[Openvpn-devel] Script interface to trigger events depending on the validity of a certificate

[Openvpn-devel] Script interface to trigger events depending on the validity of a certificate

[Till Maas]

[-- Attachment #1: Type: text/plain, Size: 395 bytes --]

Hello,

I would like to get a notification in case a client certificate is used
for a connection to an OpenVPN server, that is about to expire soon. Is
there currently a way to do this? I looked into the tls-verify hook, but
according to the documentation, only the Subject line of a certificate
is available and not the validity. Is there maybe a way to log the
expiration dates?

Regards
Till

[-- Attachment #2: Type: application/pgp-signature, Size: 835 bytes --]

Re: [Openvpn-devel] Script interface to trigger events depending on the validity of a certificate

[David Sommerseth]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/11/09 17:16, Till Maas wrote:
> I would like to get a notification in case a client certificate is used
> for a connection to an OpenVPN server, that is about to expire soon. Is
> there currently a way to do this? I looked into the tls-verify hook, but
> according to the documentation, only the Subject line of a certificate
> is available and not the validity. Is there maybe a way to log the
> expiration dates?

I don't think this is possible without patching openvpn to put these
values into some environment variables for the --tls-verify hook.  I've
done something similar in regards to the SHA1 fingerprint for my own
project (I have had an OpenVPN patch pending since RC7).  But I'd be
willing to carry such a feature in my eurephia patch for OpenVPN, as
that sounds very useful.


kind regards,

David Sommerseth



-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEUEARECAAYFAkr6eJgACgkQDC186MBRfrq6NACVESQtnCHS/SljNEAMXdR4xNmY
5gCfbRyDvGgJDguKhCIm3kiLaID6V1g=
=wjKX
-----END PGP SIGNATURE-----

Re: [Openvpn-devel] Script interface to trigger events depending on the validity of a certificate

[Victor Wagner]

On 2009.11.11 at 09:40:59 +0100, David Sommerseth wrote:

> On 10/11/09 17:16, Till Maas wrote:
> > I would like to get a notification in case a client certificate is used
> > for a connection to an OpenVPN server, that is about to expire soon. Is
> > there currently a way to do this? I looked into the tls-verify hook, but
> > according to the documentation, only the Subject line of a certificate
> > is available and not the validity. Is there maybe a way to log the
> > expiration dates?
> 
> I don't think this is possible without patching openvpn to put these
> values into some environment variables for the --tls-verify hook.  I've
> done something similar in regards to the SHA1 fingerprint for my own
> project (I have had an OpenVPN patch pending since RC7).  But I'd be
> willing to carry such a feature in my eurephia patch for OpenVPN, as
> that sounds very useful.

Apache/mod_ssl does export entire certificate in the PEM format as
environment variable. So, may be openvpn sould do the same?

Now various people patching openvpn to add some values:
you've added sha1 fingerprint, I've added certificate extension
subjectAltName, et cetera, et cetera.

But if entire certificate would be available, it would be possible to
extract any information from it (or hash it with any algorithm) from the
script using openssl command line utility or some binding or OpenSSL
libraries to the choosen script language.

Re: [Openvpn-devel] Script interface to trigger events depending on the validity of a certificate

[Mathieu GIANNECCHINI]

Victor Wagner a écrit :
> On 2009.11.11 at 09:40:59 +0100, David Sommerseth wrote:
>
>   
>> On 10/11/09 17:16, Till Maas wrote:
>>     
>>> I would like to get a notification in case a client certificate is used
>>> for a connection to an OpenVPN server, that is about to expire soon. Is
>>> there currently a way to do this? I looked into the tls-verify hook, but
>>> according to the documentation, only the Subject line of a certificate
>>> is available and not the validity. Is there maybe a way to log the
>>> expiration dates?
>>>       
>> I don't think this is possible without patching openvpn to put these
>> values into some environment variables for the --tls-verify hook.  I've
>> done something similar in regards to the SHA1 fingerprint for my own
>> project (I have had an OpenVPN patch pending since RC7).  But I'd be
>> willing to carry such a feature in my eurephia patch for OpenVPN, as
>> that sounds very useful.
>>     
>
> Apache/mod_ssl does export entire certificate in the PEM format as
> environment variable. So, may be openvpn sould do the same?
>
> Now various people patching openvpn to add some values:
> you've added sha1 fingerprint, I've added certificate extension
> subjectAltName, et cetera, et cetera.
>
> But if entire certificate would be available, it would be possible to
> extract any information from it (or hash it with any algorithm) from the
> script using openssl command line utility or some binding or OpenSSL
> libraries to the choosen script language.
>   

Ok, i try once again. Maybe the solution is here :
http://article.gmane.org/gmane.network.openvpn.devel/2492

Re: [Openvpn-devel] Script interface to trigger events depending on the validity of a certificate

[Jonathan Petersson]

This may not be a preferable approach but it should do the trick for you.

Upon connection the OpenVPN client reports it's common_name through
environmental variables: "The X509 common name of an authenticated
client. Set prior to execution of --client-connect,
--client-disconnect, and --auth-user-pass-verify scripts."

As it's doing this you can trigger a client-connect script to retrieve
the "Validity Not After" data from the client-cert (if you have a
local copy on the server) if the time-frame is out of realms trigger
sendmail or preferable mail-daemon to send an email to you or the user
notifying about renewing the certificate.

Good luck!

/Jonathan

On Wed, Nov 11, 2009 at 12:06 PM, Mathieu GIANNECCHINI
<mat.giann@...260...> wrote:
> Victor Wagner a écrit :
>> On 2009.11.11 at 09:40:59 +0100, David Sommerseth wrote:
>>
>>
>>> On 10/11/09 17:16, Till Maas wrote:
>>>
>>>> I would like to get a notification in case a client certificate is used
>>>> for a connection to an OpenVPN server, that is about to expire soon. Is
>>>> there currently a way to do this? I looked into the tls-verify hook, but
>>>> according to the documentation, only the Subject line of a certificate
>>>> is available and not the validity. Is there maybe a way to log the
>>>> expiration dates?
>>>>
>>> I don't think this is possible without patching openvpn to put these
>>> values into some environment variables for the --tls-verify hook.  I've
>>> done something similar in regards to the SHA1 fingerprint for my own
>>> project (I have had an OpenVPN patch pending since RC7).  But I'd be
>>> willing to carry such a feature in my eurephia patch for OpenVPN, as
>>> that sounds very useful.
>>>
>>
>> Apache/mod_ssl does export entire certificate in the PEM format as
>> environment variable. So, may be openvpn sould do the same?
>>
>> Now various people patching openvpn to add some values:
>> you've added sha1 fingerprint, I've added certificate extension
>> subjectAltName, et cetera, et cetera.
>>
>> But if entire certificate would be available, it would be possible to
>> extract any information from it (or hash it with any algorithm) from the
>> script using openssl command line utility or some binding or OpenSSL
>> libraries to the choosen script language.
>>
>
> Ok, i try once again. Maybe the solution is here :
> http://article.gmane.org/gmane.network.openvpn.devel/2492
>
>
> ------------------------------------------------------------------------------
> Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
> trial. Simplify your report design, integration and deployment - and focus on
> what you do best, core application coding. Discover what's new with
> Crystal Reports now.  http://p.sf.net/sfu/bobj-july
> _______________________________________________
> Openvpn-devel mailing list
> Openvpn-devel@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/openvpn-devel
>

Re: [Openvpn-devel] Script interface to trigger events depending on the validity of a certificate

[David Sommerseth]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 11/11/09 11:25, Victor Wagner wrote:
> On 2009.11.11 at 09:40:59 +0100, David Sommerseth wrote:
> 
>> On 10/11/09 17:16, Till Maas wrote:
>>> I would like to get a notification in case a client certificate is used
>>> for a connection to an OpenVPN server, that is about to expire soon. Is
>>> there currently a way to do this? I looked into the tls-verify hook, but
>>> according to the documentation, only the Subject line of a certificate
>>> is available and not the validity. Is there maybe a way to log the
>>> expiration dates?
>>
>> I don't think this is possible without patching openvpn to put these
>> values into some environment variables for the --tls-verify hook.  I've
>> done something similar in regards to the SHA1 fingerprint for my own
>> project (I have had an OpenVPN patch pending since RC7).  But I'd be
>> willing to carry such a feature in my eurephia patch for OpenVPN, as
>> that sounds very useful.
> 
> Apache/mod_ssl does export entire certificate in the PEM format as
> environment variable. So, may be openvpn sould do the same?
> 
> Now various people patching openvpn to add some values:
> you've added sha1 fingerprint, I've added certificate extension
> subjectAltName, et cetera, et cetera.
> 
> But if entire certificate would be available, it would be possible to
> extract any information from it (or hash it with any algorithm) from the
> script using openssl command line utility or some binding or OpenSSL
> libraries to the choosen script language.

Good point!  I was not aware of the Apache/mod_ssl way of doing it.  My
only concern about that is if it would be possible to exhaust the memory
pool for environment variables?  Imagine a a buffer overflow bug if an
attacker sends a specially crafted certificate request with 1000
certificates in a chain.

The reason for this concern is that OpenVPN provides now all certificate
info available at once in many of the the different hooks, all with _0,
_1, _2, etc as a suffix at the end of the environment variable name.
With roughly 2KB per certificate, on a cruel attack with 1000 chained
certificates, that could mean 2MB would be needed for the environment
table and you would have 1000 environment variables to go through.

Maybe I'm concerned about a non-existing issue ... but I'd like to know
how things would behave in this scenario.

One way how to control this situation would be to also implement a
"--max-chained-certs" argument, which would default at something
reasonable, f.ex 5.

But initially, your suggestion is really not a bad idea as it would
solve future needs indeed.


kind regards,

David Sommerseth
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkr6pz8ACgkQDC186MBRfrqH2wCgqZfprWTvXeuNPe8iHdGfAZEr
BOUAniJOF9U+af+dwpFBpRDEIozPEbok
=KIVm
-----END PGP SIGNATURE-----

Re: [Openvpn-devel] Script interface to trigger events depending on the validity of a certificate

[David Sommerseth]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 11/11/09 12:06, Mathieu GIANNECCHINI wrote:
> Victor Wagner a écrit :
>> On 2009.11.11 at 09:40:59 +0100, David Sommerseth wrote:
>>
>>   
>>> On 10/11/09 17:16, Till Maas wrote:
>>>     
>>>> I would like to get a notification in case a client certificate is used
>>>> for a connection to an OpenVPN server, that is about to expire soon. Is
>>>> there currently a way to do this? I looked into the tls-verify hook, but
>>>> according to the documentation, only the Subject line of a certificate
>>>> is available and not the validity. Is there maybe a way to log the
>>>> expiration dates?
>>>>       
>>> I don't think this is possible without patching openvpn to put these
>>> values into some environment variables for the --tls-verify hook.  I've
>>> done something similar in regards to the SHA1 fingerprint for my own
>>> project (I have had an OpenVPN patch pending since RC7).  But I'd be
>>> willing to carry such a feature in my eurephia patch for OpenVPN, as
>>> that sounds very useful.
>>>     
>>
>> Apache/mod_ssl does export entire certificate in the PEM format as
>> environment variable. So, may be openvpn sould do the same?
>>
>> Now various people patching openvpn to add some values:
>> you've added sha1 fingerprint, I've added certificate extension
>> subjectAltName, et cetera, et cetera.
>>
>> But if entire certificate would be available, it would be possible to
>> extract any information from it (or hash it with any algorithm) from the
>> script using openssl command line utility or some binding or OpenSSL
>> libraries to the choosen script language.
>>   
> 
> Ok, i try once again. Maybe the solution is here :
> http://article.gmane.org/gmane.network.openvpn.devel/2492

Indeed!  And you're about to get my vote for this implementation ... but
I have two concerns.

1) The certificate is first dumped to file.  Would it be possible to
pass it only via environment table, to avoid the file stage?  The reason
for this is primarily security (not to write more to disk than what you
really need on disk), and secondarily - SELinux - avoiding writing data
to disk you are more sure that SELinux or other MACs will not interfere
and deny the write requests.  This is especially crucial if OpenVPN is
run in as a contained user (which most daemons really do)

2) If an attacker sends a certificate with his certificate and 999 CA
certificates in a chain, what will happen?  What happens if the disk
goes full or the certificate cannot be written?


kind regards,

David Sommerseth
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkr6rVkACgkQDC186MBRfrrxSgCeMq5lVAvIAvPNVN6mfOgO7Avj
q0UAnjFM/FS6cgIt4igadYaHDThXli1c
=UKWi
-----END PGP SIGNATURE-----

Re: [Openvpn-devel] Script interface to trigger events depending on the validity of a certificate

[Victor Wagner]

On 2009.11.11 at 13:00:05 +0100, David Sommerseth wrote:

> 
> Good point!  I was not aware of the Apache/mod_ssl way of doing it.  My
> only concern about that is if it would be possible to exhaust the memory
> pool for environment variables?  Imagine a a buffer overflow bug if an
> attacker sends a specially crafted certificate request with 1000
> certificates in a chain.

I'm not sure that all intermediate CA Certificates have to be exported
such way. I don't remember if Apache does so, because I never tried to
test Apache with chain longer than 1 and without intermediate CA certs
in the OpenSSL cert-store.

For most purposes two things are sufficient
1. Check validity of client certificate data using chain 
(i.e. did intermediate CAs have right to issue certificate with such
extension). It is better done inside OpenSSL.  

I've written patch which enables OpenSSL builtin certificate policy
checking in OpenVPN.

2. Get an information from client certificate, not from intermediate CA
certificate in the chain.

> The reason for this concern is that OpenVPN provides now all certificate
> info available at once in many of the the different hooks, all with _0,
> _1, _2, etc as a suffix at the end of the environment variable name.
> With roughly 2KB per certificate, on a cruel attack with 1000 chained
> certificates, that could mean 2MB would be needed for the environment
> table and you would have 1000 environment variables to go through.
[skip]
> One way how to control this situation would be to also implement a
> "--max-chained-certs" argument, which would default at something
> reasonable, f.ex 5.
> 

Really, OpenSSL allows to set maximal
verification depth. Apache mod_ssl has a configuration directive which
sets maximum allowed chain length using SSL_CTX_set_verify_depth
function. OpenVPN doesn't provide such a directive now. 

So, may be exporting certificate should be accompanied with providing
such a directive with reasonable default.

I've never seen chains longer than 3, so 5 should be sufficient.

Re: [Openvpn-devel] Script interface to trigger events depending on the validity of a certificate

[Till Maas]

[-- Attachment #1: Type: text/plain, Size: 736 bytes --]

On Wed, Nov 11, 2009 at 12:20:31PM +0100, Jonathan Petersson wrote:

> As it's doing this you can trigger a client-connect script to retrieve
> the "Validity Not After" data from the client-cert (if you have a
> local copy on the server) if the time-frame is out of realms trigger
> sendmail or preferable mail-daemon to send an email to you or the user
> notifying about renewing the certificate.

This does not really work afaics, because there are several certificates
with the same common name but overlapping validity timeframes to allow
users to seamlessy update their certificate. So the tls-verify script
does not know, whether the certificate that expires in two weeks is used
or the one that still lasts a year.

Regards
Till

[-- Attachment #2: Type: application/pgp-signature, Size: 835 bytes --]

Re: [Openvpn-devel] Script interface to trigger events depending on the validity of a certificate

[David Sommerseth]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 11/11/09 13:54, Victor Wagner wrote:
> On 2009.11.11 at 13:00:05 +0100, David Sommerseth wrote:
> 
>>
>> Good point!  I was not aware of the Apache/mod_ssl way of doing it.  My
>> only concern about that is if it would be possible to exhaust the memory
>> pool for environment variables?  Imagine a a buffer overflow bug if an
>> attacker sends a specially crafted certificate request with 1000
>> certificates in a chain.
> 
> I'm not sure that all intermediate CA Certificates have to be exported
> such way. I don't remember if Apache does so, because I never tried to
> test Apache with chain longer than 1 and without intermediate CA certs
> in the OpenSSL cert-store.
> 
> For most purposes two things are sufficient
> 1. Check validity of client certificate data using chain 
> (i.e. did intermediate CAs have right to issue certificate with such
> extension). It is better done inside OpenSSL.  
> 
> I've written patch which enables OpenSSL builtin certificate policy
> checking in OpenVPN.
> 
> 2. Get an information from client certificate, not from intermediate CA
> certificate in the chain.

I completely agree, that under normal circumstances, it should be enough
by letting OpenSSL take care of the certificate chain.  But as OpenVPN
now do list more certificates already, I was just trying to keep that
possibility still open.

In the OpenVPN plug-in I've written which does username, password and
certificate authentication, I've been playing with an idea of using the
certificate chain to apply different "rules" (network, login hours, etc)
based on the certificate chain as well.

An example:

        CA
        /\_____________
       /               \
     sales           IT dept
      CA               CA
     /   \           /    \
    sale1 sale2    admin1  admin2

This way you can for example give the same network access to all "sales
people" by assigning an access profile based users who got a certificate
signed by "sales CA" and another access profile to users with their
certificates signed by the "IT dept CA".

In other words, group management based on the certificate chain.  But
then all certs in the chain needs to be exported to the plug-ins.

>> The reason for this concern is that OpenVPN provides now all certificate
>> info available at once in many of the the different hooks, all with _0,
>> _1, _2, etc as a suffix at the end of the environment variable name.
>> With roughly 2KB per certificate, on a cruel attack with 1000 chained
>> certificates, that could mean 2MB would be needed for the environment
>> table and you would have 1000 environment variables to go through.
> [skip]
>> One way how to control this situation would be to also implement a
>> "--max-chained-certs" argument, which would default at something
>> reasonable, f.ex 5.
>>
> 
> Really, OpenSSL allows to set maximal
> verification depth. Apache mod_ssl has a configuration directive which
> sets maximum allowed chain length using SSL_CTX_set_verify_depth
> function. OpenVPN doesn't provide such a directive now. 

Exactly! :)  I knew I had seen this limit somewhere, just didn't connect
it to OpenSSL right now.  I don't find any traces of this function call
at all in the OpenVPN, so this would be needed.


kind regards,

David Sommerseth
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkr60mcACgkQDC186MBRfrqOugCgiDvs/kwpNxrAzoNJqqdhogts
k/cAniVHz1slgiY+rG/lsXg76D5JLXx/
=9g2E
-----END PGP SIGNATURE-----

Re: [Openvpn-devel] Script interface to trigger events depending on the validity of a certificate

[Karl O. Pinc]

On 11/11/2009 06:26:04 AM, David Sommerseth wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On 11/11/09 12:06, Mathieu GIANNECCHINI wrote:
> > Victor Wagner a écrit :

> >> But if entire certificate would be available, it would be possible
> to
> >> extract any information from it (or hash it with any algorithm)
> from the
> >> script using openssl command line utility or some binding or
> OpenSSL
> >> libraries to the choosen script language.

> Indeed!  And you're about to get my vote for this implementation ...
> but
> I have two concerns.

> 2) If an attacker sends a certificate with his certificate and 999 CA
> certificates in a chain, what will happen?  What happens if the disk
> goes full or the certificate cannot be written?

You're a lot less likely to fill the disk than you are to run out
of RAM.

Karl <kop@...1206...>
Free Software:  "You don't pay back, you pay forward."
                 -- Robert A. Heinlein

Re: [Openvpn-devel] Script interface to trigger events depending on the validity of a certificate

[David Sommerseth]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 11/11/09 22:15, Karl O. Pinc wrote:
> On 11/11/2009 06:26:04 AM, David Sommerseth wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> On 11/11/09 12:06, Mathieu GIANNECCHINI wrote:
>>> Victor Wagner a écrit :
> 
>>>> But if entire certificate would be available, it would be possible
>> to
>>>> extract any information from it (or hash it with any algorithm)
>> from the
>>>> script using openssl command line utility or some binding or
>> OpenSSL
>>>> libraries to the choosen script language.
> 
>> Indeed!  And you're about to get my vote for this implementation ...
>> but
>> I have two concerns.
> 
>> 2) If an attacker sends a certificate with his certificate and 999 CA
>> certificates in a chain, what will happen?  What happens if the disk
>> goes full or the certificate cannot be written?
> 
> You're a lot less likely to fill the disk than you are to run out
> of RAM.

Indeed true, but its also a scenario to consider.  If the certificates
cannot be written to either memory or disk, proper error handling must
make sure the situation is handled correctly.  And running openvpn on
embedded systems with small filesystems or RAM disks can cause this
error as well.


kind regards,

David Sommerseth
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkr7zycACgkQDC186MBRfrryuACgjw9Je6aQWGNeCbWQRDWfGdCg
x7QAoI5ETmIDWNXhycJN5TrRbydM1Tij
=HrZ/
-----END PGP SIGNATURE-----

Re: [Openvpn-devel] Script interface to trigger events depending on the validity of a certificate

[Till Maas]

[-- Attachment #1: Type: text/plain, Size: 1159 bytes --]

On Wed, Nov 11, 2009 at 01:26:04PM +0100, David Sommerseth wrote:

> 1) The certificate is first dumped to file.  Would it be possible to
> pass it only via environment table, to avoid the file stage?  The reason
> for this is primarily security (not to write more to disk than what you
> really need on disk), and secondarily - SELinux - avoiding writing data
> to disk you are more sure that SELinux or other MACs will not interfere
> and deny the write requests.  This is especially crucial if OpenVPN is
> run in as a contained user (which most daemons really do)

As far as I understand the tls-verify option, the script will be run
once for every certificate in the chain. Therefore just passing the
cert to stdin of the script should be a feasible solution.

> 2) If an attacker sends a certificate with his certificate and 999 CA
> certificates in a chain, what will happen?  What happens if the disk
> goes full or the certificate cannot be written?

According to the manpage, the tls-verify script won't be executed,
because the attacker already need to have passed all other verifications
steps except the check against the CRL list.

Regards
Till

[-- Attachment #2: Type: application/pgp-signature, Size: 835 bytes --]

Re: [Openvpn-devel] Script interface to trigger events depending on the validity of a certificate

[David Sommerseth]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 12/11/09 12:51, Till Maas wrote:
> On Wed, Nov 11, 2009 at 01:26:04PM +0100, David Sommerseth wrote:
> 
>> 1) The certificate is first dumped to file.  Would it be possible to
>> pass it only via environment table, to avoid the file stage?  The reason
>> for this is primarily security (not to write more to disk than what you
>> really need on disk), and secondarily - SELinux - avoiding writing data
>> to disk you are more sure that SELinux or other MACs will not interfere
>> and deny the write requests.  This is especially crucial if OpenVPN is
>> run in as a contained user (which most daemons really do)
> 
> As far as I understand the tls-verify option, the script will be run
> once for every certificate in the chain. Therefore just passing the
> cert to stdin of the script should be a feasible solution.

But this will not work for --plugin.  A plug-in written in C will not
have access to stdin/stdout for such exchanges.  That's my concern.

>> 2) If an attacker sends a certificate with his certificate and 999 CA
>> certificates in a chain, what will happen?  What happens if the disk
>> goes full or the certificate cannot be written?
> 
> According to the manpage, the tls-verify script won't be executed,
> because the attacker already need to have passed all other verifications
> steps except the check against the CRL list.

True!  I didn't think about that when I thought about this scenario, but
this really covers it.


kind regards,

David Sommerseth


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkr7/tMACgkQDC186MBRfrrUJwCgrSVYrvlu3v9ZQlQOcg/oAwwk
OxsAnjN+a0OeSIH0Um/3ICbQBRGNLOEh
=ZEbM
-----END PGP SIGNATURE-----

Re: [Openvpn-devel] Script interface to trigger events depending on the validity of a certificate

[Victor Wagner]

On 2009.11.11 at 16:04:12 +0100, David Sommerseth wrote:
> I completely agree, that under normal circumstances, it should be enough
> by letting OpenSSL take care of the certificate chain.  But as OpenVPN
> now do list more certificates already, I was just trying to keep that
> possibility still open.
> 
> In the OpenVPN plug-in I've written which does username, password and
> certificate authentication, I've been playing with an idea of using the
> certificate chain to apply different "rules" (network, login hours, etc)
> based on the certificate chain as well.

I think it is what certificate policies are for (see RFC 5280).

Unfortinately  policy support is very poorly documented in the OpenSSL
(although some documentation for certificate chain verification was added 
in 1.0.0 beta 4 and it is applicable to early versions as well)

So my patch for policy checking allows only to specify
several policies to accept. It doesn't pass that policy which was found
in the certificate after all policy mappings found in CA certificates
were applied to scripts/plugins. 

There are also attribute certificates which can be used for such
autorization purposes as well.

Re: [Openvpn-devel] Script interface to trigger events depending on the validity of a certificate

[David Sommerseth]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 12/11/09 16:37, Victor Wagner wrote:
> On 2009.11.11 at 16:04:12 +0100, David Sommerseth wrote:
>> I completely agree, that under normal circumstances, it should be enough
>> by letting OpenSSL take care of the certificate chain.  But as OpenVPN
>> now do list more certificates already, I was just trying to keep that
>> possibility still open.
>>
>> In the OpenVPN plug-in I've written which does username, password and
>> certificate authentication, I've been playing with an idea of using the
>> certificate chain to apply different "rules" (network, login hours, etc)
>> based on the certificate chain as well.
> 
> I think it is what certificate policies are for (see RFC 5280).
> 
> Unfortinately  policy support is very poorly documented in the OpenSSL
> (although some documentation for certificate chain verification was added 
> in 1.0.0 beta 4 and it is applicable to early versions as well)

I'm not sure we talk about the same thing now.  I am thinking about a
centralised form of setting a policy for a limited range of users
(client certificates).  But these features mentioned in RFC5280 is only
to be used in CA certificates (which is fine enough) and to use this
information in *validation* of the certificates.  It do not go further
than this, as the validation of the contents of these fields needs to be
done by the application (not OpenSSL but OpenVPN, in this context), how
I understand it.

The eurephia plug-in I've been writing will allow you to authenticate
users based on certificate *and* user name.  And depending on the
combination here, the firewall will be applied with a specific rule to
allow a limited access.  With such rules you can limit each certificate
and user name combination down to IP addresses and port numbers which is
available over the VPN connection.

My intention is to extend the current implementation to take into
consideration which certificates is in the certificate chain, which do
not depend on the policy feature RFC5280 mentions, and apply more
general rules for a bigger group of users.  As this will make it a lot
easier for an administrator to administer in bigger environments.
Another thing, you'd normally trust the information you have locally
than the information sent to you from a client.

And in this connection, I'm looking at implementing other restrictions
as well, as when users are allowed to connect and not (login time
restrictions).


kind regards,

David Sommerseth


> So my patch for policy checking allows only to specify
> several policies to accept. It doesn't pass that policy which was found
> in the certificate after all policy mappings found in CA certificates
> were applied to scripts/plugins. 
> 
> There are also attribute certificates which can be used for such
> autorization purposes as well.
> 
> ------------------------------------------------------------------------------
> Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day 
> trial. Simplify your report design, integration and deployment - and focus on 
> what you do best, core application coding. Discover what's new with
> Crystal Reports now.  http://p.sf.net/sfu/bobj-july
> _______________________________________________
> Openvpn-devel mailing list
> Openvpn-devel@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/openvpn-devel

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkr8TLoACgkQDC186MBRfrr8zQCghdLz+8VcvTivdhSfopIDmGQl
nPYAnjUA6mWGfxpCSwzFTocykde4Lepo
=u5dv
-----END PGP SIGNATURE-----