Skip to contentSkip to conversation

Get rid of old OpenSSL workarounds.

PATCH In review Steffan Karger 2 participants 4 messages Mar 5, 2015 – Mar 6, 2015

lore
Share & tools
lore

Steffan Karger

author
#0 lore raw

PATCH 1/2 Get rid of old OpenSSL workarounds.

We now only support OpenSSL 0.9.8+, so we don't have to work around the bug in 0.9.6b anymore. Also, OBJ_txt2nid() now takes a const char * (instead of a char *), so we no langer have to cast away const.

Signed-off-by Steffan Karger <[email protected]...>
---
 src/openvpn/ssl_verify_openssl.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
src/openvpn/ssl_verify_openssl.c +2 -2
index 0348e98..81b2e38 100644
@@ -169,8 +169,8 @@ extract_x509_field_ssl (X509_NAME *x509, const char *field_name, char *out,
   int tmp = -1;
   X509_NAME_ENTRY *x509ne = 0;
   ASN1_STRING *asn1 = 0;
-  unsigned char *buf = (unsigned char *)1; /* bug in OpenSSL 0.9.6b ASN1_STRING_to_UTF8 requires this workaround */
-  int nid = OBJ_txt2nid((char *)field_name);
+  unsigned char *buf = NULL;
+  int nid = OBJ_txt2nid(field_name);
 
   ASSERT (size > 0);
   *out = '\0';
Signature · 1 line
2.1.0
author
#1 lore raw

PATCH 2/2 polarssl: make sure to always null-terminate the cn

Just a precaution, this could never fail in the current code since in the one place this function is called, the cn is already zero-initialized.

Signed-off-by Steffan Karger <[email protected]...>
---
 src/openvpn/ssl_verify_polarssl.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
src/openvpn/ssl_verify_polarssl.c +4 -1
index 3e8d712..976df50 100644
@@ -115,7 +115,10 @@ backend_x509_get_username (char *cn, int cn_len,
 
   /* Found, extract CN */
   if (cn_len > name->val.len)
-    memcpy( cn, name->val.p, name->val.len );
+    {
+      memcpy( cn, name->val.p, name->val.len );
+      cn[name->val.len] = '\0';
+    }
   else
     {
       memcpy( cn, name->val.p, cn_len);
Signature · 1 line
2.1.0
#2 lore raw

[Openvpn-devel] [PATCH applied] Re: polarssl: make sure to always null-terminate the cn

ACK. Your patch has been applied to the master branch.

commit 63559e142eb71a5e38dfc55d429f35f6e1af0b7c (master)

Author: Steffan Karger
Date:   Thu Mar 5 22:58:36 2015 +0100
     polarssl: make sure to always null-terminate the cn

     Signed-off-by: Steffan Karger <[email protected]...>
     Acked-by: Gert Doering <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/9511
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering

#3 lore raw
In reply to Steffan Karger

ACK. Your patch has been applied to the master branch.

commit 48e5e425b7568d8fbd2e32517b7c358dbb6d4c5f (master)

Author: Steffan Karger
Date:   Thu Mar 5 22:58:35 2015 +0100
     Get rid of old OpenSSL workarounds.

     Signed-off-by: Steffan Karger <[email protected]...>
     Acked-by: Gert Doering <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/9512
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering