This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree".

The branch, next has been updated via c6556649c67e7cadfb16cb91c5c75534acc336b0 (commit) from ada69e1271313afb3124c97427bedec9759fb913 (commit)

Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below.

- Log ----------------------------------------------------------------- commit c6556649c67e7cadfb16cb91c5c75534acc336b0 Author: Michael Tremer michael.tremer@ipfire.org Date: Sat May 4 20:33:15 2013 +0200

openvpn: Rewrite the vertificate verify script in perl.

The current shell implementation is not strict with the certificate common names and does not check all the requirements for the connection to be accepted.

-----------------------------------------------------------------------

Summary of changes: config/ovpn/verify | 70 ++++++++++++++++++++++++++------ config/rootfiles/core/68/filelists/files | 1 + 2 files changed, 59 insertions(+), 12 deletions(-)

Difference in files: diff --git a/config/ovpn/verify b/config/ovpn/verify index 8fbe59e..7233429 100644 --- a/config/ovpn/verify +++ b/config/ovpn/verify @@ -1,12 +1,58 @@ -#!/bin/sh -if [ $1 -eq 0 ]; then - name2=`echo $2` - name3=${name2##*/} - name4=${name3##*CN=} - clientdisabled=`/bin/grep -iwc off,.*,$name4 /var/ipfire/ovpn/ovpnconfig` - if [ "$clientdisabled" = "1" ]; then - exit 1 - fi - exit 0 -fi -exit 0 +#!/usr/bin/perl +############################################################################ +# # +# This file is part of the IPFire Firewall. # +# # +# IPFire is free software; you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation; either version 2 of the License, or # +# (at your option) any later version. # +# # +# IPFire is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with IPFire; if not, write to the Free Software # +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # +# # +# Copyright (C) 2013 IPFire Team info@ipfire.org. # +# # +############################################################################ + +require '/var/ipfire/general-functions.pl'; + +my $DEPTH = $ARGV[0]; +my $CN = $ARGV[1]; + +# Exit immediately for every certificate depth other than 0. +exit 0 unless ($DEPTH eq "0"); + +# Strip the CN from the X509 identifier. +$CN =~ //CN=(.*)$/i; +$CN = $1; + +my %confighash = (); +if (-f "${General::swroot}/ovpn/ovpnconfig"){ + &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", %confighash); + foreach my $key (keys %confighash) { + my $cn = $confighash{$key}[2]; + + # Skip disabled connections. + next unless ($confighash{$key}[0] eq "on"); + + # Skip non-roadwarrior connections. + next unless ($confighash{$key}[3] eq "host"); + + # Search for a matching CN. + exit 0 if ($cn eq $CN); + + # Compatibility code for incorrectly saved CNs. + $cn =~ s/\ /_/; + exit 0 if ($cn eq $CN); + } +} + +# Return an error if ovpnconfig could not be found. +exit 1; diff --git a/config/rootfiles/core/68/filelists/files b/config/rootfiles/core/68/filelists/files index 65e46ae..c96e7cf 100644 --- a/config/rootfiles/core/68/filelists/files +++ b/config/rootfiles/core/68/filelists/files @@ -44,3 +44,4 @@ var/ipfire/backup/include var/ipfire/header.pl var/ipfire/general-functions.pl var/ipfire/langs +var/ipfire/ovpn/verify

hooks/post-receive -- IPFire 2.x development tree