Duplicate common name

cdenley · Jan 20, 2010, 9:31 PM

Why are my users allowed to use duplicate common names? It causes the OpenVPN server to alternate between the two connections according to the log, but both clients seem to work fine. How do I enforce a certificate only being used from one client at a time? I thought this was the default, since I didn't add the duplicate-cn option anywhere.

cdenley · Jan 20, 2010, 10:18 PM

The OpenVPN server doesn't seem to be launched with that option set, so I don't know why I'm able to connect with duplicate common names. This is possible with UDP, right?


# ps -x | grep "[o]penvpn"
  487  ??  Ss     0:22.78 openvpn --config /var/etc/openvpn_server0.conf
# cat /var/etc/openvpn_server0.conf
writepid /var/run/openvpn_server0.pid
#user nobody
#group nobody
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
dev tun
proto udp
cipher BF-CBC
up /etc/rc.filter_configure
down /etc/rc.filter_configure
server 10.3.0.0 255.255.255.0
client-config-dir /var/etc/openvpn_csc
push "route 10.4.0.0 255.255.254.0"
lport 1194
push "dhcp-option WINS 10.4.0.2"
ca /var/etc/openvpn_server0.ca
cert /var/etc/openvpn_server0.cert
key /var/etc/openvpn_server0.key
dh /var/etc/openvpn_server0.dh
comp-lzo
status /var/log/openvpn-status.log
log-append  /var/log/openvpn.log
local 192.168.0.1

cdenley · Jan 20, 2010, 10:29 PM

The server seems to be doing an "inactivity timeout", restarting the client's connection every minute, alternating between the two duplicates.


Wed Jan 20 16:15:42 2010 Initialization Sequence Completed
Wed Jan 20 16:17:33 2010 [server] Inactivity timeout (--ping-restart), restarting
Wed Jan 20 16:17:33 2010 TCP/UDP: Closing socket
Wed Jan 20 16:17:33 2010 SIGUSR1[soft,ping-restart] received, process restarting
Wed Jan 20 16:17:33 2010 Restart pause, 2 second(s)

I will get this on client A one minute, then client B the next, then again on client A. If client A is connected, I would expect client B to simply fail to connect? Does it not work this way?

cdenley · Jan 21, 2010, 2:31 PM

I figured it out. It was the "keepalive 10 60" option which is put in the server configuration automatically by pfsense. This should really be optional! That option in server mode is equivalent to:


ping 10
ping-restart 120
push "ping 10"
push "ping-restart 60"

This tells the client to restart the connection if it goes 60 seconds without a ping from the server. If client A connects, then client B connects with the same common name, client A loses their connection. However, client A doesn't realize it lost its connection until it never receives a ping from the server, which then results in client A restarting. Then the same happens to client B, then back and forth. Why would this be the default? I had to edit openvpn.inc to remove the "keepalive" option, then push "ping-exit" to the client instead of "ping-restart".