From mboxrd@z Thu Jan  1 00:00:00 1970
From: Michael Tremer <michael.tremer@ipfire.org>
To: development@lists.ipfire.org
Subject: Re: [PATCH v3 1/3] vpnmain.cgi: set SubjectAlternativeName default
 during root certificate generation
Date: Wed, 08 Jan 2020 10:58:12 +0000
Message-ID: <B273EBE4-ADAD-48F5-9107-1648FC9076DD@ipfire.org>
In-Reply-To: <09672616-f2e0-2f1e-6d38-a30d5d70dae5@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============2093090203202048672=="
List-Id: <development.lists.ipfire.org>

--===============2093090203202048672==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Hi,

I am not sure about the change of behaviour here.

I thought the consensus in the telephone conference was to always set it to t=
he FQDN of the IPFire box and accept any additional values from the user. So =
it will always be set.

The code looks like it does not do that.

Did I get it wrong what we agreed on in the end?

-Michael

> On 7 Jan 2020, at 21:47, Peter M=C3=BCller <peter.mueller(a)ipfire.org> wro=
te:
>=20
> Some IPsec implementations such as OpenIKED require SubjectAlternativeName
> data on certificates and refuse to establish connections otherwise.
>=20
> The StrongSwan project also recommends it (see:
> https://wiki.strongswan.org/projects/strongswan/wiki/SimpleCA) although
> it is currently not enforced by their IPsec software.
>=20
> For convenience purposes and to raise awareness, this patch adds a default
> SubjectAlternativeName based on the machines hostname or IP address. Existi=
ng
> certificates remain unchanged for obvious reasons.
>=20
> The third version of this patch fixes a duplicate DNS query reported by Mic=
hael.
>=20
> Fixes #11594
>=20
> Signed-off-by: Peter M=C3=BCller <peter.mueller(a)ipfire.org>
> Cc: Michael Tremer <michael.tremer(a)ipfire.org>
> ---
> html/cgi-bin/vpnmain.cgi | 11 +++++++++--
> 1 file changed, 9 insertions(+), 2 deletions(-)
>=20
> diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi
> index 33b504bc9..43cdc5aa0 100644
> --- a/html/cgi-bin/vpnmain.cgi
> +++ b/html/cgi-bin/vpnmain.cgi
> @@ -2,7 +2,7 @@
> ###########################################################################=
####
> #                                                                          =
   #
> # IPFire.org - A linux based firewall                                      =
   #
> -# Copyright (C) 2007-2019  IPFire Team  info(a)ipfire.org                 =
      #
> +# Copyright (C) 2007-2020  IPFire Team  <info(a)ipfire.org>               =
      #
> #                                                                          =
   #
> # This program is free software: you can redistribute it and/or modify     =
   #
> # it under the terms of the GNU General Public License as published by     =
   #
> @@ -822,8 +822,10 @@ END
> 			close IPADDR;
> 			chomp ($ipaddr);
> 			$cgiparams{'ROOTCERT_HOSTNAME'} =3D (gethostbyaddr(pack("C4", split(/\./=
, $ipaddr)), 2))[0];
> +			$cgiparams{'SUBJECTALTNAME'} =3D "DNS:" . $cgiparams{'ROOTCERT_HOSTNAME=
'};
> 			if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') {
> 				$cgiparams{'ROOTCERT_HOSTNAME'} =3D $ipaddr;
> +				$cgiparams{'SUBJECTALTNAME'} =3D "IP:" . $cgiparams{'ROOTCERT_HOSTNAME=
'};
> 			}
> 		}
> 		$cgiparams{'ROOTCERT_COUNTRY'} =3D $vpnsettings{'ROOTCERT_COUNTRY'} if (!=
$cgiparams{'ROOTCERT_COUNTRY'});
> @@ -975,6 +977,11 @@ END
> 		#	IP: an IP address
> 		# example: email:franck(a)foo.com,IP:10.0.0.10,DNS:franck.foo.com
>=20
> +		if ($cgiparams{'SUBJECTALTNAME'} eq '') {
> +			$errormessage =3D $Lang::tr{'vpn subjectaltname missing'};
> +			goto ROOTCERT_ERROR;
> +		}
> +
> 		if ($cgiparams{'SUBJECTALTNAME'} ne '' && $cgiparams{'SUBJECTALTNAME'} !~=
 /^(email|URI|DNS|RID|IP):[a-zA-Z0-9 :\/,\.\-_@]*$/) {
> 			$errormessage =3D $Lang::tr{'vpn altname syntax'};
> 			goto VPNCONF_ERROR;
> @@ -1129,7 +1136,7 @@ END
> 	}
> 	print <<END
> 		</select></td></tr>
> -	<tr><td class=3D'base'>$Lang::tr{'vpn subjectaltname'} (subjectAltName=3D=
email:*,URI:*,DNS:*,RID:*)</td>
> +	<tr><td class=3D'base'>$Lang::tr{'vpn subjectaltname'} (subjectAltName=3D=
email:*,URI:*,DNS:*,RID:*)&nbsp;<img src=3D'/blob.gif' alt=3D'*' /></td>
> 	<td class=3D'base' nowrap=3D'nowrap'><input type=3D'text' name=3D'SUBJECTA=
LTNAME' value=3D'$cgiparams{'SUBJECTALTNAME'}' size=3D'32' /></td></tr>
> 	<tr><td>&nbsp;</td>
> 		<td><br /><input type=3D'submit' name=3D'ACTION' value=3D'$Lang::tr{'gene=
rate root/host certificates'}' /><br /><br /></td></tr>
> --=20
> 2.16.4
>=20


--===============2093090203202048672==--