OpenVPN/openvpn
1
0
Fork 0
mirror of https://github.com/OpenVPN/openvpn.git synced 2025-05-09 05:31:05 +08:00
Code Issues Packages Projects Releases Wiki Activity

Deprecate --ns-cert-type

Browse Source 
This is a manual cherry-pick of commit 2dc33226 of the master branch,
for the release/2.3 branch.

The nsCertType x509 extension is very old, and barely used.  We already
have had an alternative for a long time: --remote-cert-tls uses the far
more common keyUsage and extendedKeyUsage extensions instead.

OpenSSL 1.1 no longer exposes an API to (separately) check the nsCertType
x509 extension.  Since we want be able to migrate to OpenSSL 1.1, we
should deprecate this option immediately.

Trac: #876

Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: David Sommerseth <davids@openvpn.net>
Message-Id: <1502222447-8186-1-git-send-email-steffan@karger.me>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15180.html
Signed-off-by: David Sommerseth <davids@openvpn.net>
This commit is contained in:
Steffan Karger 2017-08-08 22:00:47 +02:00 committed by David Sommerseth
parent ca870b1396
commit 49e12a39ab
No known key found for this signature in database
GPG Key ID: 86CF944C9671FDF2
5 changed files with 25 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
Changes.rst
View File

@ -105,6 +105,18 @@ Behavioral changes
- Do not randomize resolving of IP addresses in getaddr()
Version 2.3.18
==============
Deprecated features
-------------------
- ``--ns-cert-type`` is deprecated. Use ``--remote-cert-tls`` instead.
The nsCertType x509 extension is very old, and barely used.
``--remote-cert-tls`` uses the far more common keyUsage and extendedKeyUsage
extension instead. Make sure your certificates carry these to be able to
use ``--remote-cert-tls``.
Version 2.3.17
==============

8
doc/openvpn.8
View File

@ -324,7 +324,7 @@ http-proxy-retry
persist-key
persist-tun
pkcs12 client.p12
ns-cert-type server
remote-cert-tls server
verb 3
.in -4
.ft
@ -5094,7 +5094,11 @@ options can be defined to track multiple attributes.
Not available with PolarSSL.
.\"*********************************************************
.TP
.B \-\-ns\-cert\-type client|server
.B \-\-ns\-cert\-type client|server (DEPRECATED)
This option is deprecated. Use the more modern equivalent
.B \-\-remote\-cert\-tls
instead. This option will be removed in OpenVPN 2.5.
Require that peer certificate was signed with an explicit
.B nsCertType
designation of "client" or "server".

4
src/openvpn/init.c
View File

@ -2591,6 +2591,10 @@ do_option_warnings (struct context *c)
&& !(o->ns_cert_type & NS_CERT_CHECK_SERVER)
&& !o->remote_cert_eku)
msg (M_WARN, "WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.");
if (o->ns_cert_type)
{
msg(M_WARN, "WARNING: --ns-cert-type is DEPRECATED. Use --remote-cert-tls instead.");
}
#endif
#endif

4
src/openvpn/options.c
View File

@ -622,8 +622,8 @@ static const char usage_message[] =
"--verify-x509-name name: Accept connections only from a host with X509 subject\n"
" DN name. The remote host must also pass all other tests\n"
" of verification.\n"
"--ns-cert-type t: Require that peer certificate was signed with an explicit\n"
" nsCertType designation t = 'client' | 'server'.\n"
"--ns-cert-type t: (DEPRECATED) Require that peer certificate was signed with \n"
" an explicit nsCertType designation t = 'client' | 'server'.\n"
#ifdef ENABLE_X509_TRACK
"--x509-track x : Save peer X509 attribute x in environment for use by\n"
" plugins and management interface.\n"

2
tests/t_client.rc-sample
View File

@ -39,7 +39,7 @@ TEST_RUN_LIST="1 2"
#
OPENVPN_BASE_P2MP="--client --ca $CA_CERT \
--cert $CLIENT_CERT --key $CLIENT_KEY \
--ns-cert-type server --nobind --comp-lzo --verb 3"
--remote-cert-tls server --nobind --comp-lzo --verb 3"
# base config for p2p tests
#