From mboxrd@z Thu Jan  1 00:00:00 1970
From: Adolf Belka <adolf.belka@ipfire.org>
To: development@lists.ipfire.org
Subject: [PATCH] vpnmain.cgi: Fixes bug#13138 - root/host certificate set
 fails to be created
Date: Sat, 03 Jun 2023 16:05:41 +0200
Message-ID: <20230603140541.13834-1-adolf.belka@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============1640543035384109672=="
List-Id: <development.lists.ipfire.org>

--===============1640543035384109672==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

- The change to openssl-3.x results in the openssl commands that start with c=
a failing
   with the error message
     OpenSSL produced an error: <br>40E7B4719B730000:error:0700006C:configura=
tion file
     routines:NCONF_get_string:no value:crypto/conf/conf_lib.c:315:group=3D<N=
ULL>
     name=3Dunique_subject
- The fix for this is to include the unique_subject =3D yes line into
   /var/ipfire/certs/index.txt.attr
- Additionally, based on the learnings from bug#13137 on OpenVPN, any openssl=
 commands
   dealing with pkcs12 (.p12) files that were created with openssl-1.1.1x fai=
l when being
   accessed with openssl-3.x due to the no longer supported algorithm. These =
can be
   accessed if the -legacy option is added to every openssl command dealing w=
ith pkcs12

Fixes: Bug#13138
Tested-by: Adolf Belka <adolf.belka(a)ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org>
---
 html/cgi-bin/vpnmain.cgi | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi
index 6c1fd4cf0..f2aeecdf9 100644
--- a/html/cgi-bin/vpnmain.cgi
+++ b/html/cgi-bin/vpnmain.cgi
@@ -193,7 +193,7 @@ sub cleanssldatabase {
 		close FILE;
 	}
 	if (open(FILE, ">${General::swroot}/certs/index.txt.attr")) {
-		print FILE "";
+		print FILE "unique_subject =3D yes";
 		close FILE;
 	}
 	unlink ("${General::swroot}/certs/index.txt.old");
@@ -213,6 +213,7 @@ sub newcleanssldatabase {
 	}
 	if (! -s ">${General::swroot}/certs/index.txt.attr") {
 		open(FILE, ">${General::swroot}/certs/index.txt.attr");
+		print FILE "unique_subject =3D yes";
 		close(FILE);
 	}
 	unlink ("${General::swroot}/certs/index.txt.old");
@@ -907,7 +908,7 @@ END
 		# Extract the CA certificate from the file
 		&General::log("ipsec", "Extracting caroot from p12...");
 		if (open(STDIN, "-|")) {
-			my $opt =3D " pkcs12 -cacerts -nokeys";
+			my $opt =3D " pkcs12 -legacy -cacerts -nokeys";
 			$opt .=3D " -in $filename";
 			$opt .=3D " -out /tmp/newcacert";
 			$errormessage =3D &callssl ($opt);
@@ -920,7 +921,7 @@ END
 		if (!$errormessage) {
 			&General::log("ipsec", "Extracting host cert from p12...");
 			if (open(STDIN, "-|")) {
-				my $opt =3D " pkcs12 -clcerts -nokeys";
+				my $opt =3D " pkcs12 -legacy -clcerts -nokeys";
 				$opt .=3D " -in $filename";
 				$opt .=3D " -out /tmp/newhostcert";
 				$errormessage =3D &callssl ($opt);
@@ -934,7 +935,7 @@ END
 		if (!$errormessage) {
 			&General::log("ipsec", "Extracting private key from p12...");
 			if (open(STDIN, "-|")) {
-				my $opt =3D " pkcs12 -nocerts -nodes";
+				my $opt =3D " pkcs12 -legacy -nocerts -nodes";
 				$opt .=3D " -in $filename";
 				$opt .=3D " -out /tmp/newhostkey";
 				$errormessage =3D &callssl ($opt);
@@ -1939,7 +1940,7 @@ END
 		# Extract the CA certificate from the file
 		&General::log("ipsec", "Extracting caroot from p12...");
 		if (open(STDIN, "-|")) {
-			my $opt =3D " pkcs12 -cacerts -nokeys";
+			my $opt =3D " pkcs12 -legacy -cacerts -nokeys";
 			$opt .=3D " -in $filename";
 			$opt .=3D " -out /tmp/newcacert";
 			$errormessage =3D &callssl ($opt);
@@ -1952,7 +1953,7 @@ END
 		if (!$errormessage) {
 			&General::log("ipsec", "Extracting host cert from p12...");
 			if (open(STDIN, "-|")) {
-				my $opt =3D " pkcs12 -clcerts -nokeys";
+				my $opt =3D " pkcs12 -legacy -clcerts -nokeys";
 				$opt .=3D " -in $filename";
 				$opt .=3D " -out /tmp/newhostcert";
 				$errormessage =3D &callssl ($opt);
@@ -2197,7 +2198,7 @@ END
=20
 		# Create the pkcs12 file
 		&General::log("ipsec", "Packing a pkcs12 file...");
-		$opt =3D " pkcs12 -export";
+		$opt =3D " pkcs12 -legacy -export";
 		$opt .=3D " -inkey ${General::swroot}/certs/$cgiparams{'NAME'}key.pem";
 		$opt .=3D " -in ${General::swroot}/certs/$cgiparams{'NAME'}cert.pem";
 		$opt .=3D " -name \"$cgiparams{'NAME'}\"";
--=20
2.40.1


--===============1640543035384109672==--