diff -Nur --no-dereference smeserver-openvpn-bridge-2.1.old/root/etc/e-smith/db/configuration/defaults/openvpn-bridge/Cipher smeserver-openvpn-bridge-2.1/root/etc/e-smith/db/configuration/defaults/openvpn-bridge/Cipher
--- smeserver-openvpn-bridge-2.1.old/root/etc/e-smith/db/configuration/defaults/openvpn-bridge/Cipher 1969-12-31 19:00:00.000000000 -0500
+++ smeserver-openvpn-bridge-2.1/root/etc/e-smith/db/configuration/defaults/openvpn-bridge/Cipher 2021-03-31 21:29:02.179000000 -0400
@@ -0,0 +1 @@
+AES-128-CBC
diff -Nur --no-dereference smeserver-openvpn-bridge-2.1.old/root/etc/e-smith/db/configuration/defaults/openvpn-bridge/cipher smeserver-openvpn-bridge-2.1/root/etc/e-smith/db/configuration/defaults/openvpn-bridge/cipher
--- smeserver-openvpn-bridge-2.1.old/root/etc/e-smith/db/configuration/defaults/openvpn-bridge/cipher 2021-03-31 16:16:30.757000000 -0400
+++ smeserver-openvpn-bridge-2.1/root/etc/e-smith/db/configuration/defaults/openvpn-bridge/cipher 1969-12-31 19:00:00.000000000 -0500
@@ -1 +0,0 @@
-AES-256-CBC
diff -Nur --no-dereference smeserver-openvpn-bridge-2.1.old/root/etc/e-smith/db/configuration/defaults/openvpn-bridge/HMAC smeserver-openvpn-bridge-2.1/root/etc/e-smith/db/configuration/defaults/openvpn-bridge/HMAC
--- smeserver-openvpn-bridge-2.1.old/root/etc/e-smith/db/configuration/defaults/openvpn-bridge/HMAC 1969-12-31 19:00:00.000000000 -0500
+++ smeserver-openvpn-bridge-2.1/root/etc/e-smith/db/configuration/defaults/openvpn-bridge/HMAC 2021-03-31 16:20:58.668000000 -0400
@@ -0,0 +1 @@
+SHA256
diff -Nur --no-dereference smeserver-openvpn-bridge-2.1.old/root/etc/e-smith/db/configuration/migrate/50openvpn-cipher smeserver-openvpn-bridge-2.1/root/etc/e-smith/db/configuration/migrate/50openvpn-cipher
--- smeserver-openvpn-bridge-2.1.old/root/etc/e-smith/db/configuration/migrate/50openvpn-cipher 1969-12-31 19:00:00.000000000 -0500
+++ smeserver-openvpn-bridge-2.1/root/etc/e-smith/db/configuration/migrate/50openvpn-cipher 2021-03-31 21:31:42.029000000 -0400
@@ -0,0 +1,16 @@
+{
+ #migrate cipher to Cipher that is used in all other openvpn contribs
+ my $opv = $DB->get('openvpn-bridge') || $DB->new_record('openvpn-bridge', {type => 'service'});
+
+ my %old2new = (
+ 'cipher' => "Cipher",
+ );
+
+ for my $keyt ( keys %old2new )
+ {
+ next unless ( $opv->prop($keyt) );
+ my $value = $DB->get_prop_and_delete('openvpn-bridge', $keyt);
+ next if ( $opv->prop($old2new{$keyt}) );
+ $DB->set_prop('openvpn-bridge', $old2new{$keyt}, $value);
+ }
+}
diff -Nur --no-dereference smeserver-openvpn-bridge-2.1.old/root/etc/e-smith/locale/en-us/etc/e-smith/web/functions/openvpnbridge smeserver-openvpn-bridge-2.1/root/etc/e-smith/locale/en-us/etc/e-smith/web/functions/openvpnbridge
--- smeserver-openvpn-bridge-2.1.old/root/etc/e-smith/locale/en-us/etc/e-smith/web/functions/openvpnbridge 2021-03-31 16:16:30.731000000 -0400
+++ smeserver-openvpn-bridge-2.1/root/etc/e-smith/locale/en-us/etc/e-smith/web/functions/openvpnbridge 2021-03-31 21:37:50.773000000 -0400
@@ -230,7 +230,7 @@
DESC_STATUS
- Do you want to enable the service ?
+ Do you want to enable the service?
@@ -363,7 +363,7 @@
DESC_CLIENT_DISCONECT_PAGE
- Your are going to diconnect this user. Are you sure you want to continue ?
+ You are going to diconnect this user. Are you sure you want to continue?
@@ -420,4 +420,49 @@
LABEL_TA_PEM
Static key
+
+ DESC_HMAC
+ HMAC is part of the encryption of the data channel for openvpn (where your data travel) after encryption with the cipher. Default is the insecure SHA1, we suggest you to at least use SHA256. This setting should match on both the server and the client
+
+
+ LABEL_HMAC
+ HMAC algorithm
+
+
+ DESC_CIPHER
+ The cipher used for your data channel for openvpn. The default is to use the insecure BlowFish algorithm. We suggest you the AES-128-CBC or higher. This setting should match on both the server and the client.
+
+
+ LABEL_CIPHER
+ Cipher encryption algorithm
+
+
+ LINK
+ Link status
+
+
+ UP
+ Up
+
+
+ SYSTEMD_RETURNED
+ Systemd returned service as
+
+
+ CHANGEME_INSECURE
+ Please change this insecure parameter
+
+
+ SUGGESTED
+ Sugested value
+
+
+ DEFAULT
+ Default
+
+
+ ERROR
+ Error
+
+
diff -Nur --no-dereference smeserver-openvpn-bridge-2.1.old/root/etc/e-smith/templates/etc/openvpn/bridge/openvpn.conf/35encryption smeserver-openvpn-bridge-2.1/root/etc/e-smith/templates/etc/openvpn/bridge/openvpn.conf/35encryption
--- smeserver-openvpn-bridge-2.1.old/root/etc/e-smith/templates/etc/openvpn/bridge/openvpn.conf/35encryption 1969-12-31 19:00:00.000000000 -0500
+++ smeserver-openvpn-bridge-2.1/root/etc/e-smith/templates/etc/openvpn/bridge/openvpn.conf/35encryption 2021-03-31 21:31:42.515000000 -0400
@@ -0,0 +1,33 @@
+{
+ #HMAC default is SHA1 if empty, we really want higher on new setup, but keep empty for default on existing one...
+ # need to be changed on both side
+ my $HMAC = ( ${'openvpn-bridge'}{'HMAC'} ) ? ${'openvpn-bridge'}{'HMAC'} : undef;
+ # cipher default to BF if empty, we really want higher on new setup, but keep empty for default on existing one...
+ # # here openvpn uses encrypt-then-mc so no issue using CBC rather than GCM, and GCM not implemented before openvpn 2.4 for data channel
+ my $cipher = ( ${'openvpn-bridge'}{'Cipher'} && ${'openvpn-bridge'}{'Cipher'} ne 'auto')? ${'openvpn-bridge'}{'Cipher'} : undef;
+
+ ## we do not want any tls 1.1 or lower, this does not break anything to force, unless the client is very old and limited to 1.1 or lower
+ my $tlsVmin = ( ${'openvpn-bridge'}{'tlsVmin'} && ( ${'openvpn-bridge'}{'tlsVmin'} =~ /^1\.[0-9]{1}$/ ) ) ? ${'openvpn-bridge'}{'tlsVmin'} : "1.2";
+ # TLS 1.3 encryption settings
+ my $tlsCipherSuites13 = ( ${'openvpn-bridge'}{'tlsCipherSuites13'} ) ? ${'openvpn-bridge'}{'tlsCipherSuites13'} : "TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256";
+ # # TLS 1.2 encryption settings
+ my $tlsCipher12 = ( ${'openvpn-bridge'}{'tlsCipher12'} ) ? ${'openvpn-bridge'}{'tlsCipher12'} : "TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256:TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256:TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256:TLS-ECDHE-RSA-WITH-AES-128-GCM-SHA256";
+
+
+
+ $OUT .= "#securing control channel\n";
+ $OUT .= "tls-version-min $tlsVmin\n";
+ $OUT .= "tls-cipher $tlsCipher12\n" if defined $tlsCipher12;
+ $OUT .= "tls-ciphersuites $tlsCipherSuites13\n" if defined $tlsCipherSuites13;
+ #$OUT .= "# we might be able to disable dh param with this one, NSA-'s recommended curve\n";
+ #$OUT .= "ecdh-curve secp384r1\n";
+
+ # data channel
+ $OUT .= "#securing data channel\n";
+ $OUT .= (defined $cipher) ? "cipher $cipher\n" : "# no cipher defined default to Blowfish, this is INSECURE, please consider AES-128-CBC or higher on both client and server\n";
+ #auth SHA512
+ $OUT .= (defined $HMAC )? "auth $HMAC\n" : "# no HMAC defined, default to SHA1, please consider SHA256 or higher on both client and server\n";
+
+
+
+}
diff -Nur --no-dereference smeserver-openvpn-bridge-2.1.old/root/etc/e-smith/templates/etc/openvpn/bridge/openvpn.conf/60options smeserver-openvpn-bridge-2.1/root/etc/e-smith/templates/etc/openvpn/bridge/openvpn.conf/60options
--- smeserver-openvpn-bridge-2.1.old/root/etc/e-smith/templates/etc/openvpn/bridge/openvpn.conf/60options 2013-11-11 12:27:02.000000000 -0500
+++ smeserver-openvpn-bridge-2.1/root/etc/e-smith/templates/etc/openvpn/bridge/openvpn.conf/60options 2021-03-31 21:31:42.246000000 -0400
@@ -4,7 +4,6 @@
my $mtuTest = ${'openvpn-bridge'}{mtuTest} || 'enabled';
my $tunMtu = ${'openvpn-bridge'}{tunMtu};
my $fragment = ${'openvpn-bridge'}{fragment};
-my $cipher = ${'openvpn-bridge'}{cipher} || 'auto';
my $redirectGW = ${'openvpn-bridge'}{redirectGW} || 'PerClient';
my $proto = ${'openvpn-bridge'}{protocol} || 'udp';
my $duplicate = ${'openvpn-bridge'}{duplicateCN} || 'disabled';
@@ -35,10 +34,6 @@
}
}
-if ($cipher ne 'auto'){
- $OUT .= "cipher $cipher\n";
-}
-
if ($duplicate eq 'enabled'){
$OUT .= "duplicate-cn\n";
}
diff -Nur --no-dereference smeserver-openvpn-bridge-2.1.old/root/etc/e-smith/web/functions/openvpnbridge smeserver-openvpn-bridge-2.1/root/etc/e-smith/web/functions/openvpnbridge
--- smeserver-openvpn-bridge-2.1.old/root/etc/e-smith/web/functions/openvpnbridge 2013-11-11 12:27:02.000000000 -0500
+++ smeserver-openvpn-bridge-2.1/root/etc/e-smith/web/functions/openvpnbridge 2021-03-31 21:31:41.307000000 -0400
@@ -57,6 +57,14 @@
value="get_status()">
+
+
+
+
+
+
+
+
+
+
+
@@ -135,6 +158,17 @@
DESC_END_POOL
+
+ DESC_HMAC
+
+
+
+
+ DESC_CIPHER
+
+
+
+
diff -Nur --no-dereference smeserver-openvpn-bridge-2.1.old/root/usr/share/perl5/vendor_perl/esmith/FormMagick/Panel/openvpnbridge.pm smeserver-openvpn-bridge-2.1/root/usr/share/perl5/vendor_perl/esmith/FormMagick/Panel/openvpnbridge.pm
--- smeserver-openvpn-bridge-2.1.old/root/usr/share/perl5/vendor_perl/esmith/FormMagick/Panel/openvpnbridge.pm 2021-03-31 16:16:30.758000000 -0400
+++ smeserver-openvpn-bridge-2.1/root/usr/share/perl5/vendor_perl/esmith/FormMagick/Panel/openvpnbridge.pm 2021-03-31 21:31:41.548000000 -0400
@@ -16,6 +16,7 @@
our @EXPORT = qw(
get_prop
get_status
+ print_link_status
get_auth_type
get_ip_pool
print_crt_not_ready
@@ -27,6 +28,12 @@
write_pem
read_pem
disconnect_client
+ get_cipher_status
+ get_hmac_status
+ get_current_hmac
+ get_current_cipher
+ get_digests_options
+ get_ciphers_options
);
our $config_db = esmith::ConfigDB->open || die "Couldn't open ConfigDB\n";
@@ -95,6 +102,20 @@
$config_db->set_prop('openvpn-bridge', 'userAuth', $q->param("auth_type"));
$config_db->set_prop('openvpn-bridge', 'startPool', $q->param("start_pool"));
$config_db->set_prop('openvpn-bridge', 'endPool', $q->param("end_pool"));
+ if ($q->param("hmac") eq 'SHA1') {
+ my $tmpk = $config_db->get('openvpn-bridge');
+ $tmpk->delete_prop('HMAC');
+ }
+ else {
+ $config_db->set_prop('openvpn-bridge', 'HMAC', $q->param("hmac"));
+ }
+ if ($q->param("cipher") eq 'BF-CBC') {
+ my $tmpk = $config_db->get('openvpn-bridge');
+ $tmpk->delete_prop('Cipher');
+ }
+ else {
+ $config_db->set_prop('openvpn-bridge', 'Cipher', $q->param("cipher"));
+ }
unless ( system ("/sbin/e-smith/signal-event", "openvpn-bridge-update") == 0 ){
return $fm->error('ERROR_OCCURED', 'FIRST');;
@@ -103,6 +124,51 @@
return $fm->success('SUCCESS','FIRST');
}
+#status global du lien
+sub print_link_status{
+ my $fm = shift;
+ my $q = $fm->{cgi};
+ my $common_name = $fm->localise('COMMON_NAME');
+ my $real_ip = $fm->localise('REAL_IP');
+ my $virtual_ip = $fm->localise('VIRTUAL_IP');
+ my $sent = $fm->localise('SENT');
+ my $received = $fm->localise('RECEIVED');
+ my $connected_since = $fm->localise('CONNECTED_SINCE');
+ my $disconnect = $fm->localise('DISCONNECT');
+
+ # test status db
+ return get_status($fm) if get_status($fm) eq $fm->localise('DISABLED');
+ # test systemd
+ my $act = `/usr/bin/systemctl is-active openvpn-bridge.service`;
+ chomp $act;
+ return "" . $fm->localise('SYSTEMD_RETURNED') . " $act " unless $act eq "active";
+
+ # On récupère les paramètre et on les parse
+ my $param = get_prop('',"management");
+ my @param = split(/:/,$param);
+ my $host = $param[0];
+ my $port = $param[1];
+ my $pass = $param[2];
+
+ # On cré l'objet vpn
+ my $vpn = Net::OpenVPN::Manage->new({
+ host => $host,
+ port => $port,
+ password => $pass,
+ timeout => 3
+ });
+
+ # On se connecte ou on retourne le message d'erreur
+ unless($vpn->connect()){
+ print "" . $fm->localise('ERROR_CONNECT_TO_MANAGER'). "";
+ return "";
+ }
+ my $r = $vpn->status_ref();
+ return "" . $fm->localise('UP') ."" if $r->{TITLE};
+ return "" . $fm->localise('ERROR') ."";
+}
+
+
# Affiche les connexions en cours
sub print_clients_table{
my $fm = shift;
@@ -500,7 +566,8 @@
my $mtutest = get_prop('','mtuTest','enabled');
my $fragment = get_prop('','fragment','');
my $tunmtu = get_prop('','tunMtu','');
- my $cipher = get_prop('','cipher','');
+ my $cipher = get_prop('','Cipher','');
+ my $hmac = get_prop('','HMAC','');
if ($proto eq 'tcp'){
$mtutest = 'disabled';
$fragment = '';
@@ -518,11 +585,11 @@
$fic .= "tls-auth takey.pem 1\n"
if (( -e "$privdir/takey.pem")&&( !-z "$privdir/takey.pem"));
$fic .= "ns-cert-type server\n\n";
+ $fic .= "cipher $cipher\n" if (($cipher ne '') && ($cipher ne 'auto'));
+ $fic .= "auth $hmac\n" if (($hmac ne '') && ($hmac ne 'auto'));
+ $fic .= "\n";
$fic .= (get_prop('','userAuth','CrtWithPass') eq 'CrtWithPass' ? "auth-user-pass\n\n" : "\n");
- $fic .= "# Replace user.p12 with the certificate\n# bundle in PKCS12 format\n";
- $fic .= "pkcs12 user.p12\n\n";
- $fic .= "# You can replace the pkcs12\n# directive with the old ones\n";
- $fic .= "#ca cacert.pem\n#cert user.pem\n#key user-key.pem\n\n";
+ $fic .= "\n";
if ($mtutest eq 'enabled'){
$fic .= "mtu-test\n";
}
@@ -534,9 +601,33 @@
$fic .= "fragment $fragment\nmssfix\n";
}
}
- $fic .= "cipher $cipher\n" if (($cipher ne '') && ($cipher ne 'auto'));
$fic .= "comp-lzo\n";
$fic .= "pull\n";
+ $fic .= "\n";
+ $fic .= "# Uncomment and replace user.p12 \n# with the certificate bundle in PKCS12 format\n";
+ $fic .= "#pkcs12 user.p12\n\n";
+ $fic .= "# You can replace the pkcs12\n# directive with the old ones\n";
+ $fic .= "#ca cacert.pem\n#cert user.pem\n#key user-key.pem\n\n";
+ $fic .= "# Alternatively you can paste your cert and private key here:\n";
+ #infile file support
+ $fic .= "# client certificate - uncomment and paste between delimiters \n";
+ $fic .= "#\n";
+ $fic .= "#\n";
+ $fic .= "# client private key - uncomment and paste between delimiters\n";
+ $fic .= "#\n";
+ $fic .= "#\n";
+ $fic .= "\n";
+ $fic .= "# CA certificate\n";
+ $fic .= "\n";
+ $fic .= read_pem($fm,'cacert.pem')."\n";
+ $fic .= "\n";
+ if (( -e "$privdir/takey.pem")&&( !-z "$privdir/takey.pem")) {
+ $fic .= "\n# Shared TLS key\n";
+ $fic .= "\n";
+ $fic .= read_pem($fm,'takey.pem')."\n";
+ $fic .= "\n";
+ }
+
print(esmith::cgi::genTextRow($q,
$q->textarea (
@@ -544,7 +635,7 @@
-override => 1,
-default => $fic,
-rows => 30,
- -columns => 60)
+ -columns => 100)
)
);
return "";
@@ -773,5 +864,127 @@
return "OK";
}
+###### those could almost be copy paste for bridge and s2s
+##
+=head2 get_hmac_status
+
+=cut
+sub get_hmac_status{
+ my ($fm) = @_;
+ my $hmac = get_current_hmac();
+ $hmac= "". $fm->localise('CHANGEME_INSECURE'). ": $hmac " unless ($hmac eq "whirlpool" || $hmac =~ /(512|256|384|224)$/);
+ return $hmac;
+}
+
+=head2 get_cipher_status
+list obtained using
+openvpn --show-digests | egrep 'digest size' | awk {'print "'\''" $1 "'\'' => '\''" $1 "'\''," '}
+=cut
+sub get_cipher_status{
+ my ($fm) = @_;
+ my $cipher = get_current_cipher();
+ $cipher = "". $fm->localise('CHANGEME_INSECURE'). ": $cipher " unless ($cipher =~ /(128|192|256|512|SEED)/ );
+ return $cipher;
+}
+
+=head2 get_current_hmac
+
+=cut
+sub get_current_hmac{
+ my ($self) = @_;
+ my $cvpn= $config_db->get('openvpn-bridge') or return "SHA256" ;
+ return "SHA1" unless defined $cvpn->prop('HMAC');
+ return $cvpn->prop('HMAC') ;
+}
+
+=head2 get_current_cipher
+list obtained using
+openvpn --show-digests | egrep 'digest size' | awk {'print "'\''" $1 "'\'' => '\''" $1 "'\''," '}
+=cut
+sub get_current_cipher{
+ my ($self) = @_;
+ my $cvpn= $config_db->get('openvpn-bridge') or return "AES-128-CBC";
+ return "BF-CBC" unless defined $cvpn->prop('Cipher');
+ return $cvpn->prop('Cipher') ;
+}
+
+
+=head2 get_digests_options
+
+=cut
+sub get_digests_options{
+ my ($self) = @_;
+ my $translate = $self->localise('DEFAULT');
+ my $suggested = $self->localise('SUGGESTED');
+ my %options= (
+ 'whirlpool' => 'whirlpool (512)',
+ 'SHA512' => 'SHA512',
+ 'SHA384' => 'SHA384',
+ 'SHA256' => 'SHA256' . ": $suggested",
+ 'SHA224' => 'SHA224',
+ 'SHA1' => 'SHA1 (160)' . ": $translate",
+ 'SHA' => 'SHA (160)',
+ 'ecdsa-with-SHA1' => 'ecdsa-with-SHA1 (160)',
+ 'RIPEMD160' => 'RIPEMD160',
+ 'MD5' => 'MD5 (128)',
+ 'MD4' => 'MD4 (128)',
+ );
+ return \%options;
+}
+
+
+=head2 get_ciphers_options
+list obtained using
+openvpn --show-ciphers | egrep '^[A-Z]{2}' | sed 's/ by//; s/ default//; s/block,/block/; s/)// ' | awk {'print " '\''" $1 "'\'' => '\''" $1 $2 " " $4 " " $5 " " $7")'\''," '}
+then reduced to remove most of insecure ciphers
+Using a CBC or GCM mode is recommended.
+In static key mode only CBC mode is allowed.
+
+=cut
+sub get_ciphers_options{
+ my ($self) = @_;
+ my $translate = $self->localise('DEFAULT');
+ my $suggested = $self->localise('SUGGESTED');
+ my %options= (
+ 'AES-128-CBC' => 'AES-128-CBC (128 key, 128 block)'.": $suggested",
+ 'AES-128-CFB' => 'AES-128-CFB (128 key, 128 block)',
+ 'AES-128-CFB1' => 'AES-128-CFB1 (128 key, 128 block)',
+ 'AES-128-CFB8' => 'AES-128-CFB8 (128 key, 128 block)',
+ 'AES-128-GCM' => 'AES-128-GCM (128 key, 128 block)',
+ 'AES-128-OFB' => 'AES-128-OFB (128 key, 128 block)',
+ 'AES-192-CBC' => 'AES-192-CBC (192 key, 128 block)',
+ 'AES-192-CFB' => 'AES-192-CFB (192 key, 128 block)',
+ 'AES-192-CFB1' => 'AES-192-CFB1 (192 key, 128 block)',
+ 'AES-192-CFB8' => 'AES-192-CFB8 (192 key, 128 block)',
+ 'AES-192-GCM' => 'AES-192-GCM (192 key, 128 block)',
+ 'AES-192-OFB' => 'AES-192-OFB (192 key, 128 block)',
+ 'AES-256-CBC' => 'AES-256-CBC (256 key, 128 block)',
+ 'AES-256-CFB' => 'AES-256-CFB (256 key, 128 block)',
+ 'AES-256-CFB1' => 'AES-256-CFB1 (256 key, 128 block)',
+ 'AES-256-CFB8' => 'AES-256-CFB8 (256 key, 128 block)',
+ 'AES-256-GCM' => 'AES-256-GCM (256 key, 128 block)',
+ 'AES-256-OFB' => 'AES-256-OFB (256 key, 128 block)',
+ 'CAMELLIA-128-CBC' => 'CAMELLIA-128-CBC (128 key, 128 block)',
+ 'CAMELLIA-128-CFB' => 'CAMELLIA-128-CFB (128 key, 128 block)',
+ 'CAMELLIA-128-CFB1' => 'CAMELLIA-128-CFB1 (128 key, 128 block)',
+ 'CAMELLIA-128-CFB8' => 'CAMELLIA-128-CFB8 (128 key, 128 block)',
+ 'CAMELLIA-128-OFB' => 'CAMELLIA-128-OFB (128 key, 128 block)',
+ 'CAMELLIA-192-CBC' => 'CAMELLIA-192-CBC (192 key, 128 block)',
+ 'CAMELLIA-192-CFB' => 'CAMELLIA-192-CFB (192 key, 128 block)',
+ 'CAMELLIA-192-CFB1' => 'CAMELLIA-192-CFB1 (192 key, 128 block)',
+ 'CAMELLIA-192-CFB8' => 'CAMELLIA-192-CFB8 (192 key, 128 block)',
+ 'CAMELLIA-192-OFB' => 'CAMELLIA-192-OFB (192 key, 128 block)',
+ 'CAMELLIA-256-CBC' => 'CAMELLIA-256-CBC (256 key, 128 block)',
+ 'CAMELLIA-256-CFB' => 'CAMELLIA-256-CFB (256 key, 128 block)',
+ 'CAMELLIA-256-CFB1' => 'CAMELLIA-256-CFB1 (256 key, 128 block)',
+ 'CAMELLIA-256-CFB8' => 'CAMELLIA-256-CFB8 (256 key, 128 block)',
+ 'CAMELLIA-256-OFB' => 'CAMELLIA-256-OFB (256 key, 128 block)',
+ 'SEED-CBC' => 'SEED-CBC (128 key, 128 block)',
+ 'SEED-CFB' => 'SEED-CFB (128 key, 128 block)',
+ 'SEED-OFB' => 'SEED-OFB (128 key, 128 block)',
+ 'BF-CBC' => 'BF-CBC(128 key, 64 block)'. ": $translate ",
+ );
+ return \%options;
+}
1;