Project

General

Profile

Bug #9748

openvpn_wizard.xml: DH 15360 and 16384 fall back to 1024

Added by Viktor Gurov about 1 month ago. Updated 22 days ago.

Status:
Resolved
Priority:
Low
Assignee:
Category:
OpenVPN
Target version:
Start date:
09/12/2019
Due date:
% Done:

100%

Estimated time:
Affected Version:
2.4.4-p3
Affected Architecture:

Description

If you select DH Parameters Length above 8192, i.e. 15360 or 16384, it creates server instance with DH length 1024
And you can't select DH length above 8192 in server configuration

Screenshot from 2019-09-12 13-16-28.png (12.4 KB) Screenshot from 2019-09-12 13-16-28.png VPN / OpenVPN / Servers page Viktor Gurov, 09/12/2019 05:22 AM

Associated revisions

Revision 52f686a9 (diff)
Added by Jim Pingle about 1 month ago

Add wizard select_source & use for OpenVPN DH. Fixes #9748

Revision a033a446 (diff)
Added by Jim Pingle about 1 month ago

Add wizard select_source & use for OpenVPN DH. Fixes #9748

(cherry picked from commit 52f686a97f77cfd00ddb69088bef7164676d4117)

History

#1 Updated by Viktor Gurov about 1 month ago

It shows correct number in config.xml:
<dh_length>16384</dh_length>

And on VPN / OpenVPN / Servers page

but it show 1024 on server edit page

and do not create server.conf and server.tls-auth files in /var/etc/openvpn/
only server.ca, server.cert, server.key

#2 Updated by Jim Pingle about 1 month ago

  • Assignee set to Jim Pingle
  • Target version set to 2.5.0

#3 Updated by Jim Pingle about 1 month ago

  • Status changed from New to Confirmed
  • Priority changed from Normal to Low
  • Target version deleted (2.5.0)

Looking deeper at the code, this is expected, but might be possible to improve.

The options are missing from the OpenVPN server because the files for those DH parameters do not exist on the filesystem, they must be created by the user since we don't ship stock DH parameters of that size, though the code supports using them.

The options are there in the wizard because they are hardcoded in the wizard XML file.

If the admin creates the files for those size DH parameters (e.g. /usr/bin/openssl dhparam -out /etc/dh-parameters.15360 15360) then they will appear in the server and can be used.

I'll see if the wizard list can be populated dynamically instead of hardcoded.

#4 Updated by Jim Pingle about 1 month ago

  • Target version set to 2.5.0

#5 Updated by Jim Pingle about 1 month ago

  • Status changed from Confirmed to Feedback
  • % Done changed from 0 to 100

#6 Updated by Viktor Gurov 22 days ago

Jim Pingle wrote:

Applied in changeset 52f686a97f77cfd00ddb69088bef7164676d4117.

checked, it's OK now

Resolved

#7 Updated by Jim Pingle 22 days ago

  • Status changed from Feedback to Resolved

Also available in: Atom PDF