Deprecate --ns-cert-type

This is a manual cherry-pick of commit 2dc33226 of the master branch,
for the release/2.3 branch.

The nsCertType x509 extension is very old, and barely used.  We already
have had an alternative for a long time: --remote-cert-tls uses the far
more common keyUsage and extendedKeyUsage extensions instead.

OpenSSL 1.1 no longer exposes an API to (separately) check the nsCertType
x509 extension.  Since we want be able to migrate to OpenSSL 1.1, we
should deprecate this option immediately.

Trac: #876

Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: David Sommerseth <davids@openvpn.net>
Message-Id: <1502222447-8186-1-git-send-email-steffan@karger.me>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15180.html
Signed-off-by: David Sommerseth <davids@openvpn.net>

diff --git a/Changes.rst b/Changes.rst
index b9fe6d512bf4e6f9aabd3e5afe001527a2a48161..3d164b945b2d2930be3bd69f0dbbee47c4d6163b 100644 (file)
--- a/Changes.rst
+++ b/Changes.rst
@@ -105,6 +105,18 @@ Behavioral changes
 - Do not randomize resolving of IP addresses in getaddr()
 
 
+Version 2.3.18
+==============
+
+Deprecated features
+-------------------
+- ``--ns-cert-type`` is deprecated.  Use ``--remote-cert-tls`` instead.
+  The nsCertType x509 extension is very old, and barely used.
+  ``--remote-cert-tls`` uses the far more common keyUsage and extendedKeyUsage
+  extension instead.  Make sure your certificates carry these to be able to
+  use ``--remote-cert-tls``.
+
+
 Version 2.3.17
 ==============
 

diff --git a/doc/openvpn.8 b/doc/openvpn.8
index 109afe66717bf3f5ebc396e47f6f2f97159a6e62..c6389f1c7de602a681a2763f8fcc55194e943d4f 100644 (file)
--- a/doc/openvpn.8
+++ b/doc/openvpn.8
@@ -324,7 +324,7 @@ http-proxy-retry
 persist-key
 persist-tun
 pkcs12 client.p12
-ns-cert-type server
+remote-cert-tls server
 verb 3
 .in -4
 .ft
@@ -5094,7 +5094,11 @@ options can be defined to track multiple attributes.
 Not available with PolarSSL.
 .\"*********************************************************
 .TP
-.B \-\-ns\-cert\-type client|server
+.B \-\-ns\-cert\-type client|server (DEPRECATED)
+This option is deprecated.  Use the more modern equivalent
+.B \-\-remote\-cert\-tls
+instead.  This option will be removed in OpenVPN 2.5.
+
 Require that peer certificate was signed with an explicit
 .B nsCertType
 designation of "client" or "server".

diff --git a/src/openvpn/init.c b/src/openvpn/init.c
index c6546e6999a1177e909bdb822bb7fef880004c2d..f676b5120f7fbbaf606641e874c9eb910337103c 100644 (file)
--- a/src/openvpn/init.c
+++ b/src/openvpn/init.c
@@ -2591,6 +2591,10 @@ do_option_warnings (struct context *c)
       && !(o->ns_cert_type & NS_CERT_CHECK_SERVER)
       && !o->remote_cert_eku)
     msg (M_WARN, "WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.");
+  if (o->ns_cert_type)
+    {
+      msg(M_WARN, "WARNING: --ns-cert-type is DEPRECATED.  Use --remote-cert-tls instead.");
+    }
 #endif
 #endif
 

diff --git a/src/openvpn/options.c b/src/openvpn/options.c
index 6faa280825bc3291c0c586529b09f1ecbf9835e1..20ca37ee430a5f02c89efd2ff44b2a5cfa02a77a 100644 (file)
--- a/src/openvpn/options.c
+++ b/src/openvpn/options.c
@@ -622,8 +622,8 @@ static const char usage_message[] =
   "--verify-x509-name name: Accept connections only from a host with X509 subject\n"
   "                  DN name. The remote host must also pass all other tests\n"
   "                  of verification.\n"
-  "--ns-cert-type t: Require that peer certificate was signed with an explicit\n"
-  "                  nsCertType designation t = 'client' | 'server'.\n"
+  "--ns-cert-type t: (DEPRECATED) Require that peer certificate was signed with \n"
+  "                  an explicit nsCertType designation t = 'client' | 'server'.\n"
 #ifdef ENABLE_X509_TRACK
   "--x509-track x  : Save peer X509 attribute x in environment for use by\n"
   "                  plugins and management interface.\n"

diff --git a/tests/t_client.rc-sample b/tests/t_client.rc-sample
index 59f34c7f27ebb7a91a6835d0aa334a029c74d7b8..78b0ebbc60bb23fe96d1467df1706557521118f1 100644 (file)
--- a/tests/t_client.rc-sample
+++ b/tests/t_client.rc-sample
@@ -39,7 +39,7 @@ TEST_RUN_LIST="1 2"
 #
 OPENVPN_BASE_P2MP="--client --ca $CA_CERT \
        --cert $CLIENT_CERT --key $CLIENT_KEY \
-       --ns-cert-type server --nobind --comp-lzo --verb 3"
+       --remote-cert-tls server --nobind --comp-lzo --verb 3"
 
 # base config for p2p tests
 #