Skip to contentSkip to conversation

x509 validity for tls-verify

PATCH In review Emmanuel Dreyfus 3 participants 4 messages Jan 30, 2013

lore
Share & tools
lore

Emmanuel Dreyfus

author
#0 lore raw

PATCH 1/1 x509 validity for tls-verify

Hi

Please consider the attached patch that makes x509 xertificate validity (notBeofre and notAfter) available in environement for the tls-verify script.

I use it to monitor OpenVPN certificate expirations in Nagios. I can share the Nagios bits with whoever is interested.

Signature · 2 lines
Emmanuel Dreyfus
[email protected]...
openvpn/ssl_verify.c renamed from openvpn/ssl_verify.c.orig +13 -0
@@ -399,8 +399,10 @@
     )
 {
   char envname[64];
   char *serial = NULL;
+  char *notBefore = NULL;
+  char *notAfter = NULL;
   struct gc_arena gc = gc_new ();
 
   /* Save X509 fields in environment */
 #ifdef ENABLE_X509_TRACK

@@ -435,8 +437,19 @@
   serial = x509_get_serial(peer_cert, &gc);
   openvpn_snprintf (envname, sizeof(envname), "tls_serial_%d", cert_depth);
   setenv_str (es, envname, serial);
 
+  /* export Validity */
+  if ((notBefore = x509_get_validity_notBefore(peer_cert, &gc)) != NULL) {
+    openvpn_snprintf (envname, sizeof(envname), "tls_notbefore_%d", cert_depth);
+    setenv_str (es, envname, notBefore);
+  }
+
+  if ((notAfter = x509_get_validity_notAfter(peer_cert, &gc)) != NULL) {
+    openvpn_snprintf (envname, sizeof(envname), "tls_notafter_%d", cert_depth);
+    setenv_str (es, envname, notAfter);
+  }
+
   gc_free(&gc);
 }
 
 /*
openvpn/ssl_verify_backend.h renamed from openvpn/ssl_verify_backend.h.orig +28 -0
@@ -124,8 +124,36 @@
  */
 char *x509_get_serial (openvpn_x509_cert_t *cert, struct gc_arena *gc);
 
 /*
+ * Return the certificate's notBefore validity
+ *
+ * The notBefore validity number is returned as a string with 
+ * format YYmmddHHMMSSZ
+ *
+ * @param cert		Certificate to retrieve the notBefore validity from.
+ * @param gc		Garbage collection arena to use when allocating string.
+ *
+ * @return 		The certificate's notBefore validity
+ */
+char * x509_get_validity_notBefore (openvpn_x509_cert_t *cert,
+    struct gc_arena *gc);
+
+/*
+ * Return the certificate's notAfter validity
+ *
+ * The notAfter validity number is returned as a string with 
+ * format YYmmddHHMMSSZ
+ *
+ * @param cert		Certificate to retrieve the notAfter validity from.
+ * @param gc		Garbage collection arena to use when allocating string.
+ *
+ * @return 		The certificate's notAfter validity
+ */
+char * x509_get_validity_notAfter (openvpn_x509_cert_t *cert,
+    struct gc_arena *gc);
+
+/*
  * Save X509 fields to environment, using the naming convention:
  *
  * X509_{cert_depth}_{name}={value}
  *
openvpn/ssl_verify_openssl.c renamed from openvpn/ssl_verify_openssl.c.orig +24 -0
@@ -237,8 +237,32 @@
 
   return serial;
 }
 
+char *
+x509_get_validity_notBefore (openvpn_x509_cert_t *cert, struct gc_arena *gc)
+{
+  unsigned char *buf;
+
+  if ((buf = ASN1_STRING_data(X509_get_notBefore(cert))) == NULL)
+    return NULL;
+
+  return string_alloc(buf, gc);
+}
+
+
+char *
+x509_get_validity_notAfter (openvpn_x509_cert_t *cert, struct gc_arena *gc)
+{
+  unsigned char *buf;
+
+  if ((buf = ASN1_STRING_data(X509_get_notAfter(cert))) == NULL)
+    return NULL;
+
+  return string_alloc(buf, gc);
+}
+
+
 unsigned char *
 x509_get_sha1_hash (X509 *cert, struct gc_arena *gc)
 {
   char *hash = gc_malloc(SHA_DIGEST_LENGTH, false, gc);
openvpn/ssl_verify_polarssl.c renamed from openvpn/ssl_verify_polarssl.c.orig +13 -0
@@ -140,8 +140,21 @@
 
   return buf;
 }
 
+char *
+x509_get_validity_notBefore (openvpn_x509_cert_t *cert, struct gc_arena *gc)
+{
+  return NULL;
+}
+
+
+char *
+x509_get_validity_notAfter (openvpn_x509_cert_t *cert, struct gc_arena *gc)
+{
+  return NULL;
+}
+
 unsigned char *
 x509_get_sha1_hash (x509_cert *cert, struct gc_arena *gc)
 {
   unsigned char *sha1_hash = gc_malloc(SHA_DIGEST_LENGTH, false, gc);
#1 lore raw

Hi,

openvpn/ssl_verify_polarssl.c line 148

Quoted 11 lines · Emmanuel Dreyfus

+++ src/openvpn/ssl_verify_polarssl.c 2013-01-30 09:37:42.000000000 +0100

openvpn/ssl_verify_polarssl.c renamed from openvpn/ssl_verify_polarssl.c.orig +5 -0
@@ -140,8 +140,21 @@
 
   return buf;
 }
 
+char *
+x509_get_validity_notBefore (openvpn_x509_cert_t *cert, struct gc_arena *gc)
+{
+  return NULL;
+}

Can this not be done with PolarSSL, or did you not investigate?

gert

Signature · 4 lines
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             [email protected]...
fax: +49-89-35655025                        [email protected]...
author
#2 lore raw
Quoted 1 line · Gert Doering

Can this not be done with PolarSSL, or did you not investigate?

I did not investigate, but I would be suprised if it would be difficult for someone knowledgable in PolarSSL. I have left it to be implemented by someone lese, I should have added a comment about that.

Signature · 3 lines
Emmanuel Dreyfus
http://hcpnet.free.fr/pubz
[email protected]...
#3 lore raw
In reply to Emmanuel Dreyfus
Quoted 8 lines · Emmanuel Dreyfus

Hi

Please consider the attached patch that makes x509 xertificate validity (notBeofre and notAfter) available in environement for the tls-verify script.

I use it to monitor OpenVPN certificate expirations in Nagios. I can share the Nagios bits with whoever is interested.

Thank you very much for your patch. Just a few comments. Gert already covered the PolarSSL part. I think we should have PolarSSL support included as well when pulling in new code which depends on this. Simply to avoid those to implementation to divert too much.

Another thing is that we are exporting quite a large set of environment variables already and we should probably rather reduce that footprint than increasing it further. In addition, considering that the v3 plug-in API already exports the complete certificate in a native format used by SSL library, wouldn't it make more sense to rather put this functionality into a plugin directly?

For a simple example, have a look at sample/sample-plugins/log/log_v3.c

Signature · 3 lines
kind regards,

David Sommerseth