Remove deprecated --compat-x509-names and --no-name-remapping
PATCH 1/1 Remove deprecated --compat-x509-names and --no-name-remapping
As promised, remove these options for OpenVPN 2.5.
If a user still uses these, print an error that the user should update it's configuration. Just printing a warning would cause much more confusing errors, somewhere in middle of a failed connection attempt because the (non-compat) names no longer match the expected names.
--- doc/openvpn.8 | 71 ---------------------------------------- src/openvpn/misc.c | 23 ------------- src/openvpn/misc.h | 6 ---- src/openvpn/options.c | 43 ++++-------------------- src/openvpn/ssl_verify.c | 67 ++++++++----------------------------- src/openvpn/ssl_verify_openssl.c | 12 ------- 6 files changed, 21 insertions(+), 201 deletions(-)
doc/openvpn.8 +0 -71
@@ -3801,77 +3801,6 @@ the authenticated username as the common name, rather than the common name from the client cert. .\"********************************************************* .TP -.B \-\-compat\-names [no\-remapping] -.B DEPRECATED -This option will be removed in OpenVPN 2.5 - -Until OpenVPN v2.3 the format of the X.509 Subject fields was formatted -like this: -.IP -.B -/C=US/L=Somewhere/CN=John Doe/[email protected]... -.IP -In addition the old behaviour was to remap any character other than -alphanumeric, underscore ('_'), dash ('\-'), dot ('.'), and slash ('/') to -underscore ('_'). The X.509 Subject string as returned by the -.B tls_id -environmental variable, could additionally contain colon (':') or equal ('='). -.IP -When using the -.B \-\-compat\-names -option, this old formatting and remapping will be re\-enabled again. This is -purely implemented for compatibility reasons when using older plug\-ins or -scripts which does not handle the new formatting or UTF\-8 characters. -.IP -In OpenVPN 2.3 the formatting of these fields changed into a more -standardised format. It now looks like: -.IP -.B -C=US, L=Somewhere, CN=John Doe, [email protected]... -.IP -The new default format in OpenVPN 2.3 also does not do the character remapping -which happened earlier. This new format enables proper support for UTF\-8 -characters in the usernames, X.509 Subject fields and Common Name variables and -it complies to the RFC 2253, UTF\-8 String Representation of Distinguished -Names. - -The -.B no\-remapping -mode flag can be used with the -.B -\-\-compat\-names -option to be compatible with the now deprecated \-\-no\-name\-remapping option. -It is only available at the server. When this mode flag is used, the Common Name, -Subject, and username strings are allowed to include any printable character -including space, but excluding control characters such as tab, newline, and -carriage\-return. no\-remapping is only available on the server side. - -.B Please note: -This option is immediately deprecated. It is only implemented -to make the transition to the new formatting less intrusive. It will be -removed in OpenVPN 2.5. So please update your scripts/plug\-ins where necessary. -.\"********************************************************* -.TP -.B \-\-no\-name\-remapping -.B DEPRECATED -This option will be removed in OpenVPN 2.5 - -The -.B \-\-no\-name\-remapping -option is an alias for -.B \-\-compat\-names\ no\-remapping. -It ensures compatibility with server configurations using the -.B \-\-no\-name\-remapping -option. - -.B Please note: -This option is now deprecated. It will be removed in OpenVPN 2.5. -So please make sure you support the new X.509 name formatting -described with the -.B \-\-compat\-names -option as soon as possible. -.\"********************************************************* -.TP .B \-\-port\-share host port [dir] When run in TCP server mode, share the OpenVPN port with another application, such as an HTTPS server. If OpenVPN
src/openvpn/misc.c +0 -23
@@ -666,29 +666,6 @@ sanitize_control_message(const char *src, struct gc_arena *gc)return ret; } -/** -* Will set or query for a global compat flag. To modify the compat flags -* the COMPAT_FLAG_SET must be bitwise ORed together with the flag to set. -* If no "operator" flag is given it defaults to COMPAT_FLAG_QUERY, -* which returns the flag state. -* -* @param flag Flag to be set/queried for bitwise ORed with the operator flag -* @return Returns 0 if the flag is not set, otherwise the 'flag' value is returned -*/ -bool -compat_flag (unsigned int flag) -{ -static unsigned int compat_flags =0 ; - -if (flag &COMPAT_FLAG_SET ) - { - compat_flags |= (flag >>1 ); - } - -return (compat_flags & (flag >>1 )); - -} -#if P2MP_SERVER /* helper to parse peer_info received from multi client, validate
src/openvpn/misc.h +0 -6
@@ -166,12 +166,6 @@ const char *sanitize_control_message(const char *str, struct gc_arena *gc);extern const char *iproute_path;#endif -#define COMPAT_FLAG_QUERY 0/** compat_flags operator: Query for a flag */ -#define COMPAT_FLAG_SET (1<<0)/** compat_flags operator: Set a compat flag */ -#define COMPAT_NAMES (1<<1)/** compat flag: --compat-names set */ -#define COMPAT_NO_NAME_REMAPPING (1<<2)/** compat flag: --compat-names without char remapping */ -bool compat_flag (unsigned int flag); -#if P2MP_SERVER /* helper to parse peer_info received from multi client, validate * (this is untrusted data) and put into environment */
src/openvpn/options.c +7 -36
66 lines not on this page · raw message
src/openvpn/ssl_verify.c +14 -53
170 lines not on this page · raw message
src/openvpn/ssl_verify_openssl.c +0 -12
@@ -332,18 +332,6 @@ x509_get_subject(X509 *cert, struct gc_arena *gc)BUF_MEM *subject_mem;char *subject =NULL ; -/* -* Generate the subject string in OpenSSL proprietary format, -* when in --compat-names mode -*/ -if (compat_flag (COMPAT_FLAG_QUERY |COMPAT_NAMES )) - { - subject =gc_malloc (256 , false, gc); -X509_NAME_oneline (X509_get_subject_name (cert), subject,256 ); - subject[255 ] ='\0' ; -return subject; - } - subject_bio =BIO_new (BIO_s_mem ());if (subject_bio ==NULL ) {
Signature · 1 line
2.7.4
A message that is not in the archive (sent off-list or not yet received): [email protected]...
PATCH 1/1 Remove deprecated --compat-x509-names and --no-name-remapping
Sorry, sent to Steffan but not the list:
---------- Forwarded message ---------
From: Jonathan K. Bullard <[email protected]...>
Date: Wed, Oct 24, 2018 at 7:00 AM
Subject: Re: [Openvpn-devel] [PATCH] Remove deprecated --compat-x509-names and --no-name-remapping
To: Steffan Karger <[email protected]...>
Hi,
The actual option name is --compat-names, not --compat-x509-names, so the subject line of this email should be
"[Openvpn-devel] [PATCH] Remove deprecated --compat-names and
--no-name-remapping"
The existing source code (as of commit 2b15c11) uses compat-names everywhere except one place, which is in a message (shown in the patch, see below).
In addition, https://community.openvpn.net/openvpn/wiki/DeprecatedOptions
says --compat-names was deprecated in 2.3 and removed in 2.5. There is no mention of --compat-x509-names.
Quoted 7 lines · Steffan Karger
As promised, remove these options for OpenVPN 2.5.
If a user still uses these, print an error that the user should update it's configuration. Just printing a warning would cause much more confusing errors, somewhere in middle of a failed connection attempt because the (non-compat) names no longer match the expected names.
<snip>
src/openvpn/options.c options_postprocess_verify_ce(const struct options *options, const struct connec · line 2426
Quoted 12 lines
src/openvpn/options.c +0
-4@@ -2422,10 +2422,6 @@ options_postprocess_verify_ce(const struct options *options, const struct connec {msg (M_USAGE ,"--stale-routes-check requires --mode server" ); } -if (compat_flag (COMPAT_FLAG_QUERY |COMPAT_NO_NAME_REMAPPING )) - { -msg (M_USAGE ,"--compat-x509-names no-remapping requires --mode server" ); - } }#endif /* P2MP_SERVER */
That's the sole reference to --compat-x509-names in the source code that I found (as of commit 2b15c11).
Best regards,
Jon Bullard
PATCH 1/1 Remove deprecated --compat-x509-names and --no-name-remapping
In reply to Steffan KargerAm 24.10.18 um 12:12 schrieb Steffan Karger:
Quoted 6 lines
As promised, remove these options for OpenVPN 2.5.
If a user still uses these, print an error that the user should update it's configuration. Just printing a warning would cause much more confusing errors, somewhere in middle of a failed connection attempt because the (non-compat) names no longer match the expected names.
The patch does what it says.
Arne
Your patch has been applied to the master branch.
commit c3f565f0590b152c6ea18be230509be8f3c832f0
Author: Steffan Karger Date: Wed Oct 24 12:12:05 2018 +0200
Remove deprecated --compat-x509-names and --no-name-remapping
Signed-off-by: Steffan Karger <[email protected]...>
Acked-by: Arne Schwabe <[email protected]...>
Message-Id: <[email protected]...>
URL: https://www.mail-archive.com/[email protected]/msg17804.html
Signed-off-by: Gert Doering <[email protected]...>--
kind regards,
Gert Doering