From fe787fc76100da46ad49756b471affecc625e20d Mon Sep 17 00:00:00 2001
From: Matthew Grooms <mgrooms@pfsense.org>
Date: Tue, 9 Sep 2008 20:32:56 +0000
Subject: [PATCH] Modify the OpenVPN server configuration to allow the DH
 parameter length to be specified. Upgraded 1.2.x configurations will default
 to 1024 bits.

---
 etc/inc/config.inc                   |  1 +
 etc/inc/openvpn.inc                  |  5 ++++-
 usr/local/www/vpn_openvpn_server.php | 31 ++++++++++++++++++++++++----
 3 files changed, 32 insertions(+), 5 deletions(-)

diff --git a/etc/inc/config.inc b/etc/inc/config.inc
index 62a6a89130..58c138bb3e 100644
--- a/etc/inc/config.inc
+++ b/etc/inc/config.inc
@@ -1758,6 +1758,7 @@ endif;
 				unset($server['auth_method']);
 
 				/* modify configuration values */
+				$server['dh_length'] = 1024;
 				unset($server['dh_params']);
 				if (!$server['interface'])
 					$server['interface'] = 'wan';
diff --git a/etc/inc/openvpn.inc b/etc/inc/openvpn.inc
index 70ecac48e8..543f1ee76b 100644
--- a/etc/inc/openvpn.inc
+++ b/etc/inc/openvpn.inc
@@ -62,6 +62,9 @@ $openvpn_prots = array("UDP", "TCP");
  * -mgrooms
  */
 
+$openvpn_dh_lengths = array(
+	1024, 2048, 4096 );
+
 $openvpn_server_modes = array(
 	'p2p_tls' => "Peer to Peer ( SSL/TLS )",
 	'p2p_shared_key' => "Peer to Peer ( Shared Key )",
@@ -446,7 +449,7 @@ function openvpn_reconfigure($mode,& $settings) {
 			openvpn_add_keyfile($cert['crt'], $conf, $mode_id, "cert");
 			openvpn_add_keyfile($cert['prv'], $conf, $mode_id, "key");
 			if ($mode == 'server')
-				$conf .= "dh {$g['etc_path']}/dh-parameters.2048\n";
+				$conf .= "dh {$g['etc_path']}/dh-parameters.{$settings['dh_length']}\n";
 			if ($settings['crl'])
 				openvpn_add_keyfile($settings['crl'], $conf, $mode_id, "crl-verify");
 			if ($settings['tls'])
diff --git a/usr/local/www/vpn_openvpn_server.php b/usr/local/www/vpn_openvpn_server.php
index 60cefceded..d5c5810bad 100644
--- a/usr/local/www/vpn_openvpn_server.php
+++ b/usr/local/www/vpn_openvpn_server.php
@@ -69,6 +69,7 @@ if($_GET['act']=="new"){
 	$pconfig['autokey_enable'] = "yes";
 	$pconfig['tlsauth_enable'] = "yes";
 	$pconfig['autotls_enable'] = "yes";
+	$pconfig['dh_length'] = 1024;
 	$pconfig['interface'] = "wan";
 	$pconfig['local_port'] = openvpn_port_next('UDP');
 	$pconfig['pool_enable'] = "yes";
@@ -86,12 +87,13 @@ if($_GET['act']=="edit"){
 		$pconfig['description'] = $a_server[$id]['description'];
 
 		if ($pconfig['mode'] != "p2p_shared_key") {
-			$pconfig['caref'] = $a_server[$id]['caref'];
-			$pconfig['certref'] = $a_server[$id]['certref'];
 			if ($a_server[$id]['tls']) {
 				$pconfig['tlsauth_enable'] = "yes";
 				$pconfig['tls'] = base64_decode($a_server[$id]['tls']);
 			}
+			$pconfig['caref'] = $a_server[$id]['caref'];
+			$pconfig['certref'] = $a_server[$id]['certref'];
+			$pconfig['dh_length'] = $a_server[$id]['dh_length'];
 		} else
 			$pconfig['shared_key'] = base64_decode($a_server[$id]['shared_key']);
 		$pconfig['crypto'] = $a_server[$id]['crypto'];
@@ -255,13 +257,14 @@ if ($_POST) {
 		$server['description'] = $pconfig['description'];
 
 		if ($tls_mode) {
-			$server['caref'] = $pconfig['caref'];
-			$server['certref'] = $pconfig['certref'];
 			if ($pconfig['tlsauth_enable']) {
 				if ($pconfig['autotls_enable'])
 					$pconfig['tls'] = openvpn_create_key();
 				$server['tls'] = base64_encode($pconfig['tls']);
 			}
+			$server['caref'] = $pconfig['caref'];
+			$server['certref'] = $pconfig['certref'];
+			$server['dh_length'] = $pconfig['dh_length'];
 		} else {
 			if ($pconfig['autokey_enable'])
 				$pconfig['shared_key'] = openvpn_create_key();
@@ -343,12 +346,14 @@ function mode_change() {
 			document.getElementById("tls").style.display="";
 			document.getElementById("tls_ca").style.display="";
 			document.getElementById("tls_cert").style.display="";
+			document.getElementById("tls_dh").style.display="";
 			document.getElementById("psk").style.display="none";
 			break;
 		case "p2p_shared_key":
 			document.getElementById("tls").style.display="none";
 			document.getElementById("tls_ca").style.display="none";
 			document.getElementById("tls_cert").style.display="none";
+			document.getElementById("tls_dh").style.display="none";
 			document.getElementById("psk").style.display="";
 			break;
 	}
@@ -644,6 +649,24 @@ function netbios_change() {
 							</select>
 						</td>
 					</tr>
+					<tr id="tls_dh">
+						<td width="22%" valign="top" class="vncellreq">DH Parameters Length</td>
+						<td width="78%" class="vtable">
+							<select name="dh_length" class="formselect">
+								<?php
+									foreach ($openvpn_dh_lengths as $length):
+									$selected = '';
+									if ($length == $pconfig['dh_length'])
+										$selected = ' selected';
+								?>
+								<option<?=$selected?>><?=$length;?></option>
+								<?php endforeach; ?>
+							</select>
+							<span class="vexpl">
+								bits
+							</span>
+						</td>
+					</tr>
 					<tr id="psk">
 						<td width="22%" valign="top" class="vncellreq">Shared Key</td>
 						<td width="78%" class="vtable">