Deprecate --ns-cert-type
PATCH 1/1 Deprecate --ns-cert-type
This is a manual cherry-pick of commit 2dc33226 of the master branch, for the release/2.3 branch.
The nsCertType x509 extension is very old, and barely used. We already have had an alternative for a long time: --remote-cert-tls uses the far more common keyUsage and extendedKeyUsage extensions instead.
OpenSSL 1.1 no longer exposes an API to (separately) check the nsCertType x509 extension. Since we want be able to migrate to OpenSSL 1.1, we should deprecate this option immediately.
Trac: #876
--- Changes.rst | 12 ++++++++++++ doc/openvpn.8 | 8 ++++++-- src/openvpn/init.c | 4 ++++ src/openvpn/options.c | 4 ++-- tests/t_client.rc-sample | 2 +- 5 files changed, 25 insertions(+), 5 deletions(-)
Changes.rst +12 -0
@@ -105,6 +105,18 @@ Behavioral changes - Do not randomize resolving of IP addresses in getaddr() +Version 2.3.18 +============== + +Deprecated features +------------------- +- ``--ns-cert-type`` is deprecated. Use ``--remote-cert-tls`` instead. + The nsCertType x509 extension is very old, and barely used. + ``--remote-cert-tls`` uses the far more common keyUsage and extendedKeyUsage + extension instead. Make sure your certificates carry these to be able to + use ``--remote-cert-tls``. + + Version 2.3.17 ==============
doc/openvpn.8 +6 -2
@@ -324,7 +324,7 @@ http-proxy-retry persist-key persist-tun pkcs12 client.p12 -ns-cert-type server +remote-cert-tls server verb 3 .in -4 .ft
@@ -5094,7 +5094,11 @@ options can be defined to track multiple attributes. Not available with PolarSSL. .\"********************************************************* .TP -.B \-\-ns\-cert\-type client|server +.B \-\-ns\-cert\-type client|server (DEPRECATED) +This option is deprecated. Use the more modern equivalent +.B \-\-remote\-cert\-tls +instead. This option will be removed in OpenVPN 2.5. + Require that peer certificate was signed with an explicit .B nsCertType designation of "client" or "server".
src/openvpn/init.c +4 -0
@@ -2591,6 +2591,10 @@ do_option_warnings (struct context *c) && !(o->ns_cert_type & NS_CERT_CHECK_SERVER) && !o->remote_cert_eku)msg (M_WARN ,"WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info." ); +if (o->ns_cert_type) + { +msg (M_WARN ,"WARNING: --ns-cert-type is DEPRECATED. Use --remote-cert-tls instead." ); + }#endif #endif
src/openvpn/options.c +2 -2
@@ -622,8 +622,8 @@ static const char usage_message[] ="--verify-x509-name name: Accept connections only from a host with X509 subject\n" " DN name. The remote host must also pass all other tests\n" " of verification.\n" -"--ns-cert-type t: Require that peer certificate was signed with an explicit\n" -" nsCertType designation t = 'client' | 'server'.\n" +"--ns-cert-type t: (DEPRECATED) Require that peer certificate was signed with \n" +" an explicit nsCertType designation t = 'client' | 'server'.\n" #ifdef ENABLE_X509_TRACK"--x509-track x : Save peer X509 attribute x in environment for use by\n" " plugins and management interface.\n"
tests/t_client.rc-sample +1 -1
@@ -39,7 +39,7 @@ TEST_RUN_LIST="1 2" # OPENVPN_BASE_P2MP="--client --ca $CA_CERT \ --cert $CLIENT_CERT --key $CLIENT_KEY \ - --ns-cert-type server --nobind --comp-lzo --verb 3" + --remote-cert-tls server --nobind --comp-lzo --verb 3" # base config for p2p tests #
Signature · 1 line
2.7.4
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
ACK. This makes sense and works as expected.
Your patch has been applied to the release/2.3 branch
commit 49e12a39abdecb4c63ea0e577f9abc18e0eda082
Author: Steffan Karger Date: Tue Aug 8 22:00:47 2017 +0200
Deprecate --ns-cert-type
Trac: #876
Signed-off-by: Steffan Karger <[email protected]...>
Acked-by: David Sommerseth <[email protected]...>
Message-Id: <[email protected]...>
URL: https://www.mail-archive.com/[email protected]/msg15180.html
Signed-off-by: David Sommerseth <[email protected]...>- --
kind regards,
David Sommerseth
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
iQIcBAEBCgAGBQJZkuCYAAoJEIbPlEyWcf3y+84P/2g4Jn4jdgMd4yM/diLyWPBP Nyu3ukvrB9pAN81tekdr1H3ZtOaQEfLkBV3DfAsymaSC5NEODBWHVStgypcN6wRI azOuOBgsKF4jW32CWZWG76ZBvzkVutNUue/FCU0SxddFgvE0lFBcKTpY5oAzvNPx pHc4TLZ6ZpGPEuCCb3ypyYLvBHRK8oSmTZNnSVGsOby20ZWI8Lrn5JC+f6AavKQQ 2BcS4ke0r74tRDg+PnZ07BY3xGKlExkrrKIJfYzFhpMf8Nv7qzV0y6/sM1CEn43G RjQd5NaBx53ByVqpvMTgutlymr57W424y0uBdAXTGe2VvzwVP8duiTJ8OR+bKkKV y8MnZ7bDu8UFHqACMtd10KUCRgBBC5S0wSG2lUxtb31Qz2OG+dh6W7arMyPeUl7s XNAWgVJFUoNeqGLuvIfcgE+F667vvDIRODI4MccXoRDHrBtsQrFTPyRYNOIotMOO DVESfFCUKT6flU2l70rM0Oi1lAKpqg+RtZSNbA3eUo/wLnfqsYeGpDd7cx7q1WH3 erSnu6I6BJxob+h/O+aY8qJaYnj6qhye6qPg2Bwbykb/Pc35s7aqxI/wsFxKKSFL U5ZFzeceZokni1Ucurb0S+yiwHC23O0pFaNLU7KaaxJfqIYZCidFSeUDAOtQRybp VQloJpr/pdjBCRrMwfke
=ia5o
-----END PGP SIGNATURE-----