From patchwork Tue Jun 11 04:36:00 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Peter_M=C3=BCller?= X-Patchwork-Id: 2294 Return-Path: Received: from mail01.ipfire.org (mail01.i.ipfire.org [172.28.1.200]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mail01.ipfire.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by web07.i.ipfire.org (Postfix) with ESMTPS id 7C12E80025D for ; Mon, 10 Jun 2019 19:36:49 +0100 (BST) Received: from mail01.i.ipfire.org (localhost [IPv6:::1]) by mail01.ipfire.org (Postfix) with ESMTP id 45N20c4gqQz52531; Mon, 10 Jun 2019 19:36:48 +0100 (BST) Received: from [127.0.0.1] (unknown [89.187.143.31]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mail01.ipfire.org (Postfix) with ESMTPSA id 45N20X1qJyz5P2Cp for ; Mon, 10 Jun 2019 19:36:43 +0100 (BST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=201904rsa; t=1560191805; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=R7Mn4/OHqyvq087/m+JcnZbu+XKi1r3DwFz9wfk8u/w=; b=kRcSrylOcQeF3UPk0pEAFNFNyrWwlCzXbJl9F2KVHwQ+9YhZp3xKQiB6/Srs8KygiNr+vR d4tjmt16OyaT5H1zaA47ZnI9k4zozod0jvTp1ZE9pbrQlqLNpP2oH1T+W24xHdGZSNF8r5 tsWiuSmCpoeqCBOofcg/71Akg975YMU3920ddKMvdFxuKeqgzzLuav+/tYbW5oL/TntMde 4QHKEubBdzIHm18IQRpfsqZb0CLWeVD83mK27X4CKuwhgbCIB0vO2JGsKGdIBntl5NE+Y5 eL9NK4RJQXQJFDQQ3y0JAPEWPRy5r8AeUIPRK0WoKeDwP+Xdh7SMC+jzvmlD6w== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=201904ed25519; t=1560191805; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=R7Mn4/OHqyvq087/m+JcnZbu+XKi1r3DwFz9wfk8u/w=; b=A3IpkfdlrrEq5H6jpxZklFHfJfLa/GEzM85DERueYBQ7tVwVQzLb1/gutq8pBuvgGDiL/s VL651f7NBhLv4DCQ== To: "IPFire: Development-List" From: =?utf-8?q?Peter_M=C3=BCller?= Subject: [PATCH] OpenVPN: mark CBC ciphers as weak in WebUI Organization: IPFire.org Message-ID: <5c5b7f38-c7c5-2c35-5f46-b4aca620d54b@ipfire.org> Date: Mon, 10 Jun 2019 18:36:00 +0000 MIME-Version: 1.0 Content-Language: en-US Authentication-Results: mail01.ipfire.org; auth=pass smtp.auth=pmueller smtp.mailfrom=peter.mueller@ipfire.org X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: development-bounces@lists.ipfire.org Sender: "Development" CBC a vulnerable to a bunch of vulnerabilities (MAC-then-encrypt, Padding Oracle, ...) which were considered to be an academic threat. However, research such as https://blog.qualys.com/technology/2019/04/22/zombie-poodle-and-goldendoodle-vulnerabilities indicates these issues are more serious. Thereof, this patch marks remaining CBC ciphers (AES-CBC, SEED-CBC and CAMELLIA-CBC) as "weak"; they should be avoided in future. It does not change the default, which is AES-256-CBC for compatibility reasons. Whether this can be changed or not needs to be discussed. Signed-off-by: Peter Müller Cc: Erik Kapfer --- html/cgi-bin/ovpnmain.cgi | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi index 439390228..ae1fe8e77 100644 --- a/html/cgi-bin/ovpnmain.cgi +++ b/html/cgi-bin/ovpnmain.cgi @@ -2,7 +2,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2014 IPFire Team # +# Copyright (C) 2007-2019 IPFire Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -4516,7 +4516,7 @@ if ($cgiparams{'TYPE'} eq 'net') { $selected{'DCIPHER'}{'CAST5-CBC'} = ''; $selected{'DCIPHER'}{'BF-CBC'} = ''; $selected{'DCIPHER'}{'DES-CBC'} = ''; - # If no cipher has been chossen yet, select + # If no cipher has been chosen yet, select # the old default (AES-256-CBC) for compatiblity reasons. if ($cgiparams{'DCIPHER'} eq '') { $cgiparams{'DCIPHER'} = 'AES-256-CBC'; @@ -4668,13 +4668,13 @@ if ($cgiparams{'TYPE'} eq 'net') { - - - - - - - + + + + + + + @@ -5052,7 +5052,7 @@ END } } -#default setzen +# set default values if ($cgiparams{'DCIPHER'} eq '') { $cgiparams{'DCIPHER'} = 'AES-256-CBC'; }