From patchwork Mon Mar 3 14:09:07 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 8507 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "R10" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4Z61020thJz3xFJ for ; Mon, 3 Mar 2025 14:09:22 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) client-signature ECDSA (secp384r1)) (Client CN "mail02.haj.ipfire.org", Issuer "E5" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4Z60zz46hWzp3; Mon, 3 Mar 2025 14:09:19 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4Z60zz2dhkz33LK; Mon, 3 Mar 2025 14:09:19 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "R10" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4Z60zw47sfz2y6n for ; Mon, 3 Mar 2025 14:09:16 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4Z60zv6JVJzbB; Mon, 3 Mar 2025 14:09:15 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1741010956; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=s+GeFqyslYspk+uWxNi6ldPOnBUfyz5Fkev8iK4/MDE=; b=gOSaukfhlPETqDgkRBcK2zz7DaGyCEj7WlIPevQvU89uRSFxwAzGsY0tY6csdqfGD/eTfS 9ghQj5v2cWxqVzAw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1741010956; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=s+GeFqyslYspk+uWxNi6ldPOnBUfyz5Fkev8iK4/MDE=; b=Ql5J9hQgRm/uG46h7Zfn6q2j6FV/pyDRZa8jAQhNK3baF4JdT0p+iXEK6oAhdTi1ac3B/2 ZMtsWbRj5JwRUlVFfbAxyPy4DOyfDfbMpnF3ldfR+j5/3nIQbde+KeLhIWsRTpsbzixhfl OQmtUHTwHRCt5nR9zO8UQkB6T1v/oVWtAeWfbLTYFyS+tSw+/9N/ig1L79D0ViTP+awW41 WUWUvft1Xi1oiyHZImUrM0Fj1V43Nvnliq8HMyTviJnJxjwe/Vlt/VNkORyXhd24borEGo 5X5sRuem37l2QeoAR9x3KqzksDRAQhV3cz9yqPDAFvgO1sy31oCY8483O19sxg== From: Adolf Belka To: development@lists.ipfire.org Subject: [PATCH v2 1/2] vpnmain.cgi: Fix for 2nd part of bug10595 Date: Mon, 3 Mar 2025 15:09:07 +0100 Message-ID: <20250303140908.12961-1-adolf.belka@ipfire.org> MIME-Version: 1.0 Message-ID-Hash: JW5LP2W3UAHZVN75TW4W5VLXNBC4CO2G X-Message-ID-Hash: JW5LP2W3UAHZVN75TW4W5VLXNBC4CO2G X-MailFrom: adolf.belka@ipfire.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.8 Precedence: list List-Id: IPFire development talk Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: - Bug10595 had two parts in it and was closed after the first part was fixed. The second part was still unfixed at that time. I cam across it when checking out an open bug on a similar issue with OpenVPN. - I found the section that checks on the CA Name and modified it to also allow spaces. - Having modified that then the subroutines getsubjectfromcert and getCNfromcert required modifications otherwise the openssl statement only got a filename with the first portion of the ca name until the first space was encountered. This v2 version of this patch set has the safe approach suggested by @Michael. - I am open to any suggestions for improvements to how I implemented the use of the &General::system_output function - Tested this change out on my vm and it worked fine. I was able to upload a ca certificate into IPSec and use spaces in the CA Name. - Changed the test for the CA_NAME to allow spaces. Change also made to en.pl file Fixes: Bug10595 part 2 Tested-by: Adolf Belka Signed-off-by: Adolf Belka --- html/cgi-bin/vpnmain.cgi | 34 ++++++++++++++++++++-------------- 1 file changed, 20 insertions(+), 14 deletions(-) mode change 100755 => 100644 html/cgi-bin/vpnmain.cgi diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi old mode 100755 new mode 100644 index a1d0f0e2a..c11fb0dc8 --- a/html/cgi-bin/vpnmain.cgi +++ b/html/cgi-bin/vpnmain.cgi @@ -245,13 +245,16 @@ sub callssl ($) { ### sub getCNfromcert ($) { #&General::log("ipsec", "Extracting name from $_[0]..."); - my $temp = `/usr/bin/openssl x509 -text -in $_[0]`; - $temp =~ /Subject:.*CN\s*=\s*(.*)[\n]/; - $temp = $1; - $temp =~ s+/Email+, E+; - $temp =~ s/ ST = / S = /; - $temp =~ s/,//g; - $temp =~ s/\'//g; + my @output = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "$_[0]"); + my $temp; + foreach my $line (@output) { + $line =~ /Subject:.*CN\s*=\s*(.*)[\n]/; + $temp = $1; + $temp =~ s+/Email+, E+; + $temp =~ s/ ST = / S = /; + $temp =~ s/,//g; + $temp =~ s/\'//g; + } return $temp; } ### @@ -259,11 +262,14 @@ sub getCNfromcert ($) { ### sub getsubjectfromcert ($) { #&General::log("ipsec", "Extracting subject from $_[0]..."); - my $temp = `/usr/bin/openssl x509 -text -in $_[0]`; - $temp =~ /Subject: (.*)[\n]/; - $temp = $1; - $temp =~ s+/Email+, E+; - $temp =~ s/ ST = / S = /; + my @output = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "$_[0]"); + my $temp; + foreach my $line (@output) { + $line =~ /Subject: (.*)[\n]/; + $temp = $1; + $temp =~ s+/Email+, E+; + $temp =~ s/ ST = / S = /; + } return $temp; } ### @@ -644,8 +650,8 @@ END } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload ca certificate'}) { &General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash); - if ($cgiparams{'CA_NAME'} !~ /^[a-zA-Z0-9]+$/) { - $errormessage = $Lang::tr{'name must only contain characters'}; + if ($cgiparams{'CA_NAME'} !~ /^[a-zA-Z0-9 ]*$/) { + $errormessage = $Lang::tr{'ca name must only contain characters and spaces'}; goto UPLOADCA_ERROR; }