From: Heiko Hund Date: Fri, 22 Feb 2013 09:44:21 +0000 (+0100) Subject: make --tls-remote compatible with pre 2.3 configs X-Git-Tag: v2.3.1~18 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0f92b3b4170dab29aaf5cb4e6a0d00d37bf418b4;p=thirdparty%2Fopenvpn.git make --tls-remote compatible with pre 2.3 configs In openvpn 2.3.0 the semantics of the --tls-remote option changed. That broke more configurations than anticipated. To not break configurations that use --tls-remote with a legacy OpenSSL style DN anymore, it is now detected when such a DN is configured. When necessary the --compat-names option is then automatically enabled. Signed-off-by: Heiko Hund Acked-by: Arne Schwabe Message-Id: 1361526263-1740-3-git-send-email-heiko.hund@sophos.com URL: http://article.gmane.org/gmane.network.openvpn.devel/7366 Signed-off-by: Gert Doering (cherry picked from commit ad532bba896875e56488e69ec16212a77787c57b) --- diff --git a/src/openvpn/options.c b/src/openvpn/options.c index dd38bc97a..7fda76f5f 100644 --- a/src/openvpn/options.c +++ b/src/openvpn/options.c @@ -6528,6 +6528,12 @@ add_option (struct options *options, else if (streq (p[0], "tls-remote") && p[1]) { VERIFY_PERMISSION (OPT_P_GENERAL); + /* + * Enable legacy openvpn format for DNs that have not been converted + * yet and X.509 common names (not containing an '=' or ', ') + */ + if (p[1][0] == '/' || !strchr (p[1], '=') || !strstr (p[1], ", ")) + compat_flag (COMPAT_FLAG_SET | COMPAT_NAMES); options->tls_remote = p[1]; } else if (streq (p[0], "ns-cert-type") && p[1])