From patchwork Mon Jul 27 12:13:40 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vladislav Grishenko X-Patchwork-Id: 1343 Return-Path: Delivered-To: patchwork@openvpn.net Delivered-To: patchwork@openvpn.net Received: from director10.mail.ord1d.rsapps.net ([172.31.255.6]) by backend30.mail.ord1d.rsapps.net with LMTP id UFbvMtxRH19qHAAAIUCqbw for ; Mon, 27 Jul 2020 18:14:52 -0400 Received: from proxy4.mail.iad3b.rsapps.net ([172.31.255.6]) by director10.mail.ord1d.rsapps.net with LMTP id AH65MdxRH19UbQAApN4f7A (envelope-from ) for ; Mon, 27 Jul 2020 18:14:52 -0400 Received: from smtp19.gate.iad3b ([172.31.255.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by proxy4.mail.iad3b.rsapps.net with LMTP id QOOEKtxRH19obQAA9crAow ; Mon, 27 Jul 2020 18:14:52 -0400 X-Spam-Threshold: 95 X-Spam-Score: 0 X-Spam-Flag: NO X-Virus-Scanned: OK X-Orig-To: openvpnslackdevel@openvpn.net X-Originating-Ip: [216.105.38.7] Authentication-Results: smtp19.gate.iad3b.rsapps.net; iprev=pass policy.iprev="216.105.38.7"; spf=pass smtp.mailfrom="openvpn-devel-bounces@lists.sourceforge.net" smtp.helo="lists.sourceforge.net"; dkim=fail (signature verification failed) header.d=sourceforge.net; dkim=fail (signature verification failed) header.d=sf.net; dkim=fail (signature verification failed) header.d=yandex-team.ru; dmarc=fail (p=none; dis=none) header.from=yandex-team.ru X-Suspicious-Flag: YES X-Classification-ID: 974043ae-d056-11ea-8576-525400cbaf6c-1-1 Received: from [216.105.38.7] ([216.105.38.7:54854] helo=lists.sourceforge.net) by smtp19.gate.iad3b.rsapps.net (envelope-from ) (ecelerity 4.2.38.62370 r(:)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384) id 55/67-30139-BD15F1F5; Mon, 27 Jul 2020 18:14:52 -0400 Received: from [127.0.0.1] (helo=sfs-ml-1.v29.lw.sourceforge.com) by sfs-ml-1.v29.lw.sourceforge.com with esmtp (Exim 4.90_1) (envelope-from ) id 1k0BNe-0004Bk-Fe; Mon, 27 Jul 2020 22:13:58 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-1.v29.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.90_1) (envelope-from ) id 1k0BNd-0004Bd-Id for openvpn-devel@lists.sourceforge.net; Mon, 27 Jul 2020 22:13:57 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Message-Id:Date:Subject:To:From:Sender:Reply-To:Cc: MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=sO1NezUR632SSlw13XJBFKu80EHp8aHEX9/6U+wC5b0=; b=ZkNrIF51C9rMRAcFvFooSaFXUr 3Hz1XD+dJXawnhbQLOI1GqsyFkTjDbiZOX7B+JpwHDGOymXquE5B7TPbIzwdjPqXq0zfybb2w8Ri0 yzYENJUlATvEACz15/L5QqlOwoEVJSVX2jvXB4CAZNEgYkUufNAglCJkv/b3UX2E9uIY=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Message-Id:Date:Subject:To:From:Sender:Reply-To:Cc:MIME-Version: Content-Type:Content-Transfer-Encoding:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=sO1NezUR632SSlw13XJBFKu80EHp8aHEX9/6U+wC5b0=; b=dacPu/R0cnbs0e2JLls33vicS4 2/7LvfZPYcDbHH6S85GFtOtXIYRt0DTpMobhW+Z59R77AtGmcTnw1A7XuOj9VegnYm8So0zpOOEF1 LCVBrdc3VoFrS8Kqa43Ij3VPRpGlNwvDfRqf4kdRbotAGW8YaLKEdBlrPHyBvLtiXrI8=; Received: from forwardcorp1j.mail.yandex.net ([5.45.199.163]) by sfi-mx-3.v28.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.92.2) id 1k0BNY-001Tlo-MO for openvpn-devel@lists.sourceforge.net; Mon, 27 Jul 2020 22:13:57 +0000 Received: from iva8-d077482f1536.qloud-c.yandex.net (iva8-d077482f1536.qloud-c.yandex.net [IPv6:2a02:6b8:c0c:2f26:0:640:d077:482f]) by forwardcorp1j.mail.yandex.net (Yandex) with ESMTP id 994C22E0EC9 for ; Tue, 28 Jul 2020 01:13:45 +0300 (MSK) Received: from iva4-7c3d9abce76c.qloud-c.yandex.net (iva4-7c3d9abce76c.qloud-c.yandex.net [2a02:6b8:c0c:4e8e:0:640:7c3d:9abc]) by iva8-d077482f1536.qloud-c.yandex.net (mxbackcorp/Yandex) with ESMTP id NDfrCOWTpr-DjtaAcIx; Tue, 28 Jul 2020 01:13:45 +0300 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yandex-team.ru; s=default; t=1595888025; bh=sO1NezUR632SSlw13XJBFKu80EHp8aHEX9/6U+wC5b0=; h=Message-Id:Date:Subject:To:From; b=p5Yp1vb+5uJDI0sXSMPlBh1NoXm7dpknYqaqb6+oTuqLQH/cha69bEHtw/d8lmtAb hT4xBYyHFlhqlUCG4xv51hm5znZsrXDM0+9yWZKTmj354x1wHiJGrg+ykILUaPocZ9 d8azWqNXOMYkkCSNsfJDiXoFnBH0o+LUG5O8tudM= Received: from unknown (unknown [178.154.220.35]) by iva4-7c3d9abce76c.qloud-c.yandex.net (smtpcorp/Yandex) with ESMTPSA id GY9BenkvxH-DjiGWBSn; Tue, 28 Jul 2020 01:13:45 +0300 (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (Client certificate not present) From: Vladislav Grishenko To: openvpn-devel@lists.sourceforge.net Date: Tue, 28 Jul 2020 03:13:40 +0500 Message-Id: <20200727221341.22544-1-themiron@yandex-team.ru> X-Mailer: git-send-email 2.17.1 X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. -0.0 SPF_PASS SPF: sender matches SPF record 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid X-Headers-End: 1k0BNY-001Tlo-MO Subject: [Openvpn-devel] [PATCH 1/2] Support multiple x509 field list to be username X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox OpenVPN has the ability to choose different x509 field in case "CN" can't be use used to be unique connected username since commit 935c62be9c0c8a256112df818bfb8470586a23b6. Unfortunately it's not enough in case client has multiple and valid certificates from PKI for different devices (ex. laptop, mobile, etc) with the same CN/UID. Having --duplicate-cn as a workaround helps only partially - clients can be connected, but it breaks coexistance with --ifconfig-pool-persist, --client-config-dir and opens doors to DoS possibility since same client device (with the same cert) being reconnected doesn't replace previously connected session no more, so can exhaust server ressources (ex. address pool) and can prevent other clients to be connected. With this patch, multiple x509 fields incl. "serialNumber" can be chosen to be username as --x509-username-files space-separated parameters. Multiple fields will be joined into one username using '/' delimeter for consistency with CN/addr logging and preserving ability for hierarchical ccd. As long as resulting username is unique, --duplicate-cn will not be required. Default value is preserved as "CN" only. Openssl backend is the only supported at the moment, since so far MbedTLS has no alt user name support at all. --- doc/man-sections/tls-options.rst | 9 ++++--- src/openvpn/init.c | 4 +-- src/openvpn/options.c | 46 ++++++++++++++++++-------------- src/openvpn/options.h | 4 +-- src/openvpn/ssl.h | 1 + src/openvpn/ssl_common.h | 8 +++++- src/openvpn/ssl_verify.c | 35 ++++++++++++++++-------- src/openvpn/ssl_verify_openssl.c | 15 +++++++++++ 8 files changed, 83 insertions(+), 39 deletions(-) diff --git a/doc/man-sections/tls-options.rst b/doc/man-sections/tls-options.rst index 8c2db7cd..301f8be4 100644 --- a/doc/man-sections/tls-options.rst +++ b/doc/man-sections/tls-options.rst @@ -632,13 +632,13 @@ certificates and keys: https://github.com/OpenVPN/easy-rsa options can be defined to track multiple attributes. --x509-username-field args - Field in the X.509 certificate subject to be used as the username + Field list in the X.509 certificate subject to be used as the username (default :code:`CN`). Valid syntax: :: - x509-username-field [ext:]fieldname + x509-username-field [ext:]fieldname [[ext:]fieldname...] Typically, this option is specified with **fieldname** as either of the following: @@ -646,6 +646,7 @@ certificates and keys: https://github.com/OpenVPN/easy-rsa x509-username-field emailAddress x509-username-field ext:subjectAltName + x509-username-field CN serialNumber The first example uses the value of the :code:`emailAddress` attribute in the certificate's Subject field as the username. The second example @@ -653,7 +654,9 @@ certificates and keys: https://github.com/OpenVPN/easy-rsa ``fieldname`` :code:`subjectAltName` be searched for an rfc822Name (email) field to be used as the username. In cases where there are multiple email addresses in :code:`ext:fieldname`, the last occurrence - is chosen. + is chosen. The last example uses the value of :code:`CN` attribute in + the Subject field and the hex representation of certificate's serial + number delimited by slash symbol as the resulting username. When this option is used, the ``--verify-x509-name`` option will match against the chosen ``fieldname`` instead of the Common Name. diff --git a/src/openvpn/init.c b/src/openvpn/init.c index 1ea4735d..11b417a8 100644 --- a/src/openvpn/init.c +++ b/src/openvpn/init.c @@ -2912,9 +2912,9 @@ do_init_crypto_tls(struct context *c, const unsigned int flags) to.verify_hash = options->verify_hash; to.verify_hash_algo = options->verify_hash_algo; #ifdef ENABLE_X509ALTUSERNAME - to.x509_username_field = (char *) options->x509_username_field; + memmove(to.x509_username_field, options->x509_username_field, sizeof(to.x509_username_field)); #else - to.x509_username_field = X509_USERNAME_FIELD_DEFAULT; + to.x509_username_field[0] = X509_USERNAME_FIELD_DEFAULT; #endif to.es = c->c2.es; to.net_ctx = &c->net_ctx; diff --git a/src/openvpn/options.c b/src/openvpn/options.c index bc256b18..a51038dd 100644 --- a/src/openvpn/options.c +++ b/src/openvpn/options.c @@ -877,7 +877,7 @@ init_options(struct options *o, const bool init_gc) o->tls_cert_profile = NULL; o->ecdh_curve = NULL; #ifdef ENABLE_X509ALTUSERNAME - o->x509_username_field = X509_USERNAME_FIELD_DEFAULT; + o->x509_username_field[0] = X509_USERNAME_FIELD_DEFAULT; #endif #ifdef ENABLE_PKCS11 o->pkcs11_pin_cache_period = -1; @@ -8434,7 +8434,7 @@ add_option(struct options *options, x509_track_add(&options->x509_track, p[1], msglevel, &options->gc); } #ifdef ENABLE_X509ALTUSERNAME - else if (streq(p[0], "x509-username-field") && p[1] && !p[2]) + else if (streq(p[0], "x509-username-field") && p[1]) { /* This option used to automatically upcase the fieldname passed as the * option argument, e.g., "ou" became "OU". Now, this "helpfulness" is @@ -8443,32 +8443,38 @@ add_option(struct options *options, * "emailAddress" are left as-is. An option parameter having the "ext:" * prefix for matching X.509v3 extended fields will also remain unchanged. */ - char *s = p[1]; + size_t j; VERIFY_PERMISSION(OPT_P_GENERAL); - if (strncmp("ext:", s, 4) != 0) + + for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j) { - size_t i = 0; - while (s[i] && !isupper(s[i])) - { - i++; - } - if (strlen(s) == i) + char *s = p[j]; + + if (strncmp("ext:", s, 4) != 0) { - while ((*s = toupper(*s)) != '\0') + size_t i = 0; + while (s[i] && !isupper(s[i])) + { + i++; + } + if (strlen(s) == i) { - s++; + while ((*s = toupper(*s)) != '\0') + { + s++; + } + msg(M_WARN, "DEPRECATED FEATURE: automatically upcased the " + "--x509-username-field parameter to '%s'; please update your" + "configuration", p[j]); } - msg(M_WARN, "DEPRECATED FEATURE: automatically upcased the " - "--x509-username-field parameter to '%s'; please update your" - "configuration", p[1]); } + else if (!x509_username_field_ext_supported(s+4)) + { + msg(msglevel, "Unsupported x509-username-field extension: %s", s); + } + options->x509_username_field[j-1] = p[j]; } - else if (!x509_username_field_ext_supported(s+4)) - { - msg(msglevel, "Unsupported x509-username-field extension: %s", s); - } - options->x509_username_field = p[1]; } #endif /* ENABLE_X509ALTUSERNAME */ #ifdef ENABLE_PKCS11 diff --git a/src/openvpn/options.h b/src/openvpn/options.h index c5df2d18..e84aafec 100644 --- a/src/openvpn/options.h +++ b/src/openvpn/options.h @@ -582,8 +582,8 @@ struct options int handshake_window; #ifdef ENABLE_X509ALTUSERNAME - /* Field used to be the username in X509 cert. */ - char *x509_username_field; + /* Field list used to be the username in X509 cert. */ + char *x509_username_field[MAX_PARMS]; #endif /* Old key allowed to live n seconds after new key goes active */ diff --git a/src/openvpn/ssl.h b/src/openvpn/ssl.h index 005628f6..51d6ab32 100644 --- a/src/openvpn/ssl.h +++ b/src/openvpn/ssl.h @@ -119,6 +119,7 @@ /* Default field in X509 to be username */ #define X509_USERNAME_FIELD_DEFAULT "CN" +#define X509_USERNAME_FIELD_DELIMITER '/' #define KEY_METHOD_2 2 diff --git a/src/openvpn/ssl_common.h b/src/openvpn/ssl_common.h index 9f777750..a322b923 100644 --- a/src/openvpn/ssl_common.h +++ b/src/openvpn/ssl_common.h @@ -285,7 +285,13 @@ struct tls_options const char *remote_cert_eku; uint8_t *verify_hash; hash_algo_type verify_hash_algo; - char *x509_username_field; + + /* Field list used to be the username in X509 cert. */ +#ifdef ENABLE_X509ALTUSERNAME + char *x509_username_field[MAX_PARMS]; +#else + char *x509_username_field[2]; +#endif /* allow openvpn config info to be * passed over control channel */ diff --git a/src/openvpn/ssl_verify.c b/src/openvpn/ssl_verify.c index 844bc57d..33ca58dc 100644 --- a/src/openvpn/ssl_verify.c +++ b/src/openvpn/ssl_verify.c @@ -48,7 +48,7 @@ #include "push.h" /** Maximum length of common name */ -#define TLS_USERNAME_LEN 64 +#define TLS_USERNAME_LEN 128 static void string_mod_remap_name(char *str) @@ -640,6 +640,7 @@ verify_cert(struct tls_session *session, openvpn_x509_cert_t *cert, int cert_dep char common_name[TLS_USERNAME_LEN+1] = {0}; /* null-terminated */ const struct tls_options *opt; struct gc_arena gc = gc_new(); + size_t i, size; opt = session->opt; ASSERT(opt); @@ -660,19 +661,31 @@ verify_cert(struct tls_session *session, openvpn_x509_cert_t *cert, int cert_dep string_replace_leading(subject, '-', '_'); /* extract the username (default is CN) */ - if (SUCCESS != backend_x509_get_username(common_name, sizeof(common_name), - opt->x509_username_field, cert)) + size = sizeof(common_name); + for (i = 0; opt->x509_username_field[i] != NULL && size > !!i; i++) { - if (!cert_depth) + char *buf = common_name + sizeof(common_name) - size; + + if (SUCCESS != backend_x509_get_username(buf + !!i, size - !!i, + opt->x509_username_field[i], cert)) { - msg(D_TLS_ERRORS, "VERIFY ERROR: could not extract %s from X509 " - "subject string ('%s') -- note that the username length is " - "limited to %d characters", - opt->x509_username_field, - subject, - TLS_USERNAME_LEN); - goto cleanup; + break; + } + else if (i != 0) + { + *buf = X509_USERNAME_FIELD_DELIMITER; } + size -= strlen(buf); + } + if (cert_depth == 0 && opt->x509_username_field[i] != NULL) + { + msg(D_TLS_ERRORS, "VERIFY ERROR: could not extract %s from X509 " + "subject string ('%s') -- note that the username length is " + "limited to %d characters", + opt->x509_username_field[i], + subject, + TLS_USERNAME_LEN); + goto cleanup; } /* enforce character class restrictions in common name */ diff --git a/src/openvpn/ssl_verify_openssl.c b/src/openvpn/ssl_verify_openssl.c index ff14db23..ebff0c92 100644 --- a/src/openvpn/ssl_verify_openssl.c +++ b/src/openvpn/ssl_verify_openssl.c @@ -268,6 +268,21 @@ backend_x509_get_username(char *common_name, int cn_len, return FAILURE; } } + else if (strcmp(LN_serialNumber,x509_username_field) == 0) + { + ASN1_INTEGER *asn1_i = X509_get_serialNumber(peer_cert); + struct gc_arena gc = gc_new(); + char *serial; + + serial = format_hex_ex(asn1_i->data, asn1_i->length, 0, 1, NULL, &gc); + if (!serial || cn_len <= strlen(serial)+2) + { + gc_free(&gc); + return FAILURE; + } + openvpn_snprintf(common_name, cn_len, "0x%s", serial); + gc_free(&gc); + } else #endif if (FAILURE == extract_x509_field_ssl(X509_get_subject_name(peer_cert), From patchwork Mon Jul 27 12:13:41 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vladislav Grishenko X-Patchwork-Id: 1344 Return-Path: Delivered-To: patchwork@openvpn.net Delivered-To: patchwork@openvpn.net Received: from director12.mail.ord1d.rsapps.net ([172.31.255.6]) by backend30.mail.ord1d.rsapps.net with LMTP id 8ClHJuRWH19lYQAAIUCqbw for ; Mon, 27 Jul 2020 18:36:20 -0400 Received: from proxy14.mail.iad3b.rsapps.net ([172.31.255.6]) by director12.mail.ord1d.rsapps.net with LMTP id gADTJORWH1//cQAAIasKDg (envelope-from ) for ; Mon, 27 Jul 2020 18:36:20 -0400 Received: from smtp13.gate.iad3b ([172.31.255.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by proxy14.mail.iad3b.rsapps.net with LMTP id IHSZHeRWH1+gagAA+7ETDg ; Mon, 27 Jul 2020 18:36:20 -0400 X-Spam-Threshold: 95 X-Spam-Score: 0 X-Spam-Flag: NO X-Virus-Scanned: OK X-Orig-To: openvpnslackdevel@openvpn.net X-Originating-Ip: [216.105.38.7] Authentication-Results: smtp13.gate.iad3b.rsapps.net; iprev=pass policy.iprev="216.105.38.7"; spf=pass smtp.mailfrom="openvpn-devel-bounces@lists.sourceforge.net" smtp.helo="lists.sourceforge.net"; dkim=fail (signature verification failed) header.d=sourceforge.net; dkim=fail (signature verification failed) header.d=sf.net; dkim=fail (signature verification failed) header.d=yandex-team.ru; dmarc=fail (p=none; dis=none) header.from=yandex-team.ru X-Suspicious-Flag: YES X-Classification-ID: 9703bcb0-d059-11ea-94c6-5254001dfc40-1-1 Received: from [216.105.38.7] ([216.105.38.7:38716] helo=lists.sourceforge.net) by smtp13.gate.iad3b.rsapps.net (envelope-from ) (ecelerity 4.2.38.62370 r(:)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384) id 19/26-03150-3E65F1F5; Mon, 27 Jul 2020 18:36:20 -0400 Received: from [127.0.0.1] (helo=sfs-ml-2.v29.lw.sourceforge.com) by sfs-ml-2.v29.lw.sourceforge.com with esmtp (Exim 4.90_1) (envelope-from ) id 1k0BiL-0007b9-0J; Mon, 27 Jul 2020 22:35:21 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-2.v29.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.90_1) (envelope-from ) id 1k0BiJ-0007b1-AR for openvpn-devel@lists.sourceforge.net; Mon, 27 Jul 2020 22:35:19 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Message-Id:Date:Subject:To:From:Sender:Reply-To:Cc: MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=+UT/VTHLmTHie3IWRl1QCPvm+mYoiowHwDoPdi+Ffbg=; b=iyw8O5Xm+MTbUHSo7nKCg+rAoK 41MzAMveRgSCoX1JHIIZedQ6Qn0G1paY3wPUhv82A1B1KkRanCBZ/0KQ7lVeMRt9gDUnyeUB1Rvl3 mjo8xgxJFfHY9Rz+CCyvfF8sOq8iWi3EOwLjb1psuSAVZIxcz/QGCYGAjXuJYHYIMHaY=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Message-Id:Date:Subject:To:From:Sender:Reply-To:Cc:MIME-Version: Content-Type:Content-Transfer-Encoding:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=+UT/VTHLmTHie3IWRl1QCPvm+mYoiowHwDoPdi+Ffbg=; b=W3eeRU9r9/l7vFSH9SN1wLpgTn mEyAgN1EPGppRRBlx0eXCdTvHAfiLaefhk6atuuuRm2IVICakO+fbMRbCW8Vpapx0z4nHxO4Q0T9C x1281vcLZNY/+1LNf2/zf1BBeQEZCwkzSH3JXaXQ81BpcolyBF998knPo7w7lIaeYde0=; Received: from forwardcorp1p.mail.yandex.net ([77.88.29.217]) by sfi-mx-3.v28.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.92.2) id 1k0BiG-001Ugl-6c for openvpn-devel@lists.sourceforge.net; Mon, 27 Jul 2020 22:35:19 +0000 Received: from iva8-d077482f1536.qloud-c.yandex.net (iva8-d077482f1536.qloud-c.yandex.net [IPv6:2a02:6b8:c0c:2f26:0:640:d077:482f]) by forwardcorp1p.mail.yandex.net (Yandex) with ESMTP id 2D3752E14C5 for ; Tue, 28 Jul 2020 01:13:46 +0300 (MSK) Received: from iva4-7c3d9abce76c.qloud-c.yandex.net (iva4-7c3d9abce76c.qloud-c.yandex.net [2a02:6b8:c0c:4e8e:0:640:7c3d:9abc]) by iva8-d077482f1536.qloud-c.yandex.net (mxbackcorp/Yandex) with ESMTP id cMAZUt48zp-DjtGeBnW; Tue, 28 Jul 2020 01:13:46 +0300 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yandex-team.ru; s=default; t=1595888026; bh=+UT/VTHLmTHie3IWRl1QCPvm+mYoiowHwDoPdi+Ffbg=; h=Message-Id:Date:Subject:To:From; b=y5B5PuPvCjG5Cb0ia0jgz5QrddQzapuIs+HNfoThIhWJ7TLTJQg00j2UJwVVmQIC4 Pn/svzbtvqJbCVloAAsOMLr5VpyRMoN02AUBj1KZ5+pnCxulySWPPKv+JMn9LBG3Y6 8s5/l69jpSFVVKwk97/tuFB/Ssra6vAS7UhoB4Ik= Received: from unknown (unknown [178.154.220.35]) by iva4-7c3d9abce76c.qloud-c.yandex.net (smtpcorp/Yandex) with ESMTPSA id GY9BenkvxH-DjiG2g6C; Tue, 28 Jul 2020 01:13:45 +0300 (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (Client certificate not present) From: Vladislav Grishenko To: openvpn-devel@lists.sourceforge.net Date: Tue, 28 Jul 2020 03:13:41 +0500 Message-Id: <20200727221341.22544-2-themiron@yandex-team.ru> X-Mailer: git-send-email 2.17.1 X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. -0.0 SPF_PASS SPF: sender matches SPF record 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid X-Headers-End: 1k0BiG-001Ugl-6c Subject: [Openvpn-devel] [PATCH 2/2] Allow killing of client instances by cn with wildcards X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox In case of some permanent part of common name (ex. domain) and/or long complex common name consisting of multiple x509 fields, it's handly to kill client instances via management interface with just part of common name, not by exact match only. Patch allows to use wildcard placeholder '*' as the last trailing symbol of kill command parameter. Single '*' wildcard would be too greedy and can be too harmful, therefore not allowed. Wildcards in the middle of parameter string are not supported to keep the the things simple at the moment. Signed-off-by: Vladislav Grishenko --- doc/management-notes.txt | 2 ++ src/openvpn/multi.c | 6 +++++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/doc/management-notes.txt b/doc/management-notes.txt index 61daaf07..91073693 100644 --- a/doc/management-notes.txt +++ b/doc/management-notes.txt @@ -195,6 +195,8 @@ Command examples: kill Test-Client -- kill the client instance having a common name of "Test-Client". + kill Test-Cli* -- kill the client instances having a + common name starting with "Test-Cli". kill 1.2.3.4:4000 -- kill the client instance having a source address and port of 1.2.3.4:4000 diff --git a/src/openvpn/multi.c b/src/openvpn/multi.c index 9bda38b0..8952658a 100644 --- a/src/openvpn/multi.c +++ b/src/openvpn/multi.c @@ -3772,6 +3772,10 @@ management_callback_kill_by_cn(void *arg, const char *del_cn) struct hash_element *he; int count = 0; + /* Allow trailing wildcard */ + int len = strlen(del_cn); + len += (len > 1 && del_cn[len-1] == '*') ? -1 : 1; + hash_iterator_init(m->iter, &hi); while ((he = hash_iterator_next(&hi))) { @@ -3779,7 +3783,7 @@ management_callback_kill_by_cn(void *arg, const char *del_cn) if (!mi->halt) { const char *cn = tls_common_name(mi->context.c2.tls_multi, false); - if (cn && !strcmp(cn, del_cn)) + if (cn && !strncmp(cn, del_cn, len)) { multi_signal_instance(m, mi, SIGTERM); ++count;