Skip to content

OpenVPN: Fix handling of CNs in Client Certificates #33

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ferstl wants to merge 7 commits into
base: master
Choose a base branch
from
Open

OpenVPN: Fix handling of CNs in Client Certificates #33

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
23d48f0
OpenVPN: Use the correct CN when saving certificates
ferstl Jun 20, 2014
4ed03df
OpenVPN: Extract the CN correctly and remain compatible with incorrec…
ferstl Jun 20, 2014
9ecf206
OpenVPN: Fix connection status for incorrectly saved CNs
ferstl Jun 21, 2014
49a6b89
OpenVPN: Use a stricter pattern to get the certificate's CN
ferstl Jun 23, 2014
eb26f72
OpenVPN: Improve matching of CNs
ferstl Jun 23, 2014
80b1dcf
OpenVPN: Stricter CN extraction from cert file or CSR
ferstl Jun 23, 2014
93de7df
OpenVPN: Avoid constructing regular expressions with external data
ferstl Jun 26, 2014
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 11 additions & 3 deletions config/ovpn/verify
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ my $CN = $ARGV[1];
exit 0 unless ($DEPTH eq "0");

# Strip the CN from the X509 identifier.
$CN =~ /(\/|,\ )CN=(.*)$/i;
$CN =~ /(\/|,\ )?CN=([^,\/ ]+)?/i;
$CN = $2;

my %confighash = ();
Expand All @@ -48,9 +48,17 @@ if (-f "${General::swroot}/ovpn/ovpnconfig"){
# Search for a matching CN.
exit 0 if ($cn eq $CN);

# Compatibility code for incorrectly saved CNs.
# Compatibility code for incorrectly saved CNs:

# 1) try to match an incorrectly saved CN
# See https://bugzilla.ipfire.org/show_bug.cgi?id=10552
$cn =~ s/^([^\/]+)(\/.*)?$/$1/g;

# 2) Handle OpenVPN's substitutions of space characters
# See http://lists.ipfire.org/pipermail/development/2013-January/000225.html
$cn =~ s/\ /_/g;
exit 0 if ($cn eq $CN);

exit 0 if ($cn eq $CN);
}
}

Expand Down
25 changes: 16 additions & 9 deletions html/cgi-bin/ovpnmain.cgi
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3891,11 +3891,9 @@ if ($cgiparams{'TYPE'} eq 'net') {
&deletebackupcert();
}

my $temp = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem`;
$temp =~ /Subject:.*CN=(.*)[\n]/;
my $temp = `/usr/bin/openssl x509 -subject -nameopt sep_multiline,sname,esc_ctrl,esc_msb -noout -in ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem`;
$temp =~ /^[\ ]{4}CN=(.+)$/m;
$temp = $1;
$temp =~ s+/Email+, E+;
$temp =~ s/ ST=/ S=/;
$cgiparams{'CERT_NAME'} = $temp;
$cgiparams{'CERT_NAME'} =~ s/,//g;
$cgiparams{'CERT_NAME'} =~ s/\'//g;
Expand Down Expand Up @@ -3945,14 +3943,13 @@ if ($cgiparams{'TYPE'} eq 'net') {
}
}

my $temp = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem`;
$temp =~ /Subject:.*CN=(.*)[\n]/;
my $temp = `/usr/bin/openssl x509 -subject -nameopt sep_multiline,sname,esc_ctrl,esc_msb -noout -in ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem`;
$temp =~ /^[\ ]{4}CN=(.+)$/m;
$temp = $1;
$temp =~ s+/Email+, E+;
$temp =~ s/ ST=/ S=/;
$cgiparams{'CERT_NAME'} = $temp;
$cgiparams{'CERT_NAME'} =~ s/,//g;
$cgiparams{'CERT_NAME'} =~ s/\'//g;

if ($cgiparams{'CERT_NAME'} eq '') {
unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
$errormessage = $Lang::tr{'could not retrieve common name from certificate'};
Expand Down Expand Up @@ -5111,16 +5108,26 @@ END
}else {

my $cn;
my $config_cn;
my @match = ();

foreach my $line (@status) {
chomp($line);
if ( $line =~ /^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/) {
@match = split(m/^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/, $line);
if ($match[1] ne "Common Name") {
$cn = $match[1];
}
#Handle OpenVPN's substitutions of space characters
# See http://lists.ipfire.org/pipermail/development/2013-January/000225.html
$cn =~ s/[_]/ /g;
if ($cn eq "$confighash{$key}[2]") {

# Work around incorrectly saved CNs
# See https://bugzilla.ipfire.org/show_bug.cgi?id=10552 .
$config_cn = $confighash{$key}[2];
$config_cn =~ s/^([^\/]+)(\/.*)?/$1/g;

if ($config_cn eq $cn) {
$col1="bgcolor='${Header::colourgreen}'";
$active = "<b><font color='#FFFFFF'>$Lang::tr{'capsopen'}</font></b>";
}
Expand Down