Deprecate --ns-cert-type
PATCH 1/1 Deprecate --ns-cert-type
The nsCertType x509 extension is very old, and barely used. We already have had an alternative for a long time: --remote-cert-tls uses the far more common keyUsage and extendedKeyUsage extensions instead.
OpenSSL 1.1 longer exposes an API to (separately) check the nsCertType x509 extension. Since we want be able to migrate to OpenSSL 1.1, we should deprecate this option immediately.
Signed-off-by Steffan Karger <[email protected]...>
--- Changes.rst | 13 +++++++++++-- doc/openvpn.8 | 8 ++++++-- src/openvpn/init.c | 4 ++++ src/openvpn/options.c | 4 ++-- tests/t_client.rc-sample | 2 +- 5 files changed, 24 insertions(+), 7 deletions(-)
Changes.rst +11 -2
@@ -1,5 +1,5 @@ -Version 2.4.0 -============= +Overview of changes in 2.4 +========================== New features
@@ -302,3 +302,12 @@ Maintainer-visible changes header combinations. In most of these situations it is recommended to use -std=gnu99 in CFLAGS. This is known to be needed when doing i386/i686 builds on RHEL5. + + +Version 2.4.1 +============= + - ``--ns-cert-type`` is deprecated. Use ``--remote-cert-tls`` instead. + The nsCertType x509 extension is very old, and barely used. + ``--remote-cert-tls`` uses the far more common keyUsage and extendedKeyUsage + extension instead. Make sure your certificates carry these to be able to + use ``--remote-cert-tls``.
doc/openvpn.8 +6 -2
@@ -327,7 +327,7 @@ http\-proxy 192.168.0.8 8080 persist\-key persist\-tun pkcs12 client.p12 -ns\-cert\-type server +remote\-cert\-tls server verb 3 .in -4 .ft
@@ -5313,7 +5313,11 @@ as X509_<depth>_<attribute>=<value>. Multiple options can be defined to track multiple attributes. .\"********************************************************* .TP -.B \-\-ns\-cert\-type client|server +.B \-\-ns\-cert\-type client|server (DEPRECATED) +This option is deprecated. Use the more modern equivalent +.B \-\-remote\-cert\-tls +instead. This option will be removed in OpenVPN 2.5. + Require that peer certificate was signed with an explicit .B nsCertType designation of "client" or "server".
src/openvpn/init.c +4 -0
@@ -2979,6 +2979,10 @@ do_option_warnings(struct context *c) {msg (M_WARN ,"WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info." ); } +if (o->ns_cert_type) + { +msg (M_WARN ,"WARNING: --ns-cert-type is DEPRECATED. Use --remote-cert-tls instead." ); + }#endif /* ifdef ENABLE_CRYPTO */ /* If a script is used, print appropiate warnings */
src/openvpn/options.c +2 -2
@@ -635,8 +635,8 @@ static const char usage_message[] ="--verify-x509-name name: Accept connections only from a host with X509 subject\n" " DN name. The remote host must also pass all other tests\n" " of verification.\n" -"--ns-cert-type t: Require that peer certificate was signed with an explicit\n" -" nsCertType designation t = 'client' | 'server'.\n" +"--ns-cert-type t: (DEPRECATED) Require that peer certificate was signed with \n" +" an explicit nsCertType designation t = 'client' | 'server'.\n" "--x509-track x : Save peer X509 attribute x in environment for use by\n" " plugins and management interface.\n"#if defined(ENABLE_CRYPTO_OPENSSL ) &&OPENSSL_VERSION_NUMBER >=0x10001000
tests/t_client.rc-sample +1 -1
@@ -40,7 +40,7 @@ TEST_RUN_LIST="1 2" # OPENVPN_BASE_P2MP="--client --ca $CA_CERT \ --cert $CLIENT_CERT --key $CLIENT_KEY \ - --ns-cert-type server --nobind --comp-lzo --verb 3" + --remote-cert-tls server --nobind --comp-lzo --verb 3" # base config for p2p tests #
Signature · 1 line
2.7.4
ACK. Makes sense from the discussion, and the patch itself is trivial (just adding a warning and updating documentation, not disturbing functionality). Plus, does what it says on the lid :-)
Your patch has been applied to the master and release/2.4 branch.
commit 2dc332266449d5378f1fe04f950cbebf128ec9c9 (master) commit 57637d0f677d824dacdc83d858357ccc80723f45 (release/2.4)
Author: Steffan Karger Date: Sat Mar 4 19:49:57 2017 +0100
Deprecate --ns-cert-type
Signed-off-by: Steffan Karger <[email protected]...>
Acked-by: Gert Doering <[email protected]...>
Message-Id: <[email protected]...>
URL: https://www.mail-archive.com/[email protected]/msg14222.html
Signed-off-by: Gert Doering <[email protected]...>--
kind regards,
Gert Doering