From 0e0679fd7a693cc4a092a4e632b473bf2bc99101 Mon Sep 17 00:00:00 2001
From: PiBa-NL <pba_2k3@yahoo.com>
Date: Sat, 24 Nov 2012 19:33:06 +0100
Subject: openvpn-client-export, better checking/error reporting on
 unsupported/illogical OpenVPN configurations

---
 .../openvpn-client-export.inc                      | 41 +++++++++++++++-------
 1 file changed, 28 insertions(+), 13 deletions(-)

(limited to 'config/openvpn-client-export/openvpn-client-export.inc')

diff --git a/config/openvpn-client-export/openvpn-client-export.inc b/config/openvpn-client-export/openvpn-client-export.inc
index 1ab962da..70c9dcf9 100755
--- a/config/openvpn-client-export/openvpn-client-export.inc
+++ b/config/openvpn-client-export/openvpn-client-export.inc
@@ -116,13 +116,23 @@ function openvpn_client_export_validate_config($srvid, $usrid, $crtid) {
 
 	// lookup server certificate info
 	$server_cert = lookup_cert($settings['certref']);
-	$server_ca = lookup_ca($server_cert['caref']);
-	if (!$server_cert || !$server_ca) {
-		$input_errors[] = "Could not locate certificate.";
-		return false;
-	}
-	if (function_exists("cert_get_cn")) {
-		$servercn = cert_get_cn($server_cert['crt']);
+	if (!$server_cert) 
+	{
+		$input_errors[] = "Could not locate server certificate.";
+	} else {
+		$server_cert_purpose = cert_get_purpose($server_cert['crt']);
+		if ($server_cert_purpose['ca'] == 'Yes')
+			$input_errors[] = "Server sertificate is a CA certificate.";
+		if ($server_cert_purpose['server'] != 'Yes')
+			$input_errors[] = "Server sertificate does not have the purpose 'Server: Yes'";
+			
+		$server_ca = lookup_ca($server_cert['caref']);
+		if (!$server_ca) {
+			$input_errors[] = "Could not locate the CA reference for the server certificate.";
+		}
+		if (function_exists("cert_get_cn")) {
+			$servercn = cert_get_cn($server_cert['crt']);
+		}
 	}
 
 	// lookup user info
@@ -130,7 +140,6 @@ function openvpn_client_export_validate_config($srvid, $usrid, $crtid) {
 		$user = $config['system']['user'][$usrid];
 		if (!$user) {
 			$input_errors[] = "Could not find user settings.";
-			return false;
 		}
 	}
 
@@ -142,17 +151,23 @@ function openvpn_client_export_validate_config($srvid, $usrid, $crtid) {
 			$cert = $config['cert'][$crtid];
 		}
 		if (!$cert)
-			return false;
-		// If $cert is not an array, it's a certref not a cert.
-		if (!is_array($cert))
-			$cert = lookup_cert($cert);
+		{
+			$input_errors[] = "Could not find client certificate.";
+		} else {
+			// If $cert is not an array, it's a certref not a cert.
+			if (!is_array($cert))
+				$cert = lookup_cert($cert);
+		}
 	} elseif (($settings['mode'] == "server_tls") || (($settings['mode'] == "server_tls_user") && ($settings['authmode'] != "Local Database"))) {
 		$cert = $config['cert'][$crtid];
 		if (!$cert)
-			return false;
+			$input_errors[] = "Could not find client certifficate.";
 	} else
 		$nokeys = true;
 
+	if ($input_errors)
+		return false;
+		
 	return array($settings, $server_cert, $server_ca, $servercn, $user, $cert, $nokeys);
 }
 
-- 
cgit v1.2.3


From 51cd6f8b6f5383144c7def537cd5d3e98e69f822 Mon Sep 17 00:00:00 2001
From: PiBa-NL <pba_2k3@yahoo.com>
Date: Sat, 24 Nov 2012 22:14:27 +0100
Subject: removed purpose checking because: "Certs created before 2.0.1 can
 have the "wrong" purpose but we should not invalidate them."

---
 config/openvpn-client-export/openvpn-client-export.inc | 6 ------
 1 file changed, 6 deletions(-)

(limited to 'config/openvpn-client-export/openvpn-client-export.inc')

diff --git a/config/openvpn-client-export/openvpn-client-export.inc b/config/openvpn-client-export/openvpn-client-export.inc
index 70c9dcf9..3c478553 100755
--- a/config/openvpn-client-export/openvpn-client-export.inc
+++ b/config/openvpn-client-export/openvpn-client-export.inc
@@ -120,12 +120,6 @@ function openvpn_client_export_validate_config($srvid, $usrid, $crtid) {
 	{
 		$input_errors[] = "Could not locate server certificate.";
 	} else {
-		$server_cert_purpose = cert_get_purpose($server_cert['crt']);
-		if ($server_cert_purpose['ca'] == 'Yes')
-			$input_errors[] = "Server sertificate is a CA certificate.";
-		if ($server_cert_purpose['server'] != 'Yes')
-			$input_errors[] = "Server sertificate does not have the purpose 'Server: Yes'";
-			
 		$server_ca = lookup_ca($server_cert['caref']);
 		if (!$server_ca) {
 			$input_errors[] = "Could not locate the CA reference for the server certificate.";
-- 
cgit v1.2.3