth_enable'] = "yes";
$pconfig['tls'] = base64_decode($a_server[$id]['tls']);
}
$pconfig['caref'] = $a_server[$id]['caref'];
$pconfig['certref'] = $a_server[$id]['certref'];
$pconfig['dh_length'] = $a_server[$id]['dh_length'];
} else
$pconfig['shared_key'] = base64_decode($a_server[$id]['shared_key']);
$pconfig['crypto'] = $a_server[$id]['crypto'];
@ -255,13 +257,14 @@ if ($_POST) {
$server['description'] = $pconfig['description'];
if ($tls_mode) {
$server['caref'] = $pconfig['caref'];
$server['certref'] = $pconfig['certref'];
if ($pconfig['tlsauth_enable']) {
if ($pconfig['autotls_enable'])
$pconfig['tls'] = openvpn_create_key();
$server['tls'] = base64_encode($pconfig['tls']);
}
$server['caref'] = $pconfig['caref'];
$server['certref'] = $pconfig['certref'];
$server['dh_length'] = $pconfig['dh_length'];
} else {
if ($pconfig['autokey_enable'])
$pconfig['shared_key'] = openvpn_create_key();
@ -343,12 +346,14 @@ function mode_change() {
document.getElementById("tls").style.display="";
document.getElementById("tls_ca").style.display="";
document.getElementById("tls_cert").style.display="";
document.getElementById("tls_dh").style.display="";
document.getElementById("psk").style.display="none";
break;
case "p2p_shared_key":
document.getElementById("tls").style.display="none";
document.getElementById("tls_ca").style.display="none";
document.getElementById("tls_cert").style.display="none";
document.getElementById("tls_dh").style.display="none";
document.getElementById("psk").style.display="";
break;
}
@ -644,6 +649,24 @@ function netbios_change() {
</select>
</td>
</tr>
<tr id="tls_dh">
<td width="22%" valign="top" class="vncellreq">DH Parameters Length</td>
<td width="78%" class="vtable">
<select name="dh_length" class="formselect">
<?php
foreach ($openvpn_dh_lengths as $length):
$selected = '';
if ($length == $pconfig['dh_length'])
$selected = ' selected';
?>
<option<?=$selected?>><?=$length;?></option>
<?php endforeach; ?>
</select>
<span class="vexpl">
bits
</span>
</td>
</tr>
<tr id="psk">
<td width="22%" valign="top" class="vncellreq">Shared Key</td>
<td width="78%" class="vtable">