Skip to contentSkip to conversation

add --compat-names option

PATCH New Heiko Hund 4 participants 5 messages Aug 17, 2012 – Sep 12, 2012

lore
Share & tools
lore

Heiko Hund

author
#0 lore raw

PATCH 1/1 add --compat-names option

With this option, users can basically undo the changes of the UTF-8 support commit 5e86fd93779482b90a191f929edebe414cd78a4f. It's here for short term compatibility and should be removed again as soon as possible.

When OpenSSL is used, the subject strings will be in the proprietary format again. Generally username, X.509 CN, and X.509 subject will again be subject to '_' replacemant, unless the "no-remapping" flag is also specified. That flag ensures compatibility with setups using the --no-name-remapping option, that has been removed in 2.3.

Signed-off-by Heiko Hund <[email protected]...>
---
 doc/openvpn.8                    |   22 ++++++++++++++++
 src/openvpn/misc.c               |   12 +++++++++
 src/openvpn/misc.h               |    6 +++++
 src/openvpn/options.c            |   10 +++++++
 src/openvpn/ssl_verify.c         |   53 +++++++++++++++++++++++++++++++-------
 src/openvpn/ssl_verify_openssl.c |   12 +++++++++
 6 files changed, 106 insertions(+), 9 deletions(-)
doc/openvpn.8 +22 -0
index 56be29e..73f3bdf 100644
@@ -3395,6 +3395,28 @@ the authenticated username as the common name,
 rather than the common name from the client cert.
 .\"*********************************************************
 .TP
+.B \-\-compat-names [no-remapping]
+Format usernames, X.509 Common Name and Subject as versions before OpenVPN 2.3
+did.  This option will be removed again in the future and exists solely to
+ease the transition from the proprietary OpenSSL format, in which OpenVPN
+additionally replaced some octets with underscores, to the naming scheme
+complying to RFC 2253.
+
+With this option, OpenVPN will remap any character other than alphanumeric,
+underacore ('_'), dash ('-'), dot ('.'), and slash ('/') to underscore ('_').
+The X509 Subject string as returned by the
+.B tls_id
+environmental variable, can additionally contain colon (':') or equal ('=').
+
+In
+.B no-remapping
+mode the Common Name, Subject, and username strings are allowed to include
+any printable character including space, but excluding control characters
+such as tab, newline, and carriage-return. It ensures compatibility with the
+.B \-\-no-name-remapping
+option of previous versions.
+.\"*********************************************************
+.TP
 .B \-\-port-share host port [dir]
 When run in TCP server mode, share the OpenVPN port with
 another application, such as an HTTPS server.  If OpenVPN
src/openvpn/misc.c +12 -0
index 7f72939..a5d98cc 100644
@@ -2120,3 +2120,15 @@ sanitize_control_message(const char *src, struct gc_arena *gc)
   *dest = '\0';
   return ret;
 }
+
+bool
+compat_flag (unsigned int flag)
+{
+  static unsigned int compat_flags = 0;
+
+  if (flag & COMPAT_FLAG_SET)
+    compat_flags |= (flag >> 1);
+
+  return (compat_flags & (flag >> 1));
+
+}
src/openvpn/misc.h +6 -0
index d4c8e33..a8c93ff 100644
@@ -368,4 +368,10 @@ void argv_printf_cat (struct argv *a, const char *format, ...)
 #endif
   ;
 
+#define COMPAT_FLAG_QUERY         0
+#define COMPAT_FLAG_SET           (1<<0)
+#define COMPAT_NAMES              (1<<1)
+#define COMPAT_NO_NAME_REMAPPING  (1<<2)
+bool compat_flag (unsigned int flag);
+
 #endif
src/openvpn/options.c +10 -0
index 19690e1..62a7fc6 100644
@@ -2131,6 +2131,9 @@ options_postprocess_verify_ce (const struct options *options, const struct conne
 
       if (options->stale_routes_check_interval)
         msg (M_USAGE, "--stale-routes-check requires --mode server");
+
+      if (compat_flag (COMPAT_FLAG_QUERY | COMPAT_NO_NAME_REMAPPING))
+        msg (M_USAGE, "--compat-x509-names no-remapping requires --mode server");
     }
 #endif /* P2MP_SERVER */
 

@@ -5526,6 +5529,13 @@ add_option (struct options *options,
       VERIFY_PERMISSION (OPT_P_GENERAL);
       options->ssl_flags |= SSLF_AUTH_USER_PASS_OPTIONAL;
     }
+  else if (streq (p[0], "compat-names"))
+    {
+      VERIFY_PERMISSION (OPT_P_GENERAL);
+      compat_flag (COMPAT_FLAG_SET | COMPAT_NAMES);
+      if (p[1] && streq (p[1], "no-remapping"))
+        compat_flag (COMPAT_FLAG_SET | COMPAT_NO_NAME_REMAPPING);
+    }
   else if (streq (p[0], "opt-verify"))
     {
       VERIFY_PERMISSION (OPT_P_GENERAL);
src/openvpn/ssl_verify.c +44 -9

133 lines not on this page · raw message

src/openvpn/ssl_verify_openssl.c +12 -0
index f5dce0d..30f88a1 100644
@@ -254,6 +254,18 @@ x509_get_subject (X509 *cert, struct gc_arena *gc)
   char *subject = NULL;
   int maxlen = 0;
 
+  /*
+   * Generate the subject string in OpenSSL proprietary format,
+   * when in --compat-names mode
+   */
+  if (compat_flag (COMPAT_NAMES))
+    {
+      subject = gc_malloc (256, false, gc);
+      X509_NAME_oneline (X509_get_subject_name (cert), subject, 256);
+      subject[255] = '\0';
+      return subject;
+    }
+
   subject_bio = BIO_new (BIO_s_mem ());
   if (subject_bio == NULL)
     goto err;
Signature · 1 line
1.7.9.5
#1 lore raw

PATCH 1/1 Add --compat-names option

From: Heiko Hund <[email protected]...>

With this option, users can basically undo the changes of the UTF-8 support commit 5e86fd93779482b90a191f929edebe414cd78a4f. It's here for short term compatibility and should be removed again as soon as possible.

When OpenSSL is used, the subject strings will be in the proprietary format again. Generally username, X.509 CN, and X.509 subject will again be subject to '_' replacemant, unless the "no-remapping" flag is also specified. That flag ensures compatibility with setups using the --no-name-remapping option, that has been removed in 2.3.

[v2: More comments related to compat_flags() added by DS plus using
COMPAT_FLAG_QUERY expclit]

Signed-off-by Heiko Hund <[email protected]...>
Signed-off-by David Sommerseth <[email protected]...>

---
I have reviewed this patch and suggest these minor changes, to make the usage of compat_flags() clearer. The remapping code itself looks good to me, so that gets an ACK from me. But let's add another ACK review so other can weight in too.

 doc/openvpn.8                    |   22 ++++++++++++++++
 src/openvpn/misc.c               |   21 +++++++++++++++
 src/openvpn/misc.h               |    6 +++++
 src/openvpn/options.c            |   10 +++++++
 src/openvpn/ssl_verify.c         |   54 +++++++++++++++++++++++++++++++-------
 src/openvpn/ssl_verify_openssl.c |   12 +++++++++
 6 files changed, 116 insertions(+), 9 deletions(-)
doc/openvpn.8 +22 -0
index f586744..cd039e8 100644
@@ -3399,6 +3399,28 @@ the authenticated username as the common name,
 rather than the common name from the client cert.
 .\"*********************************************************
 .TP
+.B \-\-compat-names [no-remapping]
+Format usernames, X.509 Common Name and Subject as versions before OpenVPN 2.3
+did.  This option will be removed again in the future and exists solely to
+ease the transition from the proprietary OpenSSL format, in which OpenVPN
+additionally replaced some octets with underscores, to the naming scheme
+complying to RFC 2253.
+
+With this option, OpenVPN will remap any character other than alphanumeric,
+underacore ('_'), dash ('-'), dot ('.'), and slash ('/') to underscore ('_').
+The X509 Subject string as returned by the
+.B tls_id
+environmental variable, can additionally contain colon (':') or equal ('=').
+
+In
+.B no-remapping
+mode the Common Name, Subject, and username strings are allowed to include
+any printable character including space, but excluding control characters
+such as tab, newline, and carriage-return. It ensures compatibility with the
+.B \-\-no-name-remapping
+option of previous versions.
+.\"*********************************************************
+.TP
 .B \-\-port-share host port [dir]
 When run in TCP server mode, share the OpenVPN port with
 another application, such as an HTTPS server.  If OpenVPN
src/openvpn/misc.c +21 -0
index 7f72939..d2882d8 100644
@@ -2120,3 +2120,24 @@ sanitize_control_message(const char *src, struct gc_arena *gc)
   *dest = '\0';
   return ret;
 }
+
+/**
+ * Will set or query for a global compat flag.  To modify the compat flags
+ * the COMPAT_FLAG_SET must be bitwise ORed together with the flag to set.
+ * If no "operator" flag is given it defaults to COMPAT_FLAG_QUERY,
+ * which returns the flag state.
+ *
+ * @param  flag  Flag to be set/queried for bitwise ORed with the operator flag
+ * @return Returns 0 if the flag is not set, otherwise the 'flag' value is returned
+ */
+bool
+compat_flag (unsigned int flag)
+{
+  static unsigned int compat_flags = 0;
+
+  if (flag & COMPAT_FLAG_SET)
+    compat_flags |= (flag >> 1);
+
+  return (compat_flags & (flag >> 1));
+
+}
src/openvpn/misc.h +6 -0
index d4c8e33..b6da3f4 100644
@@ -368,4 +368,10 @@ void argv_printf_cat (struct argv *a, const char *format, ...)
 #endif
   ;
 
+#define COMPAT_FLAG_QUERY         0       /** compat_flags operator: Query for a flag */
+#define COMPAT_FLAG_SET           (1<<0)  /** compat_flags operator: Set a compat flag */
+#define COMPAT_NAMES              (1<<1)  /** compat flag: --compat-names set */
+#define COMPAT_NO_NAME_REMAPPING  (1<<2)  /** compat flag: --compat-names without char remapping */
+bool compat_flag (unsigned int flag);
+
 #endif
src/openvpn/options.c +10 -0
index d25bbea..8133942 100644
@@ -2130,6 +2130,9 @@ options_postprocess_verify_ce (const struct options *options, const struct conne
 
       if (options->stale_routes_check_interval)
         msg (M_USAGE, "--stale-routes-check requires --mode server");
+
+      if (compat_flag (COMPAT_FLAG_QUERY | COMPAT_NO_NAME_REMAPPING))
+        msg (M_USAGE, "--compat-x509-names no-remapping requires --mode server");
     }
 #endif /* P2MP_SERVER */
 

@@ -5525,6 +5528,13 @@ add_option (struct options *options,
       VERIFY_PERMISSION (OPT_P_GENERAL);
       options->ssl_flags |= SSLF_AUTH_USER_PASS_OPTIONAL;
     }
+  else if (streq (p[0], "compat-names"))
+    {
+      VERIFY_PERMISSION (OPT_P_GENERAL);
+      compat_flag (COMPAT_FLAG_SET | COMPAT_NAMES);
+      if (p[1] && streq (p[1], "no-remapping"))
+        compat_flag (COMPAT_FLAG_SET | COMPAT_NO_NAME_REMAPPING);
+    }
   else if (streq (p[0], "opt-verify"))
     {
       VERIFY_PERMISSION (OPT_P_GENERAL);
src/openvpn/ssl_verify.c +45 -9

134 lines not on this page · raw message

src/openvpn/ssl_verify_openssl.c +12 -0
index f5dce0d..658f5f3 100644
@@ -254,6 +254,18 @@ x509_get_subject (X509 *cert, struct gc_arena *gc)
   char *subject = NULL;
   int maxlen = 0;
 
+  /*
+   * Generate the subject string in OpenSSL proprietary format,
+   * when in --compat-names mode
+   */
+  if (compat_flag (COMPAT_FLAG_QUERY | COMPAT_NAMES))
+    {
+      subject = gc_malloc (256, false, gc);
+      X509_NAME_oneline (X509_get_subject_name (cert), subject, 256);
+      subject[255] = '\0';
+      return subject;
+    }
+
   subject_bio = BIO_new (BIO_s_mem ());
   if (subject_bio == NULL)
     goto err;
Signature · 1 line
1.7.10.2
#2 lore raw

PATCH v3 1/1 Add --compat-names option

In reply to Heiko Hund

From: Heiko Hund <[email protected]...>

With this option, users can basically undo the changes of the UTF-8 support commit 5e86fd93779482b90a191f929edebe414cd78a4f. It's here for short term compatibility and should be removed again as soon as possible.

When OpenSSL is used, the subject strings will be in the proprietary format again. Generally username, X.509 CN, and X.509 subject will again be subject to '_' replacemant, unless the "no-remapping" flag is also specified. That flag ensures compatibility with setups using the --no-name-remapping option, that has been removed in 2.3.

[v2: More comments related to compat_flags() added by DS plus using
COMPAT_FLAG_QUERY expclit]
[v3: Improved the man page entry for --compat-names, after suggestions
from Bernhard R. Link]

Signed-off-by Heiko Hund <[email protected]...>
Signed-off-by David Sommerseth <[email protected]...>
---
 doc/openvpn.8                    |   52 ++++++++++++++++++++++++++++++++++++
 src/openvpn/misc.c               |   21 +++++++++++++++
 src/openvpn/misc.h               |    6 +++++
 src/openvpn/options.c            |   10 +++++++
 src/openvpn/ssl_verify.c         |   54 +++++++++++++++++++++++++++++++-------
 src/openvpn/ssl_verify_openssl.c |   12 +++++++++
 6 files changed, 146 insertions(+), 9 deletions(-)
doc/openvpn.8 +52 -0
index f586744..330695f 100644
@@ -3399,6 +3399,58 @@ the authenticated username as the common name,
 rather than the common name from the client cert.
 .\"*********************************************************
 .TP
+.B \-\-compat\-names [no\-remapping]
+Until OpenVPN v2.3 the format of the X.509 Subject fields was formatted
+like this:
+.IP
+.B
+/C=US/L=Somewhere/CN=John Doe/[email protected]...
+.IP
+In addition the old behavivour was to remap any character other than
+alphanumeric, underscore ('_'), dash ('-'), dot ('.'), and slash ('/') to
+underscore ('_').  The X.509 Subject string as returned by the
+.B tls_id
+environmental variable, could additionally contain colon (':') or equal ('=').
+.IP
+When using the
+.B \-\-compat\-names
+option, this old formatting and remapping will be re-enabled again.  This is
+purely implemented for compatibility reasons when using older plug-ins or
+scripts which does not handle the new formatting or UTF-8 characters.
+.IP
+In OpenVPN v2.3 the formatting of these fields changed into a more
+standardised format.  It now looks like:
+.IP
+.B
+C=US, L=Somewhere, CN=John Doe, [email protected]...
+.IP
+The new default format in OpenVPN v2.3 also does not do the character remapping
+which happened earlier.  This new format enables proper support for UTF\-8
+characters in the usernames, X.509 Subject fields and Common Name variables and
+it complies to the RFC 2253, UTF\-8 String Representation of Distinguished
+Names.
+
+As a backwards compatibility for the removed \-\-no\-name\-remapping feature in
+older OpenVPN versions, the
+.B no\-remapping
+mode flag can be used with the
+.B
+\-\-compat\-names
+option.
+When this mode flag is used, the Common Name, Subject, and username strings are
+allowed to include any printable character including space, but excluding
+control characters such as tab, newline, and carriage-return. It ensures
+compatibility with the
+.B \-\-no\-name\-remapping
+option of OpenVPN versions before v2.3.
+
+.B Please note:
+This option will not be around for a long time.  It is only implemented
+to make the transition to the new formatting less intrusive.  It will be
+removed either in OpenVPN v2.4 or v2.5.  So please make sure you start
+the process to support the new formatting as soon as possible.
+.\"*********************************************************
+.TP
 .B \-\-port-share host port [dir]
 When run in TCP server mode, share the OpenVPN port with
 another application, such as an HTTPS server.  If OpenVPN
src/openvpn/misc.c +21 -0
index 7f72939..d2882d8 100644
@@ -2120,3 +2120,24 @@ sanitize_control_message(const char *src, struct gc_arena *gc)
   *dest = '\0';
   return ret;
 }
+
+/**
+ * Will set or query for a global compat flag.  To modify the compat flags
+ * the COMPAT_FLAG_SET must be bitwise ORed together with the flag to set.
+ * If no "operator" flag is given it defaults to COMPAT_FLAG_QUERY,
+ * which returns the flag state.
+ *
+ * @param  flag  Flag to be set/queried for bitwise ORed with the operator flag
+ * @return Returns 0 if the flag is not set, otherwise the 'flag' value is returned
+ */
+bool
+compat_flag (unsigned int flag)
+{
+  static unsigned int compat_flags = 0;
+
+  if (flag & COMPAT_FLAG_SET)
+    compat_flags |= (flag >> 1);
+
+  return (compat_flags & (flag >> 1));
+
+}
src/openvpn/misc.h +6 -0
index d4c8e33..b6da3f4 100644
@@ -368,4 +368,10 @@ void argv_printf_cat (struct argv *a, const char *format, ...)
 #endif
   ;
 
+#define COMPAT_FLAG_QUERY         0       /** compat_flags operator: Query for a flag */
+#define COMPAT_FLAG_SET           (1<<0)  /** compat_flags operator: Set a compat flag */
+#define COMPAT_NAMES              (1<<1)  /** compat flag: --compat-names set */
+#define COMPAT_NO_NAME_REMAPPING  (1<<2)  /** compat flag: --compat-names without char remapping */
+bool compat_flag (unsigned int flag);
+
 #endif
src/openvpn/options.c +10 -0
index d25bbea..8133942 100644
@@ -2130,6 +2130,9 @@ options_postprocess_verify_ce (const struct options *options, const struct conne
 
       if (options->stale_routes_check_interval)
         msg (M_USAGE, "--stale-routes-check requires --mode server");
+
+      if (compat_flag (COMPAT_FLAG_QUERY | COMPAT_NO_NAME_REMAPPING))
+        msg (M_USAGE, "--compat-x509-names no-remapping requires --mode server");
     }
 #endif /* P2MP_SERVER */
 

@@ -5525,6 +5528,13 @@ add_option (struct options *options,
       VERIFY_PERMISSION (OPT_P_GENERAL);
       options->ssl_flags |= SSLF_AUTH_USER_PASS_OPTIONAL;
     }
+  else if (streq (p[0], "compat-names"))
+    {
+      VERIFY_PERMISSION (OPT_P_GENERAL);
+      compat_flag (COMPAT_FLAG_SET | COMPAT_NAMES);
+      if (p[1] && streq (p[1], "no-remapping"))
+        compat_flag (COMPAT_FLAG_SET | COMPAT_NO_NAME_REMAPPING);
+    }
   else if (streq (p[0], "opt-verify"))
     {
       VERIFY_PERMISSION (OPT_P_GENERAL);
src/openvpn/ssl_verify.c +45 -9

134 lines not on this page · raw message

src/openvpn/ssl_verify_openssl.c +12 -0
index f5dce0d..658f5f3 100644
@@ -254,6 +254,18 @@ x509_get_subject (X509 *cert, struct gc_arena *gc)
   char *subject = NULL;
   int maxlen = 0;
 
+  /*
+   * Generate the subject string in OpenSSL proprietary format,
+   * when in --compat-names mode
+   */
+  if (compat_flag (COMPAT_FLAG_QUERY | COMPAT_NAMES))
+    {
+      subject = gc_malloc (256, false, gc);
+      X509_NAME_oneline (X509_get_subject_name (cert), subject, 256);
+      subject[255] = '\0';
+      return subject;
+    }
+
   subject_bio = BIO_new (BIO_s_mem ());
   if (subject_bio == NULL)
     goto err;
Signature · 1 line
1.7.10.2
#3 lore raw

Re: [Openvpn-devel] [PATCH v3] Add --compat-names option

Hi,

Quoted 5 lines · David Sommerseth

From: Heiko Hund <[email protected]...>

With this option, users can basically undo the changes of the UTF-8 support commit 5e86fd93779482b90a191f929edebe414cd78a4f. It's here for short term compatibility and should be removed again as soon as possible.

ACK. Reviewed, and looks good. Have not actually test-compiled and run it as I do not have client certificates in place that contain UTF-8 or other funny characters - but I trust Heiko to have seen enough of that in his environment :-)

(I *do* think that the bit-shifting in compat_flags() is "slightly" overengineered, but programmers have the tendency to invest lots of brains and some code into saving a single bit... :-) - it will do the job, though, so no need to spin a v4 for that)

gert

Signature · 4 lines
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             [email protected]...
fax: +49-89-35655025                        [email protected]...
Applied
#4 lore raw

Re: [Openvpn-devel] [PATCH v3] Add --compat-names option

In reply to David Sommerseth
Quoted 19 lines · David Sommerseth

From: Heiko Hund <[email protected]...>

With this option, users can basically undo the changes of the UTF-8 support commit 5e86fd93779482b90a191f929edebe414cd78a4f. It's here for short term compatibility and should be removed again as soon as possible.

When OpenSSL is used, the subject strings will be in the proprietary format again. Generally username, X.509 CN, and X.509 subject will again be subject to '_' replacemant, unless the "no-remapping" flag is also specified. That flag ensures compatibility with setups using the --no-name-remapping option, that has been removed in 2.3.

[v2: More comments related to compat_flags() added by DS plus using
COMPAT_FLAG_QUERY expclit]
[v3: Improved the man page entry for --compat-names, after suggestions
from Bernhard R. Link]

Signed-off-by Heiko Hund <[email protected]...>
Signed-off-by David Sommerseth <[email protected]...>
Quoted 8 lines
---
 doc/openvpn.8                    |   52 ++++++++++++++++++++++++++++++++++++
 src/openvpn/misc.c               |   21 +++++++++++++++
 src/openvpn/misc.h               |    6 +++++
 src/openvpn/options.c            |   10 +++++++
 src/openvpn/ssl_verify.c         |   54 +++++++++++++++++++++++++++++++-------
 src/openvpn/ssl_verify_openssl.c |   12 +++++++++
 6 files changed, 146 insertions(+), 9 deletions(-)

Applied to master.

commit e7412ca3eee2f2a2fb0af5acbe968137cfd7e995

Author: Heiko Hund <[email protected]...>
Date:   Tue Sep 11 17:34:24 2012 +0200
    Add --compat-names option

    Signed-off-by: Heiko Hund <[email protected]...>
    Signed-off-by: David Sommerseth <[email protected]...>
    Acked-by: Gert Doering <[email protected]...>
    Acked-by: David Sommerseth <[email protected]...>
    Message-Id: [email protected]...
    URL: http://article.gmane.org/gmane.network.openvpn.devel/7053

kind regards,

David Sommerseth