diff options
| author | Steffan Karger | 2017-06-19 11:28:39 +0200 |
|---|---|---|
| committer | Gert Doering | 2017-06-19 20:03:24 +0200 |
| commit | b72472baa5f228acf211542a7511f6960479f4c8 (patch) | |
| tree | acd7df1f375e4fdd583bff53803b15654cb401f5 /src/openvpn/options.c | |
| parent | 2341f716198fa90193e040b3fdb16959a47c6c27 (diff) | |
| download | openvpn-b72472baa5f228acf211542a7511f6960479f4c8.zip openvpn-b72472baa5f228acf211542a7511f6960479f4c8.tar.gz | |
Restrict --x509-alt-username extension types
The code never supported all extension types. Make this explicit by only
allowing subjectAltName and issuerAltName (for which the current code does
work).
Using unsupported extension fields would most likely cause OpenVPN to crash
as soon as a client connects. This does not have a real-world security
impact, as such a configuration would not be possible to use in practice.
This bug was discovered, analysed and reported to the OpenVPN team by
Guido Vranken.
Signed-off-by: Steffan Karger <steffan.karger@fox-it.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Acked-by: David Sommerseth <davids@openvpn.net>
Acked-by: Guido Vranken <guidovranken@gmail.com>
Message-Id: <1497864520-12219-5-git-send-email-steffan.karger@fox-it.com>
URL: https://www.mail-archive.com/search?l=mid&q=1497864520-12219-5-git-send-email-steffan.karger@fox-it.com
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit d2a19185fd78030ce4a1bba6c9f83e0dac9e15a6)
Diffstat (limited to 'src/openvpn/options.c')
| -rw-r--r-- | src/openvpn/options.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/src/openvpn/options.c b/src/openvpn/options.c index 5248b06..fef5e90 100644 --- a/src/openvpn/options.c +++ b/src/openvpn/options.c @@ -8099,6 +8099,10 @@ add_option(struct options *options, "configuration", p[1]); } } + else if (!x509_username_field_ext_supported(s+4)) + { + msg(msglevel, "Unsupported x509-username-field extension: %s", s); + } options->x509_username_field = p[1]; } #endif /* ENABLE_X509ALTUSERNAME */ |