pfSense

I think this is a bug: Regardless of the newly introduced setting "Client Certificate Key Usage Validation", the @remote-cert-tls client" ends up in the configuration if the OpenVPN server instance is restarted (via Status=>OpenVPN or other means).

However, when saving the configuration from VPN=>OpenVPN (after changing anything, for instance only the log level) the line is not there, unless the option is ticked.

Works for me now as expected. I however noticed, that with the patch now in config.xml there is either <remote_cert_tls></remote_cert_tls> if the option is active or nothing if it is not. Before when the problem occured, the option was always in the config.xml, either empty (as above) or with yes between the tags: <remote_cert_tls>yes</remote_cert_tls>

Other boolean options (like passtos) are handled also with the tags always being present and either yes or empty and they do not show the faulty behaviour. So the remote_cert_tls option seems to be implemented somehow differently than the others.

As I have a (very) limited understanding on how the config is parsed etc., just ignore this comment if this is the intended way of doing things here. :)

Thanks for the quick fix.

Michael Ruder wrote in #note-6:

Works for me now as expected. I however noticed, that with the patch now in config.xml there is either <remote_cert_tls></remote_cert_tls> if the option is active or nothing if it is not. Before when the problem occured, the option was always in the config.xml, either empty (as above) or with yes between the tags: <remote_cert_tls>yes</remote_cert_tls>

That's fine. Some parts of the config.xml use such behavior.

Viktor Gurov wrote in #note-7:

Merged:
https://github.com/pfsense/pfsense/commit/48cf54f850c5bf4fe26a8e33deb449807e71c204

Sure, this patch is right?

In src/usr/local/www/vpn_openvpn_client.php, line 588

- $client['remote_cert_tls'] = $pconfig['remote_cert_tls'];
+ if (isset($client['remote_cert_tls'])) {
+ $client['remote_cert_tls'] = true;
+ }


Shouldn't it be

- $client['remote_cert_tls'] = $pconfig['remote_cert_tls'];
+ if (isset($pconfig['remote_cert_tls'])) {
+ $client['remote_cert_tls'] = true;
+ }


(analogous to src/usr/local/www/vpn_openvpn_server.php:751)