[Openvpn-devel] [PATCH 0/2] x509-username-fields improvements

[Openvpn-devel] [PATCH 0/2] x509-username-fields improvements

[corubba]

This patchset contains two small improvements for the
x509-username-fields option. The first patch removes the long-deprecated
and only for backwards-compatibility kept uppercasing of the fieldnames.
The second patch documents a long available but until now undocumented
way to specify fields by their oids.

I ran into several issue with the uppercasing, and while coming up with
a bugfix, I figured its easier to instead just finally remove it.


Corubba Smith (2):
  Remove x509-username-fields uppercasing
  Document x509-username-fields oid usage

 Changes.rst                      |  5 +++++
 doc/man-sections/tls-options.rst | 12 ++++--------
 src/openvpn/options.c            | 27 +--------------------------
 3 files changed, 10 insertions(+), 34 deletions(-)

--
2.48.1

[Openvpn-devel] [PATCH 1/2] Remove x509-username-fields uppercasing

[corubba]

The uppercasing was first introduced together with the
x509-username-field option in commit 935c62be, and first released with
v2.2.0 in 2011. The uppercasing was later deprecated with commit
f4e0ad82 and release v2.4.0 in 2016. It think it is time to finally
remove it.

This deprecated feature prevents you from using non-extension
all-lowercase fieldnames like `name`, because these are converted to
uppercase and then cause an error. The deprecation warning is also shown
in cases where there is no actual uppercasing happening, for example
with numerical forms (aka oids) like `2.5.4.41` (oid of `name`).

Signed-off-by: Corubba Smith <corubba@...68...>
---
 Changes.rst                      |  5 +++++
 doc/man-sections/tls-options.rst |  6 ------
 src/openvpn/options.c            | 27 +--------------------------
 3 files changed, 6 insertions(+), 32 deletions(-)

diff --git a/Changes.rst b/Changes.rst
index e0118111..bcc64fca 100644
--- a/Changes.rst
+++ b/Changes.rst
@@ -92,6 +92,11 @@ Compression on send
     ``--allow-compression yes`` is now an alias for
     ``--allow-compression asym``.

+User-visible Changes
+--------------------
+- ``--x509-username-field`` will no longer automatically convert fieldnames to
+  uppercase. This is deprecated since OpenVPN 2.4, and has now been removed.
+
 Overview of changes in 2.6
 ==========================

diff --git a/doc/man-sections/tls-options.rst b/doc/man-sections/tls-options.rst
index cdb85716..7882e924 100644
--- a/doc/man-sections/tls-options.rst
+++ b/doc/man-sections/tls-options.rst
@@ -763,12 +763,6 @@ If the option is inlined, ``algo`` is always :code:`SHA256`.
   Only the :code:`subjectAltName` and :code:`issuerAltName` X.509
   extensions and :code:`serialNumber` X.509 attribute are supported.

-  **Please note:** This option has a feature which will convert an
-  all-lowercase ``fieldname`` to uppercase characters, e.g.,
-  :code:`ou` -> :code:`OU`. A mixed-case ``fieldname`` or one having the
-  :code:`ext:` prefix will be left as-is. This automatic upcasing feature is
-  deprecated and will be removed in a future release.
-
   Non-compliant symbols are being replaced with the :code:`_` symbol, same as
   the field separator, so concatenating multiple fields with such or :code:`_`
   symbols can potentially lead to username collisions.
diff --git a/src/openvpn/options.c b/src/openvpn/options.c
index 3ae44dbe..6b2dfa58 100644
--- a/src/openvpn/options.c
+++ b/src/openvpn/options.c
@@ -9395,37 +9395,12 @@ add_option(struct options *options,
 #ifdef ENABLE_X509ALTUSERNAME
     else if (streq(p[0], "x509-username-field") && p[1])
     {
-        /* This option used to automatically upcase the fieldnames passed as the
-         * option arguments, e.g., "ou" became "OU". Now, this "helpfulness" is
-         * fine-tuned by only upcasing Subject field attribute names which consist
-         * of all lower-case characters. Mixed-case attributes such as
-         * "emailAddress" are left as-is. An option parameter having the "ext:"
-         * prefix for matching X.509v3 extended fields will also remain unchanged.
-         */
         VERIFY_PERMISSION(OPT_P_GENERAL);
         for (size_t j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
         {
             char *s = p[j];

-            if (strncmp("ext:", s, 4) != 0)
-            {
-                size_t i = 0;
-                while (s[i] && !isupper(s[i]))
-                {
-                    i++;
-                }
-                if (strlen(s) == i)
-                {
-                    while ((*s = toupper(*s)) != '\0')
-                    {
-                        s++;
-                    }
-                    msg(M_WARN, "DEPRECATED FEATURE: automatically upcased the "
-                        "--x509-username-field parameter to '%s'; please update your "
-                        "configuration", p[j]);
-                }
-            }
-            else if (!x509_username_field_ext_supported(s+4))
+            if (strncmp("ext:", s, 4) == 0 && !x509_username_field_ext_supported(s+4))
             {
                 msg(msglevel, "Unsupported x509-username-field extension: %s", s);
             }
--
2.48.1

[Openvpn-devel] [PATCH 2/2] Document x509-username-fields oid usage

[corubba]

When built against OpenSSL, the parameters of the x509-username-fields
option are in extract_x509_field_ssl() fed through OBJ_txt2obj() [0]
which accepts "long names and short names [...] as well as numerical
forms." Because of this, you can for example use `x509-username-field
2.5.4.41` to make OpenVPN read the `name` field [1].

x509-username-fields is currently not implemented for mbed TLS, so that
can be ignored.

[0] https://docs.openssl.org/1.1.1/man3/OBJ_nid2obj/
[1] https://oidref.com/2.5.4.41

Signed-off-by: Corubba Smith <corubba@...68...>
---
 doc/man-sections/tls-options.rst | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/doc/man-sections/tls-options.rst b/doc/man-sections/tls-options.rst
index 7882e924..0638d095 100644
--- a/doc/man-sections/tls-options.rst
+++ b/doc/man-sections/tls-options.rst
@@ -744,11 +744,13 @@ If the option is inlined, ``algo`` is always :code:`SHA256`.
   ::

      x509-username-field emailAddress
+     x509-username-field 1.2.840.113549.1.9.1
      x509-username-field ext:subjectAltName
      x509-username-field CN serialNumber

-  The first example uses the value of the :code:`emailAddress` attribute
-  in the certificate's Subject field as the username. The second example
+  The first two examples use the value of the :code:`emailAddress` attribute
+  in the certificate's Subject field as the username, where the first example
+  uses the name while the second example uses the oid. The third example
   uses the :code:`ext:` prefix to signify that the X.509 extension
   ``fieldname`` :code:`subjectAltName` be searched for an rfc822Name
   (email) field to be used as the username. In cases where there are
--
2.48.1

[Openvpn-devel] [PATCH applied] Re: Document x509-username-fields oid usage

[Gert Doering]

Acked-by: Gert Doering <gert@...1296...>

This is an interesting find :-) - if we can do this, we can as well
document it.  Thanks.

(I have not actually tested this, but "man OBJ_txt2obj" confirms)

Your patch has been applied to the master branch.

commit 9f17ad7c281360ec0e970af23f9ba0dc892665c6
Author: corubba via Openvpn-devel
Date:   Sat Feb 15 20:01:44 2025 +0100

     Document x509-username-fields oid usage

     Signed-off-by: Corubba Smith <corubba@...68...>
     Acked-by: Gert Doering <gert@...1296...>
     Message-Id: <eac80c73-e702-4d5c-b90a-fdaf4edd74f1@...68...>
     URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg30916.html
     Signed-off-by: Gert Doering <gert@...1296...>


--
kind regards,

Gert Doering

Re: [Openvpn-devel] [PATCH applied] Re: Document x509-username-fields oid usage

[Gert Doering]

[-- Attachment #1: Type: text/plain, Size: 1215 bytes --]

Hi,

On Thu, Feb 20, 2025 at 10:50:31AM +0100, Gert Doering wrote:
> Acked-by: Gert Doering <gert@...1296...>
> 
> This is an interesting find :-) - if we can do this, we can as well
> document it.  Thanks.
> 
> (I have not actually tested this, but "man OBJ_txt2obj" confirms)
> 
> Your patch has been applied to the master branch.
> 
> commit 9f17ad7c281360ec0e970af23f9ba0dc892665c6
> Author: corubba via Openvpn-devel
> Date:   Sat Feb 15 20:01:44 2025 +0100

Ooops.  My script merged this with the list-mangled From:, which my
pre-push-hook refused, so I had to fix the commit and the new ID is
now

commit 680ad840bda4f869d16dac38fd9fa6a643dc10c0
Author: Corubba Smith <corubba@...68...>
Date:   Sat Feb 15 20:01:44 2025 +0100

    Document x509-username-fields oid usage

(same content, of course)

gert
-- 
"If was one thing all people took for granted, was conviction that if you 
 feed honest figures into a computer, honest figures come out. Never doubted 
 it myself till I met a computer with a sense of humor."
                             Robert A. Heinlein, The Moon is a Harsh Mistress

Gert Doering - Munich, Germany                             gert@...1296...

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 630 bytes --]

[Openvpn-devel] [PATCH applied] Re: Remove x509-username-fields uppercasing

[Gert Doering]

Acked-by: Gert Doering <gert@...1296...>

Thanks for helping us get rid of our technical debt ;-) - and indeed,
if we declared it obsolete years ago, it should go now.  Someone will
complain, but this is not something which can't be fixed with a small
config change.

I have not tested this beyond a GHA test run (which is compiling on
all platforms but not actually excercising this code).

Your patch has been applied to the master branch.

commit 90d89cc4cc41da6678d244f03c842d1b745f106b
Author: Corubba Smith
Date:   Sat Feb 15 20:00:33 2025 +0100

     Remove x509-username-fields uppercasing

     Signed-off-by: Corubba Smith <corubba@...68...>
     Acked-by: Gert Doering <gert@...1296...>
     Message-Id: <cb8317eb-bfb6-47e8-9bc3-ae5cc603ff21@...68...>
     URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg30915.html
     Signed-off-by: Gert Doering <gert@...1296...>


--
kind regards,

Gert Doering