From patchwork Sun Apr 28 00:05:51 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: ummeegge X-Patchwork-Id: 2220 Return-Path: Received: from mail01.ipfire.org (mail01.i.ipfire.org [172.28.1.200]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mail01.ipfire.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by web07.i.ipfire.org (Postfix) with ESMTPS id 7C3A085BD82 for ; Sat, 27 Apr 2019 15:06:18 +0100 (BST) Received: from mail01.i.ipfire.org (localhost [IPv6:::1]) by mail01.ipfire.org (Postfix) with ESMTP id 44rt4n74Qnz57vrG; Sat, 27 Apr 2019 15:06:17 +0100 (BST) Received: from ipfire-server.local (i59F5F781.versanet.de [89.245.247.129]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mail01.ipfire.org (Postfix) with ESMTPSA id 44rt4W1z0gz57vr2; Sat, 27 Apr 2019 15:06:03 +0100 (BST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=201904rsa; t=1556373963; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:in-reply-to: references:references:openpgp:autocrypt; bh=cwr++8IB906MHkEthLVuiHxLRy0MrhZNCTzm9lGYcWg=; b=amPuCURIdAHoCVZp1PTQRCQysG/HsDh7ytuyjOjAXslgobMlwOEMxCwoucgqoYr/5dIRVm 9zQSsBT5JhPbKGnTnfyFNZkLXUdgLIWyzAbe2PDzzTSMdWmm80Ax0fAnWR+9kUll8nkNY0 oGBTZSEmVeYtZBY67lzhWBSV9ieYujDqmE9pwD2Qu50Ys4JzUuJQ4tAxszPokULclhYqLW LCyG6KYidD7XCfd+Tyu6HzgAyf6NY5QqifVKY93GZ3ZYv7ZW05CiYojClJnHCXbFoHl3f/ TgoqwTgM9z3nwy04S5ylPTcKds8M1rK4/BX/VDbgE6oeKmAQf2YQ3ipgvMpVWg== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=201904ed25519; t=1556373963; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:in-reply-to: references:references:openpgp:autocrypt; bh=cwr++8IB906MHkEthLVuiHxLRy0MrhZNCTzm9lGYcWg=; b=78gn9uNrDApaxs0TLbxNMkLTQj3A9EjqkVuyyuSEscVKjMgV1kWyHLK6XYyoK5IMl2gVQK 17MuPS/DbZ1DCgCw== From: Erik Kapfer To: development@lists.ipfire.org Subject: [PATCH 3/3] ovpn_reorganize_encryption: Integrate LZO from global to advanced section Date: Sat, 27 Apr 2019 16:05:51 +0200 Message-Id: <20190427140551.10647-3-ummeegge@ipfire.org> X-Mailer: git-send-email 2.12.2 In-Reply-To: <20190427140551.10647-1-ummeegge@ipfire.org> References: <20190427140551.10647-1-ummeegge@ipfire.org> Authentication-Results: mail01.ipfire.org; auth=pass smtp.auth=ummeegge smtp.mailfrom=ummeegge@ipfire.org X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: development-bounces@lists.ipfire.org Sender: "Development" Fixes: #11819 - Since the Voracle vulnerability, LZO is better placed under advanced section cause under specific circumstances it is exploitable. - Warning/hint has been added in the option defaults description. Signed-off-by: Erik Kapfer --- html/cgi-bin/ovpnmain.cgi | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi index d7895e600..c5eac26a9 100644 --- a/html/cgi-bin/ovpnmain.cgi +++ b/html/cgi-bin/ovpnmain.cgi @@ -785,6 +785,7 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) { $vpnsettings{'MAX_CLIENTS'} = $cgiparams{'MAX_CLIENTS'}; $vpnsettings{'REDIRECT_GW_DEF1'} = $cgiparams{'REDIRECT_GW_DEF1'}; $vpnsettings{'CLIENT2CLIENT'} = $cgiparams{'CLIENT2CLIENT'}; + $vpnsettings{'COMPLZO'} = $cgiparams{'DCOMPLZO'}; $vpnsettings{'ADDITIONAL_CONFIGS'} = $cgiparams{'ADDITIONAL_CONFIGS'}; $vpnsettings{'DHCP_DOMAIN'} = $cgiparams{'DHCP_DOMAIN'}; $vpnsettings{'DHCP_DNS'} = $cgiparams{'DHCP_DNS'}; @@ -2654,6 +2655,9 @@ ADV_ERROR: $checked{'REDIRECT_GW_DEF1'}{'off'} = ''; $checked{'REDIRECT_GW_DEF1'}{'on'} = ''; $checked{'REDIRECT_GW_DEF1'}{$cgiparams{'REDIRECT_GW_DEF1'}} = 'CHECKED'; + $checked{'DCOMPLZO'}{'off'} = ''; + $checked{'DCOMPLZO'}{'on'} = ''; + $checked{'DCOMPLZO'}{$cgiparams{'DCOMPLZO'}} = 'CHECKED'; $checked{'ADDITIONAL_CONFIGS'}{'off'} = ''; $checked{'ADDITIONAL_CONFIGS'}{'on'} = ''; $checked{'ADDITIONAL_CONFIGS'}{$cgiparams{'ADDITIONAL_CONFIGS'}} = 'CHECKED'; @@ -2732,7 +2736,7 @@ print < - + @@ -2745,6 +2749,11 @@ print < + $Lang::tr{'comp-lzo'} + + $Lang::tr{'openvpn default'}: off ($Lang::tr{'attention'} exploitable via Voracle) + + $Lang::tr{'ovpn add conf'} @@ -5248,8 +5257,6 @@ END - $Lang::tr{'comp-lzo'} -