Skip to contentSkip to conversation

Choose a different field in X509 to be username

PATCH Applied Emilien Mantel 6 participants 14 messages Jun 17, 2010 – Jun 26, 2010

lore
Share & tools
lore

Emilien Mantel

author
#0 lore raw

PATCH 1/1 Choose a different field in X509 to be username

Hi,

For my company, we use a PKI (linked to a LDAP) with OpenVPN. We can't use "CN" to be username (few people can have the same "CN"). In our case, we only use the UID.

With my patch, you can choose another field to be username with a new option called "x509-username-field", the default value is "CN".

Best regards

Signature · 1 line
Emilien Mantel
options.c +24 -0
index 35f3f13..d2d04e2 100644
@@ -533,6 +533,8 @@ static const char usage_message[] =
   "--key file      : Local private key in .pem format.\n"
   "--pkcs12 file   : PKCS#12 file containing local private key, local certificate\n"
   "                  and optionally the root CA certificate.\n"
+  "--x509-username-field : Field used in x509 certificat to be username.\n"
+  "                        Default is CN.\n"
 #ifdef WIN32
   "--cryptoapicert select-string : Load the certificate and private key from the\n"
   "                  Windows Certificate System Store.\n"

@@ -786,6 +788,7 @@ init_options (struct options *o, const bool init_gc)
   o->renegotiate_seconds = 3600;
   o->handshake_window = 60;
   o->transition_window = 3600;
+  o->x509_username_field = X509_USERNAME_FIELD_DEFAULT;
 #endif
 #endif
 #ifdef ENABLE_PKCS11

@@ -6191,6 +6194,27 @@ add_option (struct options *options,
 	}
       options->key_method = key_method;
     }
+  else if (streq (p[0], "x509-username-field") && p[1])
+    {
+      VERIFY_PERMISSION (OPT_P_GENERAL);
+      /* Uppercase if necessary */
+      {
+	char *s = p[1];
+	int c, flag = 0;
+
+	while ((c = *s) != '\0') 
+          {
+	    if (c >= 'a' && c <= 'z') 
+              {
+                c = c + 'A' - 'a';
+		flag++;
+              }
+            *s = (char) c;
+            s++;
+	  }
+      }
+      options->x509_username_field = p[1];
+    }
 #endif /* USE_SSL */
 #endif /* USE_CRYPTO */
 #ifdef ENABLE_PKCS11
options.h +3 -0
index ccc03df..1a90f86 100644
@@ -526,6 +526,9 @@ struct options
      within n seconds of handshake initiation. */
   int handshake_window;
 
+  /* Field used to be the username in X509 cert. */
+  char *x509_username_field;
+
   /* Old key allowed to live n seconds after new key goes active */
   int transition_window;
ssl.c +17 -12
index b0fb6e4..f6e2410 100644
@@ -734,6 +734,8 @@ get_peer_cert(X509_STORE_CTX *ctx, const char *tmp_dir, struct gc_arena *gc)
   return peercert_filename;
 }
 
+char * x509_username_field; /* GLOBAL */
+
 /*
  * Our verify callback function -- check
  * that an incoming peer certificate is good.

@@ -744,7 +746,7 @@ verify_callback (int preverify_ok, X509_STORE_CTX * ctx)
 {
   char *subject = NULL;
   char envname[64];
-  char common_name[TLS_CN_LEN];
+  char common_name[TLS_USERNAME_LEN];
   SSL *ssl;
   struct tls_session *session;
   const struct tls_options *opt;

@@ -776,18 +778,20 @@ verify_callback (int preverify_ok, X509_STORE_CTX * ctx)
   string_mod_sslname (subject, X509_NAME_CHAR_CLASS, opt->ssl_flags);
   string_replace_leading (subject, '-', '_');
 
-  /* extract the common name */
-  if (!extract_x509_field_ssl (X509_get_subject_name (ctx->current_cert), "CN", common_name, TLS_CN_LEN))
+  /* extract the username (default is CN) */
+  if (!extract_x509_field_ssl (X509_get_subject_name (ctx->current_cert), x509_username_field, common_name, TLS_USERNAME_LEN))
     {
       if (!ctx->error_depth)
-	{
-	  msg (D_TLS_ERRORS, "VERIFY ERROR: could not extract Common Name from X509 subject string ('%s') -- note that the Common Name length is limited to %d characters",
-	       subject,
-	       TLS_CN_LEN);
-	  goto err;
-	}
+        {
+          msg (D_TLS_ERRORS, "VERIFY ERROR: could not extract %s from X509 subject string ('%s') -- note that the username length is limited to %d characters",
+                 x509_username_field,
+                 subject,
+                 TLS_USERNAME_LEN);
+          goto err;
+        }
     }
 
+
   string_mod_sslname (common_name, COMMON_NAME_CHAR_CLASS, opt->ssl_flags);
 
   cert_hash_remember (session, ctx->error_depth, ctx->current_cert->sha1_hash);

@@ -1822,7 +1826,8 @@ init_ssl (const struct options *options)
     }
   else
 #endif
-    SSL_CTX_set_verify (ctx, SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
+  x509_username_field = (char *) options->x509_username_field;
+  SSL_CTX_set_verify (ctx, SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
 			verify_callback);
 
   /* Connection information callback */

@@ -3755,9 +3760,9 @@ key_method_2_read (struct buffer *buf, struct tls_multi *multi, struct tls_sessi
 	s2 = verify_user_pass_script (session, up);
 
       /* check sizing of username if it will become our common name */
-      if ((session->opt->ssl_flags & SSLF_USERNAME_AS_COMMON_NAME) && strlen (up->username) >= TLS_CN_LEN)
+      if ((session->opt->ssl_flags & SSLF_USERNAME_AS_COMMON_NAME) && strlen (up->username) >= TLS_USERNAME_LEN)
 	{
-	  msg (D_TLS_ERRORS, "TLS Auth Error: --username-as-common name specified and username is longer than the maximum permitted Common Name length of %d characters", TLS_CN_LEN);
+	  msg (D_TLS_ERRORS, "TLS Auth Error: --username-as-common name specified and username is longer than the maximum permitted Common Name length of %d characters", TLS_USERNAME_LEN);
 	  s1 = OPENVPN_PLUGIN_FUNC_ERROR;
 	}
ssl.h +5 -2
index 34c6988..02234c3 100644
@@ -278,8 +278,8 @@
  * Buffer sizes (also see mtu.h).
  */
 
-/* Maximum length of common name */
-#define TLS_CN_LEN 64
+/* Maximum length of the username in cert */
+#define TLS_USERNAME_LEN 64
 
 /* Legal characters in an X509 or common name */
 #define X509_NAME_CHAR_CLASS   (CC_ALNUM|CC_UNDERBAR|CC_DASH|CC_DOT|CC_AT|CC_COLON|CC_SLASH|CC_EQUAL)

@@ -288,6 +288,9 @@
 /* Maximum length of OCC options string passed as part of auth handshake */
 #define TLS_OPTIONS_LEN 512
 
+/* Default field in X509 to be username */
+#define X509_USERNAME_FIELD_DEFAULT "CN"
+
 /*
  * Range of key exchange methods
  */
#1 lore raw
Quoted 14 lines

Hi,

For my company, we use a PKI (linked to a LDAP) with OpenVPN. We can't use "CN" to be username (few people can have the same "CN"). In our case, we only use the UID.

With my patch, you can choose another field to be username with a new option called "x509-username-field", the default value is "CN".

Best regards

Signature · 1 line
Emilien Mantel

Hi Emilien,

Thanks for the patch! Could somebody with better C skills take a look and see if it needs modifications?

Signature · 5 lines
Samuli Seppänen
Community Manager
OpenVPN Technologies, Inc

irc freenode net: mattock
#2 lore raw

This is good idea.

In order to upper case toupper() should be used and not manual guessing.

+ else if (streq (p[0], "x509-username-field") && p[1])
+ {

+      VERIFY_PERMISSION (OPT_P_GENERAL);
+      /* Uppercase if necessary */
+      {

+ char *s = p[1];
+ int c, flag = 0;
+
+ while ((c = *s) != '\0')
+ {
+ if (c >= 'a' && c <= 'z')
+ {
+ c = c + 'A' - 'a';
+ flag++;
+ }
+ *s = (char) c;
+ s++;
+ }
+ }
+ options->x509_username_field = p[1];
+ }

2010/6/17 Samuli Seppänen <[email protected]...>:

Quoted 37 lines
Quoted 7 lines

Hi,

For my company, we use a PKI (linked to a LDAP) with OpenVPN. We can't use "CN" to be username (few people can have the same "CN"). In our case, we only use the UID.

Quoted 7 lines

With my patch, you can choose another field to be username with a new option called "x509-username-field", the default value is "CN".

Best regards

--
Emilien Mantel

Hi Emilien,

Thanks for the patch! Could somebody with better C skills take a look and see if it needs modifications?

--
Samuli Seppänen
Community Manager
OpenVPN Technologies, Inc

irc freenode net: mattock

------------------------------------------------------------------------------
ThinkGeek and WIRED's GeekDad team up for the Ultimate GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the lucky parental unit.  See the prize list and enter to win:
http://p.sf.net/sfu/thinkgeek-promo
_______________________________________________
Openvpn-devel mailing list [email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel

author
#3 lore raw

I added toupper() + #include <ctype.h> in options.c

See attached.

--
Emilien Mantel

Quoted 67 lines · Alon Bar-Lev

This is good idea.

In order to upper case toupper() should be used and not manual guessing.

(quoted diff) +21 -0
+  else if (streq (p[0], "x509-username-field")&&  p[1])
+    {
+      VERIFY_PERMISSION (OPT_P_GENERAL);
+      /* Uppercase if necessary */
+      {
+       char *s = p[1];
+       int c, flag = 0;
+
+       while ((c = *s) != '\0')
+          {
+           if (c>= 'a'&&  c<= 'z')
+              {
+                c = c + 'A' - 'a';
+               flag++;
+              }
+            *s = (char) c;
+            s++;
+         }
+      }
+      options->x509_username_field = p[1];
+    }

2010/6/17 Samuli Seppänen<[email protected]...>:

Quoted 28 lines
Quoted 7 lines

Hi,

For my company, we use a PKI (linked to a LDAP) with OpenVPN. We can't use "CN" to be username (few people can have the same "CN"). In our case, we only use the UID.

Quoted 8 lines

With my patch, you can choose another field to be username with a new option called "x509-username-field", the default value is "CN".

Best regards

--
Emilien Mantel

Hi Emilien,

Thanks for the patch! Could somebody with better C skills take a look and see if it needs modifications?

--
Samuli Seppänen
Community Manager
OpenVPN Technologies, Inc

irc freenode net: mattock

Quoted 11 lines

------------------------------------------------------------------------------
ThinkGeek and WIRED's GeekDad team up for the Ultimate GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the lucky parental unit. See the prize list and enter to win:
http://p.sf.net/sfu/thinkgeek-promo
_______________________________________________
Openvpn-devel mailing list [email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel

Quoted 10 lines

------------------------------------------------------------------------------
ThinkGeek and WIRED's GeekDad team up for the Ultimate GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the lucky parental unit. See the prize list and enter to win:
http://p.sf.net/sfu/thinkgeek-promo
_______________________________________________
Openvpn-devel mailing list [email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel

options.c +20 -0
index 35f3f13..f39e6a2 100644
@@ -49,6 +49,7 @@
 #include "helper.h"
 #include "manage.h"
 #include "configure.h"
+#include <ctype.h>
 
 #include "memdbg.h"
 

@@ -533,6 +534,8 @@ static const char usage_message[] =
   "--key file      : Local private key in .pem format.\n"
   "--pkcs12 file   : PKCS#12 file containing local private key, local certificate\n"
   "                  and optionally the root CA certificate.\n"
+  "--x509-username-field : Field used in x509 certificat to be username.\n"
+  "                        Default is CN.\n"
 #ifdef WIN32
   "--cryptoapicert select-string : Load the certificate and private key from the\n"
   "                  Windows Certificate System Store.\n"

@@ -786,6 +789,7 @@ init_options (struct options *o, const bool init_gc)
   o->renegotiate_seconds = 3600;
   o->handshake_window = 60;
   o->transition_window = 3600;
+  o->x509_username_field = X509_USERNAME_FIELD_DEFAULT;
 #endif
 #endif
 #ifdef ENABLE_PKCS11

@@ -6191,6 +6195,22 @@ add_option (struct options *options,
 	}
       options->key_method = key_method;
     }
+  else if (streq (p[0], "x509-username-field") && p[1])
+    {
+      VERIFY_PERMISSION (OPT_P_GENERAL);
+      /* Uppercase if necessary */ 
+        {
+	  char *s = p[1];
+	  int c;
+
+	  while ((c = *s) != '\0') 
+            {
+              *s = (char) toupper(c);
+              s++;
+	    }
+        }     
+      options->x509_username_field = p[1];
+    }
 #endif /* USE_SSL */
 #endif /* USE_CRYPTO */
 #ifdef ENABLE_PKCS11
options.h +3 -0
index ccc03df..1a90f86 100644
@@ -526,6 +526,9 @@ struct options
      within n seconds of handshake initiation. */
   int handshake_window;
 
+  /* Field used to be the username in X509 cert. */
+  char *x509_username_field;
+
   /* Old key allowed to live n seconds after new key goes active */
   int transition_window;
ssl.c +17 -12
index b0fb6e4..f6e2410 100644
@@ -734,6 +734,8 @@ get_peer_cert(X509_STORE_CTX *ctx, const char *tmp_dir, struct gc_arena *gc)
   return peercert_filename;
 }
 
+char * x509_username_field; /* GLOBAL */
+
 /*
  * Our verify callback function -- check
  * that an incoming peer certificate is good.

@@ -744,7 +746,7 @@ verify_callback (int preverify_ok, X509_STORE_CTX * ctx)
 {
   char *subject = NULL;
   char envname[64];
-  char common_name[TLS_CN_LEN];
+  char common_name[TLS_USERNAME_LEN];
   SSL *ssl;
   struct tls_session *session;
   const struct tls_options *opt;

@@ -776,18 +778,20 @@ verify_callback (int preverify_ok, X509_STORE_CTX * ctx)
   string_mod_sslname (subject, X509_NAME_CHAR_CLASS, opt->ssl_flags);
   string_replace_leading (subject, '-', '_');
 
-  /* extract the common name */
-  if (!extract_x509_field_ssl (X509_get_subject_name (ctx->current_cert), "CN", common_name, TLS_CN_LEN))
+  /* extract the username (default is CN) */
+  if (!extract_x509_field_ssl (X509_get_subject_name (ctx->current_cert), x509_username_field, common_name, TLS_USERNAME_LEN))
     {
       if (!ctx->error_depth)
-	{
-	  msg (D_TLS_ERRORS, "VERIFY ERROR: could not extract Common Name from X509 subject string ('%s') -- note that the Common Name length is limited to %d characters",
-	       subject,
-	       TLS_CN_LEN);
-	  goto err;
-	}
+        {
+          msg (D_TLS_ERRORS, "VERIFY ERROR: could not extract %s from X509 subject string ('%s') -- note that the username length is limited to %d characters",
+                 x509_username_field,
+                 subject,
+                 TLS_USERNAME_LEN);
+          goto err;
+        }
     }
 
+
   string_mod_sslname (common_name, COMMON_NAME_CHAR_CLASS, opt->ssl_flags);
 
   cert_hash_remember (session, ctx->error_depth, ctx->current_cert->sha1_hash);

@@ -1822,7 +1826,8 @@ init_ssl (const struct options *options)
     }
   else
 #endif
-    SSL_CTX_set_verify (ctx, SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
+  x509_username_field = (char *) options->x509_username_field;
+  SSL_CTX_set_verify (ctx, SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
 			verify_callback);
 
   /* Connection information callback */

@@ -3755,9 +3760,9 @@ key_method_2_read (struct buffer *buf, struct tls_multi *multi, struct tls_sessi
 	s2 = verify_user_pass_script (session, up);
 
       /* check sizing of username if it will become our common name */
-      if ((session->opt->ssl_flags & SSLF_USERNAME_AS_COMMON_NAME) && strlen (up->username) >= TLS_CN_LEN)
+      if ((session->opt->ssl_flags & SSLF_USERNAME_AS_COMMON_NAME) && strlen (up->username) >= TLS_USERNAME_LEN)
 	{
-	  msg (D_TLS_ERRORS, "TLS Auth Error: --username-as-common name specified and username is longer than the maximum permitted Common Name length of %d characters", TLS_CN_LEN);
+	  msg (D_TLS_ERRORS, "TLS Auth Error: --username-as-common name specified and username is longer than the maximum permitted Common Name length of %d characters", TLS_USERNAME_LEN);
 	  s1 = OPENVPN_PLUGIN_FUNC_ERROR;
 	}
ssl.h +5 -2
index 34c6988..02234c3 100644
@@ -278,8 +278,8 @@
  * Buffer sizes (also see mtu.h).
  */
 
-/* Maximum length of common name */
-#define TLS_CN_LEN 64
+/* Maximum length of the username in cert */
+#define TLS_USERNAME_LEN 64
 
 /* Legal characters in an X509 or common name */
 #define X509_NAME_CHAR_CLASS   (CC_ALNUM|CC_UNDERBAR|CC_DASH|CC_DOT|CC_AT|CC_COLON|CC_SLASH|CC_EQUAL)

@@ -288,6 +288,9 @@
 /* Maximum length of OCC options string passed as part of auth handshake */
 #define TLS_OPTIONS_LEN 512
 
+/* Default field in X509 to be username */
+#define X509_USERNAME_FIELD_DEFAULT "CN"
+
 /*
  * Range of key exchange methods
  */
#4 lore raw

Great.

Few more:

1. To upper:
char *s = p[1];
while ((*s = toupper(*s)) != '\0') s++;
2. Remove compound {} at this place, move the char *s before the VERIFY_PERMISSION.
3. I think:
"""
extract_x509_field_ssl (X509_get_subject_name (ctx->current_cert), x509_username_field, common_name, TLS_USERNAME_LEN)
"""
TLS_USERNAME_LEN -> sizeof(common_name)
4. Maybe rename common_name -> x509_field or something to make it clearer that it isn't actually common_name.

Thanks.

Quoted 105 lines · Emilien Mantel

I added toupper() + #include <ctype.h> in options.c

See attached.

--
Emilien Mantel

Quoted 74 lines · Alon Bar-Lev

This is good idea.

In order to upper case toupper() should be used and not manual guessing.

+  else if (streq (p[0], "x509-username-field")&&  p[1])
+    {
+      VERIFY_PERMISSION (OPT_P_GENERAL);
+      /* Uppercase if necessary */
+      {
+       char *s = p[1];
+       int c, flag = 0;
+
+       while ((c = *s) != '\0')
+          {
+           if (c>= 'a'&&  c<= 'z')
+              {
+                c = c + 'A' - 'a';
+               flag++;
+              }
+            *s = (char) c;
+            s++;
+         }
+      }
+      options->x509_username_field = p[1];
+    }

2010/6/17 Samuli Seppänen<[email protected]...>:

Quoted 32 lines
Quoted 9 lines

Hi,

For my company, we use a PKI (linked to a LDAP) with OpenVPN. We can't use "CN" to be username (few people can have the same "CN"). In our case, we only use the UID.

Quoted 8 lines

With my patch, you can choose another field to be username with a new option called "x509-username-field", the default value is "CN".

Best regards

--
Emilien Mantel

Hi Emilien,

Thanks for the patch! Could somebody with better C skills take a look and see if it needs modifications?

--
Samuli Seppänen
Community Manager
OpenVPN Technologies, Inc

irc freenode net: mattock

Quoted 11 lines

------------------------------------------------------------------------------
ThinkGeek and WIRED's GeekDad team up for the Ultimate GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the lucky parental unit.  See the prize list and enter to win:
http://p.sf.net/sfu/thinkgeek-promo
_______________________________________________
Openvpn-devel mailing list [email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel

Quoted 10 lines

------------------------------------------------------------------------------
ThinkGeek and WIRED's GeekDad team up for the Ultimate GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the lucky parental unit.  See the prize list and enter to win:
http://p.sf.net/sfu/thinkgeek-promo
_______________________________________________
Openvpn-devel mailing list [email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel

------------------------------------------------------------------------------
ThinkGeek and WIRED's GeekDad team up for the Ultimate GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the lucky parental unit.  See the prize list and enter to win:
http://p.sf.net/sfu/thinkgeek-promo
_______________________________________________
Openvpn-devel mailing list [email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel

author
#5 lore raw

1) Done

2) Done

3) "sizeof(common_name)" is useless... Line 745: char common_name[TLS_USERNAME_LEN]; we can use directly TLS_USERNAME_LEN.

4)
I note "common_name" is used everwhere in OpenVPN code... I can rename it with a big sed :) But substitute all "common_name" is very heavy :

[email protected]...:~/dev/openvpn-testing$ grep -i common_name * | wc -l
165
Are you sure it's a good idea? If I do that, are you agree to rename it "username"?

--
Emilien Mantel

Quoted 18 lines · Alon Bar-Lev

Great.

Few more:

1. To upper:
char *s = p[1];
while ((*s = toupper(*s)) != '\0') s++;
2. Remove compound {} at this place, move the char *s before the VERIFY_PERMISSION.
3. I think:
"""
extract_x509_field_ssl (X509_get_subject_name (ctx->current_cert), x509_username_field, common_name, TLS_USERNAME_LEN)
"""
TLS_USERNAME_LEN -> sizeof(common_name)
4. Maybe rename common_name -> x509_field or something to make it clearer that it isn't actually common_name.

Quoted 111 lines

Thanks.

Quoted 106 lines · Emilien Mantel

I added toupper() + #include<ctype.h> in options.c

See attached.

--
Emilien Mantel

Quoted 73 lines · Alon Bar-Lev

This is good idea.

In order to upper case toupper() should be used and not manual guessing.

(quoted diff) +21 -0
+  else if (streq (p[0], "x509-username-field")&&    p[1])
+    {
+      VERIFY_PERMISSION (OPT_P_GENERAL);
+      /* Uppercase if necessary */
+      {
+       char *s = p[1];
+       int c, flag = 0;
+
+       while ((c = *s) != '\0')
+          {
+           if (c>= 'a'&&    c<= 'z')
+              {
+                c = c + 'A' - 'a';
+               flag++;
+              }
+            *s = (char) c;
+            s++;
+         }
+      }
+      options->x509_username_field = p[1];
+    }

2010/6/17 Samuli Seppänen<[email protected]...>:

Quoted 31 lines
Quoted 8 lines

Hi,

For my company, we use a PKI (linked to a LDAP) with OpenVPN. We can't use "CN" to be username (few people can have the same "CN"). In our case, we only use the UID.

Quoted 9 lines

With my patch, you can choose another field to be username with a new option called "x509-username-field", the default value is "CN".

Best regards

--
Emilien Mantel

Hi Emilien,

Thanks for the patch! Could somebody with better C skills take a look and see if it needs modifications?

--
Samuli Seppänen
Community Manager
OpenVPN Technologies, Inc

irc freenode net: mattock

Quoted 12 lines

------------------------------------------------------------------------------
ThinkGeek and WIRED's GeekDad team up for the Ultimate GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the lucky parental unit. See the prize list and enter to win:
http://p.sf.net/sfu/thinkgeek-promo
_______________________________________________
Openvpn-devel mailing list [email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel

Quoted 11 lines

------------------------------------------------------------------------------
ThinkGeek and WIRED's GeekDad team up for the Ultimate GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the lucky parental unit. See the prize list and enter to win:
http://p.sf.net/sfu/thinkgeek-promo
_______________________________________________
Openvpn-devel mailing list [email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel

------------------------------------------------------------------------------
ThinkGeek and WIRED's GeekDad team up for the Ultimate GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the lucky parental unit. See the prize list and enter to win:
http://p.sf.net/sfu/thinkgeek-promo
_______________________________________________
Openvpn-devel mailing list [email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel

options.c +11 -0
index 35f3f13..a078372 100644
@@ -49,6 +49,7 @@
 #include "helper.h"
 #include "manage.h"
 #include "configure.h"
+#include <ctype.h>
 
 #include "memdbg.h"
 

@@ -533,6 +534,8 @@ static const char usage_message[] =
   "--key file      : Local private key in .pem format.\n"
   "--pkcs12 file   : PKCS#12 file containing local private key, local certificate\n"
   "                  and optionally the root CA certificate.\n"
+  "--x509-username-field : Field used in x509 certificat to be username.\n"
+  "                        Default is CN.\n"
 #ifdef WIN32
   "--cryptoapicert select-string : Load the certificate and private key from the\n"
   "                  Windows Certificate System Store.\n"

@@ -786,6 +789,7 @@ init_options (struct options *o, const bool init_gc)
   o->renegotiate_seconds = 3600;
   o->handshake_window = 60;
   o->transition_window = 3600;
+  o->x509_username_field = X509_USERNAME_FIELD_DEFAULT;
 #endif
 #endif
 #ifdef ENABLE_PKCS11

@@ -6191,6 +6195,13 @@ add_option (struct options *options,
 	}
       options->key_method = key_method;
     }
+  else if (streq (p[0], "x509-username-field") && p[1])
+    {
+      char *s = p[1];
+      VERIFY_PERMISSION (OPT_P_GENERAL);
+      while ((*s = toupper(*s)) != '\0') s++; /* Uppercase if necessary */
+      options->x509_username_field = p[1];
+    }
 #endif /* USE_SSL */
 #endif /* USE_CRYPTO */
 #ifdef ENABLE_PKCS11
options.h +3 -0
index ccc03df..1a90f86 100644
@@ -526,6 +526,9 @@ struct options
      within n seconds of handshake initiation. */
   int handshake_window;
 
+  /* Field used to be the username in X509 cert. */
+  char *x509_username_field;
+
   /* Old key allowed to live n seconds after new key goes active */
   int transition_window;
ssl.c +17 -12
index b0fb6e4..f6e2410 100644
@@ -734,6 +734,8 @@ get_peer_cert(X509_STORE_CTX *ctx, const char *tmp_dir, struct gc_arena *gc)
   return peercert_filename;
 }
 
+char * x509_username_field; /* GLOBAL */
+
 /*
  * Our verify callback function -- check
  * that an incoming peer certificate is good.

@@ -744,7 +746,7 @@ verify_callback (int preverify_ok, X509_STORE_CTX * ctx)
 {
   char *subject = NULL;
   char envname[64];
-  char common_name[TLS_CN_LEN];
+  char common_name[TLS_USERNAME_LEN];
   SSL *ssl;
   struct tls_session *session;
   const struct tls_options *opt;

@@ -776,18 +778,20 @@ verify_callback (int preverify_ok, X509_STORE_CTX * ctx)
   string_mod_sslname (subject, X509_NAME_CHAR_CLASS, opt->ssl_flags);
   string_replace_leading (subject, '-', '_');
 
-  /* extract the common name */
-  if (!extract_x509_field_ssl (X509_get_subject_name (ctx->current_cert), "CN", common_name, TLS_CN_LEN))
+  /* extract the username (default is CN) */
+  if (!extract_x509_field_ssl (X509_get_subject_name (ctx->current_cert), x509_username_field, common_name, TLS_USERNAME_LEN))
     {
       if (!ctx->error_depth)
-	{
-	  msg (D_TLS_ERRORS, "VERIFY ERROR: could not extract Common Name from X509 subject string ('%s') -- note that the Common Name length is limited to %d characters",
-	       subject,
-	       TLS_CN_LEN);
-	  goto err;
-	}
+        {
+          msg (D_TLS_ERRORS, "VERIFY ERROR: could not extract %s from X509 subject string ('%s') -- note that the username length is limited to %d characters",
+                 x509_username_field,
+                 subject,
+                 TLS_USERNAME_LEN);
+          goto err;
+        }
     }
 
+
   string_mod_sslname (common_name, COMMON_NAME_CHAR_CLASS, opt->ssl_flags);
 
   cert_hash_remember (session, ctx->error_depth, ctx->current_cert->sha1_hash);

@@ -1822,7 +1826,8 @@ init_ssl (const struct options *options)
     }
   else
 #endif
-    SSL_CTX_set_verify (ctx, SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
+  x509_username_field = (char *) options->x509_username_field;
+  SSL_CTX_set_verify (ctx, SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
 			verify_callback);
 
   /* Connection information callback */

@@ -3755,9 +3760,9 @@ key_method_2_read (struct buffer *buf, struct tls_multi *multi, struct tls_sessi
 	s2 = verify_user_pass_script (session, up);
 
       /* check sizing of username if it will become our common name */
-      if ((session->opt->ssl_flags & SSLF_USERNAME_AS_COMMON_NAME) && strlen (up->username) >= TLS_CN_LEN)
+      if ((session->opt->ssl_flags & SSLF_USERNAME_AS_COMMON_NAME) && strlen (up->username) >= TLS_USERNAME_LEN)
 	{
-	  msg (D_TLS_ERRORS, "TLS Auth Error: --username-as-common name specified and username is longer than the maximum permitted Common Name length of %d characters", TLS_CN_LEN);
+	  msg (D_TLS_ERRORS, "TLS Auth Error: --username-as-common name specified and username is longer than the maximum permitted Common Name length of %d characters", TLS_USERNAME_LEN);
 	  s1 = OPENVPN_PLUGIN_FUNC_ERROR;
 	}
ssl.h +5 -2
index 34c6988..02234c3 100644
@@ -278,8 +278,8 @@
  * Buffer sizes (also see mtu.h).
  */
 
-/* Maximum length of common name */
-#define TLS_CN_LEN 64
+/* Maximum length of the username in cert */
+#define TLS_USERNAME_LEN 64
 
 /* Legal characters in an X509 or common name */
 #define X509_NAME_CHAR_CLASS   (CC_ALNUM|CC_UNDERBAR|CC_DASH|CC_DOT|CC_AT|CC_COLON|CC_SLASH|CC_EQUAL)

@@ -288,6 +288,9 @@
 /* Maximum length of OCC options string passed as part of auth handshake */
 #define TLS_OPTIONS_LEN 512
 
+/* Default field in X509 to be username */
+#define X509_USERNAME_FIELD_DEFAULT "CN"
+
 /*
  * Range of key exchange methods
  */
#6 lore raw
Quoted 6 lines · Emilien Mantel

1) Done

2) Done

3) "sizeof(common_name)" is useless... Line 745: char common_name[TLS_USERNAME_LEN]; we can use directly TLS_USERNAME_LEN.

Usually sizeof(XXX) should be used so if XXX is modified there is no overrun (Single point of change).

Quoted 9 lines

4)
I note "common_name" is used everwhere in OpenVPN code... I can rename it with a big sed :)
But substitute all "common_name" is very heavy :

[email protected]...:~/dev/openvpn-testing$ grep -i common_name * | wc -l
165
Are you sure it's a good idea? If I do that, are you agree to rename it
"username"?

Oh... this is not for me to decide, I of course think it should be done... Maybe as separate patch... it is very confusing to leave it this way...

Quoted 144 lines

--
Emilien Mantel

Quoted 137 lines · Alon Bar-Lev

Great.

Few more:

1. To upper:
char *s = p[1];
while ((*s = toupper(*s)) != '\0') s++;
2. Remove compound {} at this place, move the char *s before the VERIFY_PERMISSION.
3. I think:
"""
extract_x509_field_ssl (X509_get_subject_name (ctx->current_cert), x509_username_field, common_name, TLS_USERNAME_LEN)
"""
TLS_USERNAME_LEN ->  sizeof(common_name)
4. Maybe rename common_name ->  x509_field or something to make it clearer that it isn't actually common_name.

Thanks.

Quoted 113 lines · Emilien Mantel

I added toupper() + #include<ctype.h>  in options.c

See attached.

--
Emilien Mantel

Quoted 78 lines · Alon Bar-Lev

This is good idea.

In order to upper case toupper() should be used and not manual guessing.

+  else if (streq (p[0], "x509-username-field")&&    p[1])
+    {
+      VERIFY_PERMISSION (OPT_P_GENERAL);
+      /* Uppercase if necessary */
+      {
+       char *s = p[1];
+       int c, flag = 0;
+
+       while ((c = *s) != '\0')
+          {
+           if (c>= 'a'&&    c<= 'z')
+              {
+                c = c + 'A' - 'a';
+               flag++;
+              }
+            *s = (char) c;
+            s++;
+         }
+      }
+      options->x509_username_field = p[1];
+    }

2010/6/17 Samuli Seppänen<[email protected]...>:

Quoted 34 lines
Quoted 9 lines

Hi,

For my company, we use a PKI (linked to a LDAP) with OpenVPN. We can't use "CN" to be username (few people can have the same "CN"). In our case, we only use the UID.

Quoted 9 lines

With my patch, you can choose another field to be username with a new option called "x509-username-field", the default value is "CN".

Best regards

--
Emilien Mantel

Hi Emilien,

Thanks for the patch! Could somebody with better C skills take a look and see if it needs modifications?

--
Samuli Seppänen
Community Manager
OpenVPN Technologies, Inc

irc freenode net: mattock

Quoted 12 lines

------------------------------------------------------------------------------
ThinkGeek and WIRED's GeekDad team up for the Ultimate GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the lucky parental unit.  See the prize list and enter to win:
http://p.sf.net/sfu/thinkgeek-promo
_______________________________________________
Openvpn-devel mailing list [email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel

Quoted 11 lines

------------------------------------------------------------------------------
ThinkGeek and WIRED's GeekDad team up for the Ultimate GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the lucky parental unit.  See the prize list and enter to win:
http://p.sf.net/sfu/thinkgeek-promo
_______________________________________________
Openvpn-devel mailing list [email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel

------------------------------------------------------------------------------
ThinkGeek and WIRED's GeekDad team up for the Ultimate GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the lucky parental unit.  See the prize list and enter to win:
http://p.sf.net/sfu/thinkgeek-promo
_______________________________________________
Openvpn-devel mailing list [email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel

author
#7 lore raw
Quoted 5 lines · Alon Bar-Lev
Quoted 2 lines · Emilien Mantel

1) Done

Quoted 9 lines
Quoted 5 lines

2) Done

3) "sizeof(common_name)" is useless... Line 745: char common_name[TLS_USERNAME_LEN]; we can use directly TLS_USERNAME_LEN.

Usually sizeof(XXX) should be used so if XXX is modified there is no overrun (Single point of change).

TLS_USERNAME_LEN is never modified (#define in ssl.h)... I can add sizeof, but I don't think it's very useful. In git repository/stable version, TLS_CN_LEN is used. I just renamed it.

Quoted 9 lines
Quoted 9 lines

4)
I note "common_name" is used everwhere in OpenVPN code... I can rename it with a big sed :)
But substitute all "common_name" is very heavy :

[email protected]...:~/dev/openvpn-testing$ grep -i common_name * | wc -l
165
Are you sure it's a good idea? If I do that, are you agree to rename it
"username"?
Quoted 4 lines

Oh... this is not for me to decide, I of course think it should be done... Maybe as separate patch... it is very confusing to leave it this way...

I think a separate patch is not a good idea. Renaming all occurences of "common_name" is only useful in the context of my patch. I'd rather wait a little to gather more ideas about this.

Quoted 145 lines
Quoted 145 lines

--
Emilien Mantel

Quoted 137 lines · Alon Bar-Lev

Great.

Few more:

1. To upper:
char *s = p[1];
while ((*s = toupper(*s)) != '\0') s++;
2. Remove compound {} at this place, move the char *s before the VERIFY_PERMISSION.
3. I think:
"""
extract_x509_field_ssl (X509_get_subject_name (ctx->current_cert), x509_username_field, common_name, TLS_USERNAME_LEN)
"""
TLS_USERNAME_LEN -> sizeof(common_name)
4. Maybe rename common_name -> x509_field or something to make it
clearer that it isn't actually common_name.

Thanks.

Quoted 113 lines · Emilien Mantel

I added toupper() + #include<ctype.h> in options.c

See attached.

--
Emilien Mantel

Quoted 77 lines · Alon Bar-Lev

This is good idea.

In order to upper case toupper() should be used and not manual guessing.

(quoted diff) +21 -0
+  else if (streq (p[0], "x509-username-field")&&      p[1])
+    {
+      VERIFY_PERMISSION (OPT_P_GENERAL);
+      /* Uppercase if necessary */
+      {
+       char *s = p[1];
+       int c, flag = 0;
+
+       while ((c = *s) != '\0')
+          {
+           if (c>= 'a'&&      c<= 'z')
+              {
+                c = c + 'A' - 'a';
+               flag++;
+              }
+            *s = (char) c;
+            s++;
+         }
+      }
+      options->x509_username_field = p[1];
+    }

2010/6/17 Samuli Seppänen<[email protected]...>:

Quoted 33 lines
Quoted 8 lines

Hi,

For my company, we use a PKI (linked to a LDAP) with OpenVPN. We can't use "CN" to be username (few people can have the same "CN"). In our case, we only use the UID.

Quoted 10 lines

With my patch, you can choose another field to be username with a new option called "x509-username-field", the default value is "CN".

Best regards

--
Emilien Mantel

Hi Emilien,

Thanks for the patch! Could somebody with better C skills take a look and see if it needs modifications?

--
Samuli Seppänen
Community Manager
OpenVPN Technologies, Inc

irc freenode net: mattock

Quoted 13 lines

------------------------------------------------------------------------------
ThinkGeek and WIRED's GeekDad team up for the Ultimate GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the lucky parental unit. See the prize list and enter to win:
http://p.sf.net/sfu/thinkgeek-promo
_______________________________________________
Openvpn-devel mailing list [email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel

Quoted 12 lines

------------------------------------------------------------------------------
ThinkGeek and WIRED's GeekDad team up for the Ultimate GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the lucky parental unit. See the prize list and enter to win:
http://p.sf.net/sfu/thinkgeek-promo
_______________________________________________
Openvpn-devel mailing list [email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel

------------------------------------------------------------------------------
ThinkGeek and WIRED's GeekDad team up for the Ultimate GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the lucky parental unit. See the prize list and enter to win:
http://p.sf.net/sfu/thinkgeek-promo
_______________________________________________
Openvpn-devel mailing list [email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel

Acked-by
#8 lore raw
In reply to Emilien Mantel

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 6 lines · Emilien Mantel

1) Done

2) Done

3) "sizeof(common_name)" is useless... Line 745: char common_name[TLS_USERNAME_LEN]; we can use directly TLS_USERNAME_LEN.

Thanks a lot for the patch and all rework done. (Also: thank you to all reviewers!)

The third and last patch looks very good! I've applied it to the feat_misc branch and merged it into allmerged.

commit 935c62be9c0c8a256112df818bfb8470586a23b6

Author: Emilien Mantel <[email protected]...>
Date:   Thu Jun 17 21:38:59 2010 +0200

Choose a different field in X509 to be username

For my company, we use a PKI (linked to a LDAP) with OpenVPN. We can't use "CN" to be username (few people can have the same "CN"). In our case, we only use the UID.

With my patch, you can choose another field to be username with a new option called --x509-username-field, the default value is "CN".

Signed-off-by Emilien Mantel <[email protected]...>
Acked-by David Sommerseth <[email protected]...>
Signed-off-by David Sommerseth <[email protected]...>
Quoted 8 lines

4)
I note "common_name" is used everwhere in OpenVPN code... I can rename it with a big sed :)
But substitute all "common_name" is very heavy :

[email protected]...:~/dev/openvpn-testing$ grep -i common_name * | wc -l
165
Are you sure it's a good idea? If I do that, are you agree to rename it
"username"?

In regards to this one. It is a good idea to rename the common_name to something else. I am not sure if it is clearer to rename it to username. I lean more towards Alon's suggestion, x509_field - as it tells you where this information comes from. On the other hand '_field' is a bit vague, to what this information can be used for. So I'd probably suggest something like: x509_clientid or x509_clientref ... maybe there are some better suggestions?

Anyhow, this change should be a separate patch. This is to make it eaiser to pin point which change (commit) causes troubles later on, if that happens. That way, smaller commits helps narrowing down the problem better later on, when we've all forgotten which changes we've done and why.

kind regards,

David Sommerseth

Quoted 81 lines · Alon Bar-Lev
Quoted 80 lines

Great.

Few more:

1. To upper:
char *s = p[1];
while ((*s = toupper(*s)) != '\0') s++;
2. Remove compound {} at this place, move the char *s before the VERIFY_PERMISSION.
3. I think:
"""
extract_x509_field_ssl (X509_get_subject_name (ctx->current_cert), x509_username_field, common_name, TLS_USERNAME_LEN)
"""
TLS_USERNAME_LEN -> sizeof(common_name)
4. Maybe rename common_name -> x509_field or something to make it clearer that it isn't actually common_name.

Thanks.

Quoted 57 lines · Emilien Mantel

I added toupper() + #include<ctype.h> in options.c

See attached.

Signature · 1 line
Emilien Mantel
Quoted 48 lines · Alon Bar-Lev

This is good idea.

In order to upper case toupper() should be used and not manual guessing.

(quoted diff) +21 -0
+  else if (streq (p[0], "x509-username-field")&&    p[1])
+    {
+      VERIFY_PERMISSION (OPT_P_GENERAL);
+      /* Uppercase if necessary */
+      {
+       char *s = p[1];
+       int c, flag = 0;
+
+       while ((c = *s) != '\0')
+          {
+           if (c>= 'a'&&    c<= 'z')
+              {
+                c = c + 'A' - 'a';
+               flag++;
+              }
+            *s = (char) c;
+            s++;
+         }
+      }
+      options->x509_username_field = p[1];
+    }

2010/6/17 Samuli Seppänen<[email protected]...>:

Quoted 18 lines
Quoted 18 lines

Hi,

For my company, we use a PKI (linked to a LDAP) with OpenVPN. We can't
use "CN" to be username (few people can have the same "CN"). In our case, we only use the UID.

With my patch, you can choose another field to be username with a new option called "x509-username-field", the default value is "CN".

Best regards

Signature · 1 line
Emilien Mantel
Quoted 7 lines
Quoted 7 lines
Quoted 7 lines
Quoted 7 lines
Quoted 7 lines

Hi Emilien,

Thanks for the patch! Could somebody with better C skills take a look and see if it needs modifications?

Signature · 1 line
Samuli Seppänen

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkwafiYACgkQDC186MBRfrq3+QCgp9Si+E8oJmjiyrHnNJhQg1tm zJkAn1G42OuH1bZ/wtQaiET+mnNI4LHJ
=hHj0
-----END PGP SIGNATURE-----

#9 lore raw
Quoted 8 lines · David Sommerseth
Quoted 2 lines

3) "sizeof(common_name)" is useless... Line 745: char common_name[TLS_USERNAME_LEN]; we can use directly TLS_USERNAME_LEN.

Thanks a lot for the patch and all rework done. (Also: thank you to all reviewers!)

The third and last patch looks very good! I've applied it to the feat_misc branch and merged it into allmerged.

I strongly agree with Alon about sizeof() rather than a second reference to the same define. It is the defensive way.

//Peter

#10 lore raw

Hi,

Quoted 4 lines · Peter Stuge
Quoted 3 lines · David Sommerseth
Quoted 2 lines

3) "sizeof(common_name)" is useless... Line 745: char common_name[TLS_USERNAME_LEN]; we can use directly TLS_USERNAME_LEN.

Quoted 8 lines
Quoted 5 lines

Thanks a lot for the patch and all rework done. (Also: thank you to all reviewers!)

The third and last patch looks very good! I've applied it to the feat_misc branch and merged it into allmerged.

I strongly agree with Alon about sizeof() rather than a second reference to the same define. It is the defensive way.

I'm a bit late, but I also want to second this :-)

That way, if the definition of "common_name" is ever changed to a different size, e.g "TLS_USERNAME_LEN+3" or whatever, all(!) references automatically get the correct size. Defensive coding, less surprises later on.

gert

Signature · 4 lines
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             [email protected]...
fax: +49-89-35655025                        [email protected]...
author
#11 lore raw
In reply to Peter Stuge

Hi,

See attached a very small patch (based on allmerged tree) to fix "sizeof".

Regards,

--
Emilien Mantel

Quoted 17 lines · Peter Stuge
Quoted 9 lines · David Sommerseth
Quoted 3 lines

3) "sizeof(common_name)" is useless... Line 745: char common_name[TLS_USERNAME_LEN]; we can use directly TLS_USERNAME_LEN.

Thanks a lot for the patch and all rework done. (Also: thank you to all reviewers!)

The third and last patch looks very good! I've applied it to the feat_misc branch and merged it into allmerged.

I strongly agree with Alon about sizeof() rather than a second reference to the same define. It is the defensive way.

//Peter

Quoted 10 lines

------------------------------------------------------------------------------
ThinkGeek and WIRED's GeekDad team up for the Ultimate GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the lucky parental unit. See the prize list and enter to win:
http://p.sf.net/sfu/thinkgeek-promo
_______________________________________________
Openvpn-devel mailing list [email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel

ssl.c +1 -1
index f6e2410..8c7a5ee 100644
@@ -779,7 +779,7 @@ verify_callback (int preverify_ok, X509_STORE_CTX * ctx)
   string_replace_leading (subject, '-', '_');
 
   /* extract the username (default is CN) */
-  if (!extract_x509_field_ssl (X509_get_subject_name (ctx->current_cert), x509_username_field, common_name, TLS_USERNAME_LEN))
+  if (!extract_x509_field_ssl (X509_get_subject_name (ctx->current_cert), x509_username_field, common_name, sizeof(common_name)))
     {
       if (!ctx->error_depth)
         {
Acked-by Peter Stuge Applied
#13 lore raw
In reply to Emilien Mantel

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 3 lines · Emilien Mantel

Hi,

See attached a very small patch (based on allmerged tree) to fix "sizeof".

Thanks a lot!

commit 031d18fcb8a2a552aecabb41f1afdfe3f51bdd58

Author: Emilien Mantel <[email protected]...>
Date:   Sat Jun 26 13:56:48 2010 +0200

Fixed static defined length check to use sizeof()

This comes in addition to commit 935c62be9c0c8a256112d after some additional review comments.

Signed-off-by Emilien Mantel <[email protected]...>
Acked-by Peter Stuge <[email protected]...>
Signed-off-by David Sommerseth <[email protected]...>

Applied to feat_misc and merged into allmerged.

kind regards,

David Sommerseth

Quoted 40 lines · Peter Stuge
Quoted 19 lines
Quoted 9 lines · David Sommerseth
Quoted 3 lines

3) "sizeof(common_name)" is useless... Line 745: char common_name[TLS_USERNAME_LEN]; we can use directly TLS_USERNAME_LEN.

Thanks a lot for the patch and all rework done. (Also: thank you to all reviewers!)

The third and last patch looks very good! I've applied it to the feat_misc branch and merged it into allmerged.

I strongly agree with Alon about sizeof() rather than a second reference to the same define. It is the defensive way.

//Peter

------------------------------------------------------------------------------

Quoted 9 lines

ThinkGeek and WIRED's GeekDad team up for the Ultimate GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the lucky parental unit. See the prize list and enter to win:
http://p.sf.net/sfu/thinkgeek-promo
_______________________________________________
Openvpn-devel mailing list [email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel

------------------------------------------------------------------------------
ThinkGeek and WIRED's GeekDad team up for the Ultimate GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the lucky parental unit. See the prize list and enter to win:
http://p.sf.net/sfu/thinkgeek-promo

Quoted 4 lines

_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkwl7G4ACgkQDC186MBRfroyaACfVDmQ4OI9lQ5JgcWGWyqeWbVu Ev4An3kjEVIkII14MtTIcFqAazY+2sFC
=pq/V
-----END PGP SIGNATURE-----