mirror of
https://github.com/OpenVPN/openvpn.git
synced 2025-05-09 05:31:05 +08:00
058f3d0b3e
This patch should be easy to process. A resubmission of the patch sent to this list on 04/23/2009. The patch changes the verify-cn script sample to be used with --tls-verify so that instead of having to hardcode a cn to verify in the OpenVPN configuration file the allowed cns may be written into a separate file. This makes the process of verifying cns a whole lot more dynamic, to the point where it is useful in the real world. One problem with this patch is that it is backwards incompatible. I did not bother keeping the original calling interface as A) it's a sample script, and B) the original's functionality seems useless and equalivant functionality is easily available with the new script. The problem with the original is that there seems little point in verifying a client's cn when all the clients share one cn, as would have to be the case when the cn is hardcoded into the openvpn config file. This patch applies against the testing allmiscs branch, and should apply against any of the other testing branches as well. It works for me. I've tested it throughly but not used it extensively in production. Regards, Karl <kop@meme.com> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net> Acked-by: Gert Doering <gert@greenie.muc.de> Acked-by: Eric F Crist <ecrist@secure-computing.net>
65 lines
2.2 KiB
Perl
Executable File
65 lines
2.2 KiB
Perl
Executable File
#!/usr/bin/perl
|
|
|
|
# verify-cn -- a sample OpenVPN tls-verify script
|
|
#
|
|
# Return 0 if cn matches the common name component of
|
|
# X509_NAME_oneline, 1 otherwise.
|
|
#
|
|
# For example in OpenVPN, you could use the directive:
|
|
#
|
|
# tls-verify "./verify-cn /etc/openvpn/allowed_clients"
|
|
#
|
|
# This would cause the connection to be dropped unless
|
|
# the client common name is listed on a line in the
|
|
# allowed_clients file.
|
|
|
|
die "usage: verify-cn cnfile certificate_depth X509_NAME_oneline" if (@ARGV != 3);
|
|
|
|
# Parse out arguments:
|
|
# cnfile -- The file containing the list of common names, one per
|
|
# line, which the client is required to have,
|
|
# taken from the argument to the tls-verify directive
|
|
# in the OpenVPN config file.
|
|
# The file can have blank lines and comment lines that begin
|
|
# with the # character.
|
|
# depth -- The current certificate chain depth. In a typical
|
|
# bi-level chain, the root certificate will be at level
|
|
# 1 and the client certificate will be at level 0.
|
|
# This script will be called separately for each level.
|
|
# x509 -- the X509 subject string as extracted by OpenVPN from
|
|
# the client's provided certificate.
|
|
($cnfile, $depth, $x509) = @ARGV;
|
|
|
|
if ($depth == 0) {
|
|
# If depth is zero, we know that this is the final
|
|
# certificate in the chain (i.e. the client certificate),
|
|
# and the one we are interested in examining.
|
|
# If so, parse out the common name substring in
|
|
# the X509 subject string.
|
|
|
|
if ($x509 =~ /\/CN=([^\/]+)/) {
|
|
$cn = $1;
|
|
# Accept the connection if the X509 common name
|
|
# string matches the passed cn argument.
|
|
open(FH, '<', $cnfile) or exit 1; # can't open, nobody authenticates!
|
|
while (defined($line = <FH>)) {
|
|
if ($line !~ /^[[:space:]]*(#|$)/o) {
|
|
chop($line);
|
|
if ($line eq $cn) {
|
|
exit 0;
|
|
}
|
|
}
|
|
}
|
|
close(FH);
|
|
}
|
|
|
|
# Authentication failed -- Either we could not parse
|
|
# the X509 subject string, or the common name in the
|
|
# subject string didn't match the passed cn argument.
|
|
exit 1;
|
|
}
|
|
|
|
# If depth is nonzero, tell OpenVPN to continue processing
|
|
# the certificate chain.
|
|
exit 0;
|