]> git.ipfire.org Git - thirdparty/openvpn.git/commit
Ensure the current common_name is in the environment for scripts
authorSelva Nair <selva.nair@gmail.com>
Sat, 23 Oct 2021 00:07:05 +0000 (20:07 -0400)
committerGert Doering <gert@greenie.muc.de>
Sat, 23 Oct 2021 15:39:50 +0000 (17:39 +0200)
commitfa5ab2438ad2d8a12eaf43e2cdd8b4294299c175
tree6f1711f75a5231f12522295b58d2569b7164b161
parente23c152aa58f533a224df4bc3d433e2be967f64b
Ensure the current common_name is in the environment for scripts

When username-as-common-name is in effect, the common_name
is "CN" from the certificate for auth-user-pass-verify. It gets
changed to "username" after successful authentication. This
changed value gets into the env when client-connect script is
called.

However, "common_name" goes through the cycle of being
"CN", then "username" during every reauth (renegotiation).
As the client-connect script is not called during reneg, the changed
value never gets back into the env. The end result is that the
disconnect script gets "common_name=<CN>" instead of the username.
Unless no reneg steps have happened before disconnect.
(For a more detailed analysis see
https://community.openvpn.net/openvpn/ticket/1434#comment:12)

Fix by adding common_name to env whenever it changes.

Trac: #1434
Very likely applies to #160 as well, but that's too old and
some of the relevant code path has evolved since then.

Signed-off-by: Selva Nair <selva.nair@gmail.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20211023000706.25016-1-selva.nair@gmail.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23051.html
Signed-off-by: Gert Doering <gert@greenie.muc.de>
src/openvpn/ssl_verify.c