Add checks for external-key-managements

PATCH In review Arne Schwabe 2 participants 2 messages Sep 10, 2012 – Sep 11, 2012

Share & tools

Arne Schwabe

author

2012-09-10 14:39 UTC #0 lore raw

PATCH 1/1 Add checks for external-key-managements

Commit 4806cc102655f1a829d656f6deb83e5953c5eab2 fixed only part of the problem. Since it removed the filename either the magic filename has to be resurrected or all checks against priv_key_file need to take to check for MF_EXTERNAL_KEY as well. This patch implements the extra checks

Signed-off-by Arne Schwabe <[email protected]...>

---
 src/openvpn/options.c |   25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

src/openvpn/options.c +24 -1

index 534e319..0f1dfc1 100644
@@ -2173,6 +2173,10 @@ options_postprocess_verify_ce (const struct options *options, const struct conne
 	  msg(M_USAGE, "Parameter --cert cannot be used when --pkcs11-provider is also specified.");
 	if (options->priv_key_file)
 	  msg(M_USAGE, "Parameter --key cannot be used when --pkcs11-provider is also specified.");
+#ifdef MANAGMENT_EXTERNAL_KEY
+	if (options->management_flags & MF_EXTERNAL_KEY)
+	  msg(M_USAGE, "Parameter --management-external-key cannot be used when --pkcs11-provider is also specified.");
+#endif
 	if (options->pkcs12_file)
 	  msg(M_USAGE, "Parameter --pkcs12 cannot be used when --pkcs11-provider is also specified.");
 #ifdef ENABLE_CRYPTOAPI

@@ -2198,6 +2202,10 @@ options_postprocess_verify_ce (const struct options *options, const struct conne
 	    msg(M_USAGE, "Parameter --key cannot be used when --cryptoapicert is also specified.");
           if (options->pkcs12_file)
 	    msg(M_USAGE, "Parameter --pkcs12 cannot be used when --cryptoapicert is also specified.");
+#ifdef MANAGMENT_EXTERNAL_KEY
+          if (options->management_flags & MF_EXTERNAL_KEY)
+	    msg(M_USAGE, "Parameter --management-external-key cannot be used when --cryptoapicert is also specified.");
+#endif
 	}
       else
 #endif

@@ -2212,6 +2220,10 @@ options_postprocess_verify_ce (const struct options *options, const struct conne
 	    msg(M_USAGE, "Parameter --cert cannot be used when --pkcs12 is also specified.");
           if (options->priv_key_file)
 	    msg(M_USAGE, "Parameter --key cannot be used when --pkcs12 is also specified.");
+#ifdef MANAGMENT_EXTERNAL_KEY
+          if (options->management_flags & MF_EXTERNAL_KEY)
+	    msg(M_USAGE, "Parameter --external-management-key cannot be used when --pkcs12 is also specified.");
+#endif
 #endif
         }
       else

@@ -2227,7 +2239,15 @@ options_postprocess_verify_ce (const struct options *options, const struct conne
 #endif
 	  if (pull)
 	    {
-	      const int sum = (options->cert_file != NULL) + (options->priv_key_file != NULL);
+
+	      const int sum = (options->cert_file != NULL) +
+#ifdef MANAGMENT_EXTERNAL_KEY
+			((options->priv_key_file != NULL) || (options->management_flags & MF_EXTERNAL_KEY));
+#else 
+		    (options->priv_key_file != NULL);
+#endif
+
+
 	      if (sum == 0)
 		{
 #if P2MP

@@ -2245,6 +2265,9 @@ options_postprocess_verify_ce (const struct options *options, const struct conne
 	  else
 	    {
 	      notnull (options->cert_file, "certificate file (--cert) or PKCS#12 file (--pkcs12)");
+#ifdef MANAGMENT_EXTERNAL_KEY
+          if (!options->management_flags & MF_EXTERNAL_KEY)
+#endif
 	      notnull (options->priv_key_file, "private key file (--key) or PKCS#12 file (--pkcs12)");
 	    }
 	}

Signature · 1 line

1.7.9.5

David Sommerseth

2012-09-11 18:08 UTC #1 lore raw

Quoted 10 lines · Arne Schwabe

Commit 4806cc102655f1a829d656f6deb83e5953c5eab2 fixed only part of the problem. Since it removed the filename either the magic filename has to be resurrected or all checks against priv_key_file need to take to check for MF_EXTERNAL_KEY as well. This patch implements the extra checks
Signed-off-by Arne Schwabe <[email protected]...>
---
 src/openvpn/options.c |   25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

ACK. Applied to master.

commit 6dad4f8e924086333d32122432f316a17ae67987

Author: Arne Schwabe <[email protected]...>
Date:   Mon Sep 10 16:39:33 2012 +0200

    Add checks for external-key-managements
      
    Signed-off-by: Arne Schwabe <[email protected]...>
    Acked-by: David Sommerseth <[email protected]...>
    Message-Id: [email protected]...
    URL: http://article.gmane.org/gmane.network.openvpn.devel/7046
    Signed-off-by: David Sommerseth <[email protected]...>

kind regards,

David Sommerseth