smeserver-openvpn-s2s/contribs10/smeserver-openvpn-s2s-0.2-sme10.patch

diff -Nur --no-dereference smeserver-openvpn-s2s-0.2.old/createlinks smeserver-openvpn-s2s-0.2/createlinks
--- smeserver-openvpn-s2s-0.2.old/createlinks   2021-03-30 00:12:27.731000000 -0400
+++ smeserver-openvpn-s2s-0.2/createlinks       2021-03-30 01:01:21.126000000 -0400
@@ -5,9 +5,7 @@
 safe_symlink("restart", "root/etc/e-smith/events/openvpn-s2s-update/services2adjust/openvpn-s2s");
 safe_symlink("adjust", "root/etc/e-smith/events/openvpn-s2s-update/services2adjust/masq");
 
-#service_link_enhanced("openvpn-s2s", "S80", "7");
-#service_link_enhanced("openvpn-s2s", "K25", "6");
-#service_link_enhanced("openvpn-s2s", "K25", "0");
+event_link("openvpn-s2s-onelink", "openvpn-s2s-update-one", "50");
 
 event_link("openvpn-s2s-delete-networks", "openvpn-s2s-update", "10");
 event_link("openvpn-s2s-genconf", "openvpn-s2s-update", "20");
diff -Nur --no-dereference smeserver-openvpn-s2s-0.2.old/root/etc/e-smith/events/actions/openvpn-s2s-onelink smeserver-openvpn-s2s-0.2/root/etc/e-smith/events/actions/openvpn-s2s-onelink
--- smeserver-openvpn-s2s-0.2.old/root/etc/e-smith/events/actions/openvpn-s2s-onelink   1969-12-31 19:00:00.000000000 -0500
+++ smeserver-openvpn-s2s-0.2/root/etc/e-smith/events/actions/openvpn-s2s-onelink       2021-03-30 00:54:13.858000000 -0400
@@ -0,0 +1,60 @@
+#!/usr/bin/perl -w
+
+#----------------------------------------------------------------------
+# copyright (C) 2010 Firewall Services 
+# Daniel Berteaud <daniel@firewall-services.com>
+# 
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#               
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#               
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307  USA
+#----------------------------------------------------------------------
+
+use strict;
+use esmith::templates;
+use esmith::ConfigDB;
+
+
+my $event = $ARGV [0];
+my $vpn = $ARGV [1];
+my $lock="/var/lock/subsys/openvpn-s2s";
+my $piddir="/var/run/openvpn-s2s";
+
+die "missing vpn name"  unless defined $vpn;
+
+my $db = esmith::ConfigDB->open_ro("openvpn-s2s");
+
+my $conf = $db->get($vpn) or die "unknown site to site vpn";
+
+my $key = $conf->key;
+my $status = $conf->prop('status') || 'disabled';
+if ($status eq 'enabled'){
+  processTemplate(
+        {   
+            TEMPLATE_PATH => "/etc/openvpn/s2s/openvpn-s2s.conf",
+            MORE_DATA => {DB_KEY=>$key},
+            OUTPUT_FILENAME => "/etc/openvpn/s2s/$key.conf",
+        });
+
+  if ( -f $lock ) {
+    my $pidf = "$piddir/$key.pid";
+    if ( -f $pidf ) {
+       my $pid=`cat $pidf`;
+        kill 'USR1', $pid || exit 1 ;
+       exit 0; 
+    }
+   } 
+   else {
+     print "openvpn: service not started";
+     exit 1
+   }
+}
diff -Nur --no-dereference smeserver-openvpn-s2s-0.2.old/root/etc/e-smith/locale/en-us/etc/e-smith/web/functions/openvpns2s smeserver-openvpn-s2s-0.2/root/etc/e-smith/locale/en-us/etc/e-smith/web/functions/openvpns2s
--- smeserver-openvpn-s2s-0.2.old/root/etc/e-smith/locale/en-us/etc/e-smith/web/functions/openvpns2s    2013-11-11 12:33:06.000000000 -0500
+++ smeserver-openvpn-s2s-0.2/root/etc/e-smith/locale/en-us/etc/e-smith/web/functions/openvpns2s        2021-03-30 00:54:14.068000000 -0400
@@ -285,4 +285,71 @@
         <base>IP_IN_LOCAL_NET</base>
         <trans>This IP address is part of one of your local networks</trans>
     </entry>
+
+    <entry>
+        <base>INSECURE</base>
+        <trans>Insecure parameter</trans>
+    </entry>
+    <entry>
+        <base>SUGGESTED</base>
+        <trans>Sugested value</trans>
+    </entry>
+    <entry>
+        <base>DEFAULT</base>
+        <trans>Default</trans>
+    </entry>
+    <entry>
+        <base>DOWN</base>
+        <trans>Down</trans>
+    </entry>
+    <entry>
+        <base>UP</base>
+        <trans>Up</trans>
+    </entry>
+    <entry>
+        <base>SUCCESS_RELOAD</base>
+        <trans>VPN connection reloaded with success</trans>
+    </entry>
+    <entry>
+        <base>DESC_RELOAD</base>
+        <trans>Do you really want to reload this vpn connection?</trans>
+    </entry>
+    <entry>
+        <base>RELOAD</base>
+        <trans>reload</trans>
+    </entry>
+    <entry>
+        <base>DESC_HMAC</base>
+        <trans>HMAC is part of the encryption of the data channel for openvpn (where your data travel) after encryption with the cipher. Default is the insecure SHA1, we suggest you to at least use SHA256. This setting should match on both the server and the client</trans>
+    </entry>
+    <entry>
+        <base>LABEL_HMAC</base>
+        <trans>HMAC algorithm</trans>
+    </entry>
+    <entry>
+        <base>DESC_CIPHER</base>
+        <trans>The cipher used for your data channel for openvpn. The default is to use the insecure BlowFish algorithm. We suggest you the AES-128-CBC or higher. This setting should match on both the server and the client.</trans>
+    </entry>
+    <entry>
+        <base>LABEL_CIPHER</base>
+        <trans>Cipher encryption algorithm</trans>
+    </entry>
+    <entry>
+        <base>DESC_SNAT</base>
+        <trans>SNAT Outbound can be enabled or disabled (default is enabled). When enabled, connections initiated by the server itself will be SNATed so they will appear to come from the internal IP. If disabled, connections from the server itself will have the virtual IP as source.</trans>
+    </entry>
+    <entry>
+        <base>LABEL_SNAT</base>
+        <trans>SNAT Outbound</trans>
+    </entry>
+    <entry>
+        <base>CIPHER</base>
+        <trans>Cipher</trans>
+    </entry>
+    <entry>
+        <base>LINK</base>
+        <trans>Link status</trans>
+    </entry>
+
+
 </lexicon>
diff -Nur --no-dereference smeserver-openvpn-s2s-0.2.old/root/etc/e-smith/templates/etc/openvpn/s2s/openvpn-s2s.conf/30key smeserver-openvpn-s2s-0.2/root/etc/e-smith/templates/etc/openvpn/s2s/openvpn-s2s.conf/30key
--- smeserver-openvpn-s2s-0.2.old/root/etc/e-smith/templates/etc/openvpn/s2s/openvpn-s2s.conf/30key     2021-03-30 00:12:27.713000000 -0400
+++ smeserver-openvpn-s2s-0.2/root/etc/e-smith/templates/etc/openvpn/s2s/openvpn-s2s.conf/30key 2021-03-30 00:54:12.710000000 -0400
@@ -5,16 +5,41 @@
 my $checkcrt = $db->get_prop($key,'CheckCertificateUsage') || 'disabled';
 my $tlsremote = $db->get_prop($key,'RemoteCommonName') || '';
 
+#HMAC default is SHA1 if empty, we really want higher on new setup, but keep empty for default on existing one...
+# need to be changed on both side
+my $HMAC = ( $db->get_prop($key,'HMAC') ) ?  $db->get_prop($key,'HMAC') : undef;
+# cipher default to BF if empty,  we really want higher on new setup, but keep empty for default on existing one...
+# # here openvpn uses encrypt-then-mc so no issue using CBC rather than GCM, and GCM not implemented before openvpn 2.4 for data channel
+my $cipher = ( $db->get_prop($key,'Cipher') && $db->get_prop($key,'Cipher') ne 'auto')? $db->get_prop($key,'Cipher')  : undef;
+
+## we do not want any tls 1.1 or lower, this does not break anything to force, unless the client is very old and limited to 1.1 or lower
+my $tlsVmin = (  $db->get_prop($key,'tlsVmin') && ( $db->get_prop($key,'tlsVmin') =~ /^1\.[0-9]{1}$/  ) ) ? $db->get_prop($key,'tlsVmin')  : "1.2";
+# TLS 1.3 encryption settings
+my $tlsCipherSuites13 = (  $db->get_prop($key,'tlsCipherSuites13') ) ?  $db->get_prop($key,'tlsCipherSuites13') : "TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256";
+# # TLS 1.2 encryption settings
+my $tlsCipher12 = (  $db->get_prop($key,'tlsCipher12') ) ? $db->get_prop($key,'tlsCipher12') : "TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256:TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256:TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256:TLS-ECDHE-RSA-WITH-AES-128-GCM-SHA256";
+
+
+# cipher default to BF if empty,  we really want higher on new setup, but keep empty for default on existing one...
+# here openvpn uses encrypt-then-mc so no issue using CBC rather than GCM, and GCM not implemented before openvpn 2.4 for data channel
+my $cipher = ( $db->get_prop($key,'Cipher') && $db->get_prop($key,'Cipher') ne 'auto')? $db->get_prop($key,'Cipher')  : undef; 
+
+
 if ($auth eq 'SharedKey'){
     $OUT .= "secret priv/$key"."_sharedkey.pem\n";
 }
 elsif ($auth eq 'TLS'){
     if ($type eq 'server'){
         $OUT .= "tls-server\n";
+       $OUT .= "tls-version-min $tlsVmin\n";
+        $OUT .= "tls-cipher $tlsCipher12\n" if defined $tlsCipher12;
+        $OUT .= "tls-ciphersuites tlsCipherSuites13\n" if defined tlsCipherSuites13;
         $OUT .= "ca pub/$key" . "_cacert.pem\n";
         $OUT .= "cert pub/$key" . "_cert.pem\n";
         $OUT .= "key priv/$key" . "_key.pem\n";
         $OUT .= "dh pub/$key" . "_dh.pem\n";
+       $OUT .= "# we might be able to disable dh param with this one, NSA-'s recommended curve\n";
+        $OUT .= "ecdh-curve secp384r1\n";
         $OUT .= "tls-auth priv/$key" . "_sharedkey.pem 0\n"
            if ( -e "/etc/openvpn/s2s/priv/$key".'_sharedkey.pem' ) &&
               ( ! -z "/etc/openvpn/s2s/priv/$key".'_sharedkey.pem' );
@@ -26,9 +51,14 @@
     }
     else{
         $OUT .= "tls-client\n";
+        $OUT .= "tls-version-min $tlsVmin\n";
+        $OUT .= "tls-cipher $tlsCipher12\n" if defined $tlsCipher12;
+        $OUT .= "tls-ciphersuites tlsCipherSuites13\n" if defined tlsCipherSuites13;
         $OUT .= "ca pub/$key" . "_cacert.pem\n";
         $OUT .= "cert pub/$key" . "_cert.pem\n";
         $OUT .= "key priv/$key" . "_key.pem\n";
+        $OUT .= "# we might be able to disable dh param with this one, NSA-'s recommended curve\n";
+        $OUT .= "ecdh-curve secp384r1\n";
         $OUT .= "tls-auth priv/$key" . "_sharedkey.pem 1\n"
            if ( -e "/etc/openvpn/s2s/priv/$key".'_sharedkey.pem' ) &&
               ( ! -z "/etc/openvpn/s2s/priv/$key".'_sharedkey.pem' );
@@ -40,5 +70,12 @@
     }
 }
 
+     # available for both sharedkey and tls
+     # data channel
+     $OUT .= "#securing data channel\n";
+     $OUT .= (defined $cipher) ? "cipher $cipher\n" : "# no cipher defined default to Blowfish, this is INSECURE, please consider AES-128-CBC or higher on both client and server\n";
+     #auth SHA512
+     $OUT .= (defined $HMAC )? "auth $HMAC\n" : "# no HMAC defined, default to SHA1, please consider SHA256 or higher on both client and server\n";
+#
 }
 
diff -Nur --no-dereference smeserver-openvpn-s2s-0.2.old/root/etc/e-smith/templates/etc/openvpn/s2s/openvpn-s2s.conf/60options smeserver-openvpn-s2s-0.2/root/etc/e-smith/templates/etc/openvpn/s2s/openvpn-s2s.conf/60options
--- smeserver-openvpn-s2s-0.2.old/root/etc/e-smith/templates/etc/openvpn/s2s/openvpn-s2s.conf/60options 2013-11-11 12:33:06.000000000 -0500
+++ smeserver-openvpn-s2s-0.2/root/etc/e-smith/templates/etc/openvpn/s2s/openvpn-s2s.conf/60options     2021-03-30 00:54:12.466000000 -0400
@@ -1,13 +1,11 @@
 # Options
 {
 
-my $cipher = $db->get_prop($key,'Cipher') || 'auto';
 my $comp = $db->get_prop($key,'Compression') || 'enabled';     
 
 
 $OUT .= "comp-lzo adaptive\n" if ($comp eq 'enabled');
 
-$OUT .= "cipher $cipher\n" if ($cipher ne 'auto');
 
 if ($type eq 'server'){
     $OUT .= "ping-timer-rem\n";
diff -Nur --no-dereference smeserver-openvpn-s2s-0.2.old/root/etc/e-smith/web/functions/openvpns2s smeserver-openvpn-s2s-0.2/root/etc/e-smith/web/functions/openvpns2s
--- smeserver-openvpn-s2s-0.2.old/root/etc/e-smith/web/functions/openvpns2s     2013-11-11 12:33:06.000000000 -0500
+++ smeserver-openvpn-s2s-0.2/root/etc/e-smith/web/functions/openvpns2s 2021-03-30 00:54:12.925000000 -0400
@@ -4,7 +4,7 @@
 #----------------------------------------------------------------------
 # heading       : Configuration
 # description   : OpenVPN Site to Site
-# navigation    : 1000 1000
+# navigation    : 6000 6750
 #----------------------------------------------------------------------
 
 #----------------------------------------------------------------------
@@ -99,6 +99,16 @@
             <label>LABEL_AUTH</label>
         </field>
 
+        <field type="select" id="hmac"  options="get_digests_options()" value="get_current_hmac()">
+            <description>DESC_HMAC</description>
+            <label>LABEL_HMAC</label>
+        </field>
+
+        <field type="select" id="cipher" options="get_ciphers_options()" value="get_current_cipher()">
+            <description>DESC_CIPHER</description>
+            <label>LABEL_CIPHER</label>
+        </field>
+
         <field type="text" id="remote_host" validation="is_hostname_or_ip()">
             <description>DESC_REMOTE_HOST</description>
             <label>LABEL_REMOTE_HOST</label>
@@ -119,13 +129,18 @@
             <label>LABEL_REMOTE_IP</label>
         </field>
 
+        <field type="select" id="SnatOutbound" value="" options="'disabled' => 'DISABLED', 'enabled' => 'ENABLED'">
+            <description>DESC_SNAT</description>
+            <label>LABEL_SNAT</label>
+        </field>
+
+
         <field type="text"  size="53" id="remote_net" validation="is_valid_net_or_empty()">
             <description>DESC_REMOTE_NET</description>
             <label>LABEL_REMOTE_NET</label>
         </field>
 
         <subroutine src="print_button('NEXT')"/>
-
     </page>
 
     #----------------------------------------------------------------
@@ -156,6 +171,16 @@
             <label>LABEL_AUTH</label>
         </field>
 
+       <field type="select" id="hmac"  options="get_digests_options()" value="get_current_hmac()">
+            <description>DESC_HMAC</description>
+            <label>LABEL_HMAC</label>
+        </field>
+
+        <field type="select" id="cipher" options="get_ciphers_options()" value="get_current_cipher()">
+            <description>DESC_CIPHER</description>
+            <label>LABEL_CIPHER</label>
+        </field>
+
         <field type="text" id="port" validation="is_valid_and_available_port()">
             <description>DESC_LOCAL_PORT</description>
             <label>LABEL_LOCAL_PORT</label>
@@ -196,4 +221,11 @@
         <subroutine src="print_conf_to_remove()"/>
     </page>
 
+    <page name="RELOAD_PAGE" pre-event="turn_off_buttons()"  post-event="reload()">
+        <field type="literal" id="conf_name">
+            <description>DESC_RELOAD</description>
+        </field>
+        <subroutine src="print_button('NEXT')"/>
+    </page>
+
 </form>
diff -Nur --no-dereference smeserver-openvpn-s2s-0.2.old/root/usr/lib/systemd/system/openvpn-s2s.service smeserver-openvpn-s2s-0.2/root/usr/lib/systemd/system/openvpn-s2s.service
--- smeserver-openvpn-s2s-0.2.old/root/usr/lib/systemd/system/openvpn-s2s.service       2021-03-30 00:12:27.732000000 -0400
+++ smeserver-openvpn-s2s-0.2/root/usr/lib/systemd/system/openvpn-s2s.service   2021-03-30 00:54:13.389000000 -0400
@@ -1,10 +1,16 @@
 [Unit]
 Description=OpenVPN Server to Server
 After=network.service
+
 [Service]
-Type=forking
+Type=oneshot
+RemainAfterExit=yes
+GuessMainPID=no
+
 ExecStart=/usr/sbin/systemd/openvpn-s2s start
 ExecStop=/usr/sbin/systemd/openvpn-s2s stop
+ExecReload=/usr/sbin/systemd/openvpn-s2s reopen
+
 [Install]
 WantedBy=sme-server.target
 
diff -Nur --no-dereference smeserver-openvpn-s2s-0.2.old/root/usr/sbin/systemd/openvpn-s2s smeserver-openvpn-s2s-0.2/root/usr/sbin/systemd/openvpn-s2s
--- smeserver-openvpn-s2s-0.2.old/root/usr/sbin/systemd/openvpn-s2s     2021-03-30 00:12:27.732000000 -0400
+++ smeserver-openvpn-s2s-0.2/root/usr/sbin/systemd/openvpn-s2s 2021-03-30 00:54:13.631000000 -0400
@@ -90,6 +90,9 @@
   fi
 done
 
+#ncp
+ncp=" --ncp-ciphers AES-256-GCM:AES-128-GCM:AES-256-CBC:AES-128-CBC:BF-CBC "
+
 # Lockfile
 lock="/var/lock/subsys/openvpn-s2s"
 
@@ -218,6 +221,7 @@
                    kill -HUP `cat $pidf` >/dev/null 2>&1
                fi
            done
+           exit 0
        else
            echo "openvpn: service not started"
            exit 1
@@ -230,6 +234,7 @@
                    kill -USR1 `cat $pidf` >/dev/null 2>&1
                fi
            done
+           exit 0
        else
            echo "openvpn: service not started"
            exit 1
diff -Nur --no-dereference smeserver-openvpn-s2s-0.2.old/root/usr/share/perl5/vendor_perl/esmith/FormMagick/Panel/openvpns2s.pm smeserver-openvpn-s2s-0.2/root/usr/share/perl5/vendor_perl/esmith/FormMagick/Panel/openvpns2s.pm
--- smeserver-openvpn-s2s-0.2.old/root/usr/share/perl5/vendor_perl/esmith/FormMagick/Panel/openvpns2s.pm        2021-03-30 00:12:27.724000000 -0400
+++ smeserver-openvpn-s2s-0.2/root/usr/share/perl5/vendor_perl/esmith/FormMagick/Panel/openvpns2s.pm    2021-03-30 01:19:05.081000000 -0400
@@ -26,6 +26,7 @@
     remove_conf
     print_conf_to_remove
     read_file
+    reload
 );
 
 our $pubdir = '/etc/openvpn/s2s/pub';
@@ -91,6 +92,21 @@
     $ovpn_db->set_prop($conf, 'status', $q->param("status"));
     $ovpn_db->set_prop($conf, 'Comment', $q->param("comment"));
     $ovpn_db->set_prop($conf, 'RemoteNetworks', $q->param("remote_net"));
+    $ovpn_db->set_prop($conf, 'SnatOutbound', $q->param("SnatOutbound"));
+    if ($q->param("hmac") eq 'SHA1') {
+       my $tmpk = $ovpn_db->get($conf);
+       $tmpk->delete_prop('HMAC');
+    }
+    else {
+       $ovpn_db->set_prop($conf, 'HMAC' , $q->param("hmac"));
+    }
+    if ($q->param("cipher") eq 'BF-CBC') {
+       my $tmpk = $ovpn_db->get($conf);
+       $tmpk->delete_prop('cipher');
+    }
+    else {
+       $ovpn_db->set_prop($conf, 'cipher', $q->param("cipher"));
+    }
 
     # Now, update the main configuration entry
     update_ports();
@@ -153,6 +169,9 @@
     }
     print KEY $q->param('key_pem');
     close KEY;
+    chmod(0600, "$privdir/${conf}_key.pem" );
+    esmith::util::chownFile("root", "root","$privdir/${conf}_key.pem" );
+
 
     if (! open (DH, ">$pubdir/$conf" . "_dh.pem")){
         $fm->error('ERROR_OPEN_DH','FIRST_PAGE');
@@ -167,11 +186,13 @@
     }
     print TA $q->param('shared_key');
     close TA;
+    chmod(0600, "$privdir/${conf}_sharedkey.pem" );
+    esmith::util::chownFile("root", "root","$privdir/${conf}_sharedkey.pem" );
 
-    esmith::util::chownFile("root", "root", "$privdir/$conf*");
-    esmith::util::chownFile("root", "root", "$pubdir/$conf*");
-    chmod 0600, "$privdir/$conf*";
-    chmod 0644, "$pubdir/$conf*";
+    esmith::util::chownFile("root", "root", "$privdir");
+    esmith::util::chownFile("root", "root", "$pubdir");
+    chmod 0600, "$privdir";
+    chmod 0644, "$pubdir";
 
     $ovpn_db->set_prop($conf, 'CrlUrl', $q->param("crl_url"));
 
@@ -294,6 +315,22 @@
 
 
 # Print clients or servers table
+sub reload{
+    my ($fm) = @_;
+    my $q = $fm->{cgi};
+    my $conf = $q->param('conf_name');
+    #$conf = $conf=~ m/^([a-zA-Z\-\_0-9]+)$/;
+    unless (system ("/sbin/e-smith/signal-event", "openvpn-s2s-update-one", $conf) == 0 ){
+            $fm->error('ERROR_OCCURED1','FIRST_PAGE');
+            return undef;
+        }
+    $fm->success( $fm->localise('SUCCESS_RELOAD') . " $conf" ,'FIRST_PAGE');
+    return undef;
+
+
+}
+
+# Print clients or servers table
 sub print_conf_table{
     my $fm = shift;
     my $type = shift;
@@ -310,8 +347,15 @@
     print $q->start_table({-CLASS => "sme-border"}),"\n";
     print $q->Tr (
             esmith::cgi::genSmallCell($q, $fm->localise('CONF_NAME'),"header"),
-            esmith::cgi::genSmallCell($q, $fm->localise('MODIFY'),"header"),
-            esmith::cgi::genSmallCell($q, $fm->localise('STATUS'),"header")),"\n";
+            esmith::cgi::genSmallCell($q, $fm->localise('STATUS'),"header"),
+            esmith::cgi::genSmallCell($q, $fm->localise('CIPHER'),"header"),
+           esmith::cgi::genSmallCell($q, 'HMAC',"header"),
+            esmith::cgi::genSmallCell($q, $fm->localise('LABEL_AUTH'),"header"),
+            esmith::cgi::genSmallCell($q, $fm->localise('LINK'),"header"),
+            esmith::cgi::genSmallCell($q, $fm->localise('ACTION'),"header", 3),
+       ),
+           "\n";
+
 
     foreach my $config (@conf){
         my $key = $config->key;
@@ -323,11 +367,28 @@
         elsif ($status eq 'disabled'){
             $status = $fm->localise('DISABLED');
         }
+        my $cipher = $config->prop('cipher') || 'BF-CBC';
+       $cipher = "<span style='color:red'>". $fm->localise('INSECURE'). " $cipher</span> " unless ($cipher =~ /(128|192|256|512|SEED)/ );
+        my $hmac   = $config->prop('HMAC') || 'SHA1';
+       $hmac= "<span style='color:red'>". $fm->localise('INSECURE'). " $hmac</span> " unless ($hmac eq "whirlpool" || $hmac =~ /(512|256|384|224)$/);
+        my $authe  = $config->prop('Authentication') || '';
+       my $linkup = "<span style='color:red'>". $fm->localise('DOWN')."</span>" ;
+       use Net::Ping;
+       my $p = Net::Ping->new();
+       $linkup = "<span style='color:green'>". $fm->localise('UP') ."</span>"  if $p->ping($config->prop('RemoteIP'));
+
         print $q->Tr (esmith::cgi::genSmallCell($q,"$key"),
+                      esmith::cgi::genSmallCell($q,"$status"),
+                      esmith::cgi::genSmallCell($q,"$cipher"),
+                      esmith::cgi::genSmallCell($q,"$hmac"),
+                      esmith::cgi::genSmallCell($q,"$authe"),
+                      esmith::cgi::genSmallCell($q,"$linkup"),
+                      esmith::cgi::genSmallCell ($q, $q->a ({href => $q->url (-absolute => 1).
+                                $base_url."RELOAD_PAGE&action=reload&conf_name=".
+                                $key}, $fm->localise('RELOAD'))),
                       esmith::cgi::genSmallCell ($q, $q->a ({href => $q->url (-absolute => 1).
                                 $base_url."CREATE_OR_MODIFY_".uc($type)."_CONF_PAGE&action=modify&conf_name=".
                                 $key}, $fm->localise('MODIFY'))),
-                      esmith::cgi::genSmallCell($q,"$status"),
                       esmith::cgi::genSmallCell ($q, $q->a ({href => $q->url (-absolute => 1).
                                 $base_url."REMOVE_CONF_PAGE&conf_name=".
                                 $key}, $fm->localise('REMOVE'))));
@@ -376,6 +437,13 @@
                     $rec->prop('status'));
             $q->param(-name=>'remote_net',-value=>
                     $rec->prop('RemoteNetworks'));
+           $q->param(-name=>'hmac',-value=>
+                    get_current_hmac($fm)); 
+            $q->param(-name=>'cipher',-value=>
+                    get_current_cipher($fm)); 
+           $q->param(-name=>'SnatOutbound',-value=>
+                    $rec->prop('SnatOutbound'));
+
         }
     }
     else {
@@ -487,7 +555,7 @@
 sub is_url_or_empty{
     my ($fm, $url) = @_;
     my $ret = 'OK';
-    if (($url !~ /^(http:\/\/)|(https:\/\/)/) && ($url ne '')){
+    if (defined $url && ($url !~ /^(http:\/\/)|(https:\/\/)/) && ($url ne '')){
         $ret = $fm->localise('NOT_A_VALID_URL',{string => $url});
     }
     return $ret;
@@ -604,4 +672,110 @@
     return $ret;
 }
 
+
+
+###### those are copy paste for bridge and s2s
+#
+=head2 get_current_hmac
+
+=cut
+sub get_current_hmac{
+    my ($self) = @_;
+    my $name = $self->cgi->param('conf_name') or return "SHA256";
+    my $cvpn= $ovpn_db->get($name);
+    return "SHA1" unless defined $cvpn->prop('HMAC');
+    return $cvpn->prop('HMAC') ;
+}
+
+
+=head2 get_digests_options 
+
+=cut
+sub get_digests_options{
+   my ($self) = @_;
+   my $translate = $self->localise('DEFAULT');
+   my $suggested = $self->localise('SUGGESTED');
+   my %options= (
+        'whirlpool' => 'whirlpool (512)',
+        'SHA512' => 'SHA512',
+        'SHA384' => 'SHA384',
+        'SHA256' => 'SHA256' . ": $suggested",
+        'SHA224' => 'SHA224',
+        'SHA1' => 'SHA1 (160)' . ": $translate",
+        'SHA' => 'SHA (160)',
+        'ecdsa-with-SHA1' => 'ecdsa-with-SHA1 (160)',
+        'RIPEMD160' => 'RIPEMD160',
+       'MD5' => 'MD5 (128)',
+       'MD4' => 'MD4 (128)',
+       );
+   return \%options;
+}
+
+
+=head2 get_current_cipher
+list obtained using
+openvpn --show-digests | egrep 'digest size' | awk {'print "'\''" $1 "'\'' => '\''" $1 "'\''," '}
+=cut
+sub get_current_cipher{
+    my ($self) = @_; 
+    my $name = $self->cgi->param('conf_name') or return "AES-128-CBC";
+    my $cvpn= $ovpn_db->get($name);
+    return "BF-CBC" unless defined $cvpn->prop('cipher');
+    return $cvpn->prop('cipher') ;
+}
+
+=head2 get_ciphers_options 
+list obtained using
+openvpn --show-ciphers | egrep '^[A-Z]{2}' |  sed 's/ by//; s/ default//; s/block,/block/; s/)// ' | awk {'print "    '\''" $1 "'\'' => '\''" $1 $2 " " $4 " "  $5 " "  $7")'\''," '}
+then reduced to remove most of insecure ciphers
+Using a CBC or GCM mode is recommended.
+In static key mode only CBC mode is allowed.
+
+=cut
+sub get_ciphers_options{
+   my ($self) = @_;
+   my $translate = $self->localise('DEFAULT');
+   my $suggested = $self->localise('SUGGESTED');
+   my %options= (
+    'AES-128-CBC' => 'AES-128-CBC (128 key, 128 block)'.": $suggested",
+    'AES-128-CFB' => 'AES-128-CFB (128 key, 128 block)',
+    'AES-128-CFB1' => 'AES-128-CFB1 (128 key, 128 block)',
+    'AES-128-CFB8' => 'AES-128-CFB8 (128 key, 128 block)',
+    'AES-128-GCM' => 'AES-128-GCM (128 key, 128 block)',
+    'AES-128-OFB' => 'AES-128-OFB (128 key, 128 block)',
+    'AES-192-CBC' => 'AES-192-CBC (192 key, 128 block)',
+    'AES-192-CFB' => 'AES-192-CFB (192 key, 128 block)',
+    'AES-192-CFB1' => 'AES-192-CFB1 (192 key, 128 block)',
+    'AES-192-CFB8' => 'AES-192-CFB8 (192 key, 128 block)',
+    'AES-192-GCM' => 'AES-192-GCM (192 key, 128 block)',
+    'AES-192-OFB' => 'AES-192-OFB (192 key, 128 block)',
+    'AES-256-CBC' => 'AES-256-CBC (256 key, 128 block)',
+    'AES-256-CFB' => 'AES-256-CFB (256 key, 128 block)',
+    'AES-256-CFB1' => 'AES-256-CFB1 (256 key, 128 block)',
+    'AES-256-CFB8' => 'AES-256-CFB8 (256 key, 128 block)',
+    'AES-256-GCM' => 'AES-256-GCM (256 key, 128 block)',
+    'AES-256-OFB' => 'AES-256-OFB (256 key, 128 block)',
+    'CAMELLIA-128-CBC' => 'CAMELLIA-128-CBC (128 key, 128 block)',
+    'CAMELLIA-128-CFB' => 'CAMELLIA-128-CFB (128 key, 128 block)',
+    'CAMELLIA-128-CFB1' => 'CAMELLIA-128-CFB1 (128 key, 128 block)',
+    'CAMELLIA-128-CFB8' => 'CAMELLIA-128-CFB8 (128 key, 128 block)',
+    'CAMELLIA-128-OFB' => 'CAMELLIA-128-OFB (128 key, 128 block)',
+    'CAMELLIA-192-CBC' => 'CAMELLIA-192-CBC (192 key, 128 block)',
+    'CAMELLIA-192-CFB' => 'CAMELLIA-192-CFB (192 key, 128 block)',
+    'CAMELLIA-192-CFB1' => 'CAMELLIA-192-CFB1 (192 key, 128 block)',
+    'CAMELLIA-192-CFB8' => 'CAMELLIA-192-CFB8 (192 key, 128 block)',
+    'CAMELLIA-192-OFB' => 'CAMELLIA-192-OFB (192 key, 128 block)',
+    'CAMELLIA-256-CBC' => 'CAMELLIA-256-CBC (256 key, 128 block)',
+    'CAMELLIA-256-CFB' => 'CAMELLIA-256-CFB (256 key, 128 block)',
+    'CAMELLIA-256-CFB1' => 'CAMELLIA-256-CFB1 (256 key, 128 block)',
+    'CAMELLIA-256-CFB8' => 'CAMELLIA-256-CFB8 (256 key, 128 block)',
+    'CAMELLIA-256-OFB' => 'CAMELLIA-256-OFB (256 key, 128 block)',
+    'SEED-CBC' => 'SEED-CBC (128 key, 128 block)',
+    'SEED-CFB' => 'SEED-CFB (128 key, 128 block)',
+    'SEED-OFB' => 'SEED-OFB (128 key, 128 block)',
+    'BF-CBC' => 'BF-CBC(128 key, 64 block)'. ": $translate ",
+        );
+   return \%options;
+}
+
 1;