Replace leading dash ('-') characters in an X509 name with underbars ('_')

before calling user-defined scripts, to preclude the chance of a leading
dash being interpreted as an option prefix.

git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@3083 e7ae566f-a301-0410-adde-c780ea21d3b5

diff --git a/buffer.c b/buffer.c
index 8febc911b0f5207fac325a78b32600b28f47b905..c90ff9f5055fe9b37b03b79a4933a6c3a4722210 100644 (file)
--- a/buffer.c
+++ b/buffer.c
@@ -804,6 +804,20 @@ string_mod_const (const char *str,
     return NULL;
 }
 
+void
+string_replace_leading (char *str, const char match, const char replace)
+{
+  ASSERT (match != '\0');
+  while (*str)
+    {
+      if (*str == match)
+       *str = replace;
+      else
+       break;
+      ++str;
+    }
+}
+
 #ifdef CHARACTER_CLASS_DEBUG
 
 #define CC_INCLUDE    (CC_PRINT)

diff --git a/buffer.h b/buffer.h
index d8ef00ffbdf2f14fd46eec5fb25c88cf45894a28..8888869159e84cec71df413a4f5098a23306d2b0 100644 (file)
--- a/buffer.h
+++ b/buffer.h
@@ -615,6 +615,8 @@ const char *string_mod_const (const char *str,
                              const char replace,
                              struct gc_arena *gc);
 
+void string_replace_leading (char *str, const char match, const char replace);
+
 #ifdef CHARACTER_CLASS_DEBUG
 void character_class_debug (void);
 #endif

diff --git a/ssl.c b/ssl.c
index bbb998bbb3c8e5823bc91644e34a89b8da95d73b..9f7aa9d201534cac7e30b05c6ab25aaf85b476e5 100644 (file)
--- a/ssl.c
+++ b/ssl.c
@@ -554,6 +554,9 @@ verify_callback (int preverify_ok, X509_STORE_CTX * ctx)
 
   /* enforce character class restrictions in X509 name */
   string_mod (subject, X509_NAME_CHAR_CLASS, 0, '_');
+  string_replace_leading (subject, '-', '_');
+
+  msg (M_INFO, "X509: '%s'", subject); // JYFIXME
 
   /* extract the common name */
 #ifdef USE_OLD_EXTRACT_X509_FIELD