upstream/openvpn
1
0
Fork 0
mirror of https://github.com/OpenVPN/openvpn.git synced 2026-06-09 08:59:57 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Disabled X.509 track and username selection for PolarSSL

Browse source 
Signed-off-by: Adriaan de Jong <dejong@fox-it.com>
Acked-by: James Yonan <james@openvpn.net>
Signed-off-by: David Sommerseth <davids@redhat.com>
This commit is contained in:
Adriaan de Jong 2011-07-05 13:09:13 +02:00 committed by David Sommerseth
parent 88203950ef
commit 7dd8bbf574
5 changed files with 20 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
README.polarssl
View file

@ -7,17 +7,22 @@ To Build and Install,
make
make install
This version depends on at least PolarSSL v0.99.
*************************************************************************
The following features are missing in the PolarSSL version of OpenVPN:
Due to limitations in the PolarSSL library, the following features are missing
in the PolarSSL version of OpenVPN:
* ca_path support - Loading certificate authorities from a directory
* PKCS#12 file support
* --capath support - Loading certificate authorities from a directory
* Windows CryptoAPI support
* Management external key support
* X509 alternative username fields (must be "CN")
* X.509 alternative username fields (must be "CN")
TODO:
* serial is in Hex
* X509 certificate export
* X.509 tracking
Plugin/Script features:
* X.509 Serial number is in hex, not decimal as with OpenSSL
* X.509 subject line has a different format than the OpenSSL subject line
* X.509 certificate export does not work
* X.509 certificate tracking

4
configure.ac
View file

@ -840,6 +840,10 @@ fi
dnl enable --x509-username-field feature if requested
if test "$X509ALTUSERNAME" = "yes"; then
if test "$SSL_LIB" = "polarssl" ; then
AC_MSG_ERROR([PolarSSL does not support the --x509-username-field feature])
fi
AC_DEFINE(ENABLE_X509ALTUSERNAME, 1, [Enable --x509-username-field feature])
fi

1
openvpn.8
View file

@ -4543,6 +4543,7 @@ to save values from full cert chain. Values will be encoded
as X509_<depth>_<attribute>=<value>. Multiple
.B \-\-x509-track
options can be defined to track multiple attributes.
Not available with PolarSSL.
.\"*********************************************************
.TP
.B \-\-ns-cert-type client|server

2
options.c
View file

@ -604,8 +604,10 @@ static const char usage_message[] =
" of verification.\n"
"--ns-cert-type t: Require that peer certificate was signed with an explicit\n"
" nsCertType designation t = 'client' | 'server'.\n"
#ifdef ENABLE_X509_TRACK
"--x509-track x : Save peer X509 attribute x in environment for use by\n"
" plugins and management interface.\n"
#endif
#if OPENSSL_VERSION_NUMBER >= 0x00907000L || USE_POLARSSL
"--remote-cert-ku v ... : Require that the peer certificate was signed with\n"
" explicit key usage, you can specify more than one value.\n"

2
syshead.h
View file

@ -627,7 +627,7 @@ socket_defined (const socket_descriptor_t sd)
/*
* Enable x509-track feature?
*/
#if defined(USE_CRYPTO) && defined(USE_SSL) && defined USE_OPENSSL
#if defined(USE_CRYPTO) && defined(USE_SSL) && defined (USE_OPENSSL)
#define ENABLE_X509_TRACK
#endif