- If a backup from before openvpn-2.6 is restored then the server.conf file has ncp-disable still in it. Also data-ciphers in server.conf and DATACIPHERS in settings will not be present. - The existing code checks if DATACIPHERS is empty and if it is then it puts ncp-disable into server.conf which we no longer need to have. - This patch changes this code section so that if DATACIPHERS is empty then it has the default ciphers added into server.conf and then also updates the DATACIPHERS entry in the settings file. - I have made this an RFC patch as the patch does work but it might not be the correct or best way to go about this. - If it is accepted then the previous patches I did for backup.pl and update.sh can be reverted. - The change was tested out with the reverted backup.pl and all old backup versions were successfully restored correctly and worked as expected. Also tested out the change with a backup from CU197 and that restore also worked correctly.
Tested-by: Adolf Belka <[email protected]> Signed-off-by: Adolf Belka <[email protected]> --- html/cgi-bin/ovpnmain.cgi | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi index dfe7f8ad5..8c908d725 100644 --- a/html/cgi-bin/ovpnmain.cgi +++ b/html/cgi-bin/ovpnmain.cgi @@ -291,8 +291,14 @@ sub writeserverconf { print CONF "status $RW_STATUS 30\n"; # Cryptography + + # Previous ncp-disable server conf will have an empty DATACIPHERS entry + # This will occur with restores from prior to OpenVPN-2.6 + # Replace the empty DATACIPHERS entry with the default value if ($vpnsettings{'DATACIPHERS'} eq '') { - print CONF "ncp-disable\n"; + print CONF "data-ciphers " . "AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305" . "\n"; + $vpnsettings{'DATACIPHERS'} = "AES-256-GCM|AES-128-GCM|CHACHA20-POLY1305"; + &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings); } else { print CONF "data-ciphers " . $vpnsettings{'DATACIPHERS'} =~ s/\|/:/gr . "\n"; } -- 2.51.0
