[Openvpn-devel] Variable common_name can be blank in client-connect script

[Carlos Soto]

Author: Carlos Soto <carlos.soto at terra.es <mailto:carlos.s...@terra.es> >



Variable common_name can be blank in client-connect script



If a server is configured with auth-user-pass-optional and
username-as-common-name it is possible that the auth-user-pass-verify script
will validate a connection with no username as it is optional. It that case
the common_name becames blank and client-connect script may fail because it
does not have a value for the common name. I think that the common name
should never be blank so in cases where the username is blank and the
username-as-common-name option is enabled, the common_name should keep its
original value.





diff --git a/ssl.c b/ssl.c

index a1268ac..381ab07 100644

--- a/ssl.c

+++ b/ssl.c

@@ -3718,7 +3718,7 @@ key_method_2_read (struct buffer *buf, struct
tls_multi *multi, struct tls_sessi

          if (man_def_auth != KMDA_UNDEF)

            ks->auth_deferred = true;

 #endif

-         if ((session->opt->ssl_flags & SSLF_USERNAME_AS_COMMON_NAME))

+         if ((session->opt->ssl_flags & SSLF_USERNAME_AS_COMMON_NAME) &&
(strlen (up->username)))

            set_common_name (session, up->username);

 #ifdef ENABLE_DEF_AUTH

          msg (D_HANDSHAKE, "TLS: Username/Password authentication %s for
username '%s' %s",