From mboxrd@z Thu Jan  1 00:00:00 1970
From: Adolf Belka <adolf.belka@ipfire.org>
To: development@lists.ipfire.org
Subject: [PATCH 1/2] ovpnmain.cgi: Fixes Bug#13137 - Existing n2n client
 connection created with openssl-1.1.1x fails to start with openssl-3.x
Date: Sun, 04 Jun 2023 20:57:08 +0200
Message-ID: <20230604185709.8088-1-adolf.belka@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============1831326196344423826=="
List-Id: <development.lists.ipfire.org>

--===============1831326196344423826==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

- With a n2n connection .p12 certificate created wityh openssl-1.1.1x the line
   providers legacy default is required in the n2nconf file to enable it to s=
tart.
- Any openssl-3.x attempt to open a .p12 file created with openssl-1.1.1x wil=
l result in
   a failure and an error message. All the openssl commands dealing with pkcs=
12 (.p12)
   files need to have the -legacy option added to them.

Fixes: Bug#13137
Tested-by: Adolf Belka <adolf.belka(a)ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org>
---
 html/cgi-bin/ovpnmain.cgi | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi
index 5c4fad0a5..88106251e 100755
--- a/html/cgi-bin/ovpnmain.cgi
+++ b/html/cgi-bin/ovpnmain.cgi
@@ -1115,6 +1115,7 @@ unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'=
NAME'}"){mkdir "${General
   print CLIENTCONF "# Activate Management Interface and Port\n";
   if ($cgiparams{'OVPN_MGMT'} eq '') {print CLIENTCONF "management localhost=
 $cgiparams{'DEST_PORT'}\n"}
   else {print CLIENTCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
+  print CLIENTCONF "providers legacy default\n";
   close(CLIENTCONF);
=20
 }
@@ -1648,7 +1649,7 @@ END
 		goto ROOTCERT_ERROR;
 	    }
 	} else {	# child
-	    unless (exec ('/usr/bin/openssl', 'pkcs12', '-cacerts', '-nokeys',
+	    unless (exec ('/usr/bin/openssl', 'pkcs12', '-legacy', '-cacerts', '-no=
keys',
 		    '-in', $filename,
 		    '-out', "$tempdir/cacert.pem")) {
 		$errormessage =3D "$Lang::tr{'cant start openssl'}: $!";
@@ -1671,7 +1672,7 @@ END
 		goto ROOTCERT_ERROR;
 	    }
 	} else {	# child
-	    unless (exec ('/usr/bin/openssl', 'pkcs12', '-clcerts', '-nokeys',
+	    unless (exec ('/usr/bin/openssl', 'pkcs12', '-legacy', '-clcerts', '-no=
keys',
 		    '-in', $filename,
 		    '-out', "$tempdir/hostcert.pem")) {
 		$errormessage =3D "$Lang::tr{'cant start openssl'}: $!";
@@ -1694,7 +1695,7 @@ END
 		goto ROOTCERT_ERROR;
 	    }
 	} else {	# child
-	    unless (exec ('/usr/bin/openssl', 'pkcs12', '-nocerts',
+	    unless (exec ('/usr/bin/openssl', 'pkcs12', '-legacy', '-nocerts',
 		    '-nodes',
 		    '-in', $filename,
 		    '-out', "$tempdir/serverkey.pem")) {
@@ -2156,6 +2157,7 @@ if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
    if ($confighash{$cgiparams{'KEY'}}[22] eq '') {print CLIENTCONF "manageme=
nt localhost $confighash{$cgiparams{'KEY'}}[29]\n"}
     else {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY=
'}}[22]\n"};
    print CLIENTCONF "# remsub $confighash{$cgiparams{'KEY'}}[11]\n";
+   print CLIENTCONF "providers legacy default\n";
=20
=20
     close(CLIENTCONF);
@@ -3296,6 +3298,7 @@ END
 	print FILE "# Logfile\n";
 	print FILE "status-version 1\n";
 	print FILE "status /var/run/openvpn/$n2nname[0]-n2n 10\n";
+	print FILE "providers legacy default\n";
 	close FILE;
=20
 	unless(move("$tempdir/$uplconffilename", "${General::swroot}/ovpn/n2nconf/$=
n2nname[0]/$uplconffilename2")) {
@@ -4242,7 +4245,7 @@ if ($cgiparams{'TYPE'} eq 'net') {
=20
 	    # Create the pkcs12 file
 	    # The system call is safe, because all arguments are passed as an array.
-	    system('/usr/bin/openssl', 'pkcs12', '-export',
+	    system('/usr/bin/openssl', 'pkcs12', '-legacy', '-export',
 		'-inkey', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem",
 		'-in', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
 		'-name', $cgiparams{'NAME'},
--=20
2.40.1


--===============1831326196344423826==--