Openvpn unmatched entries

Hi,

I have attached a small patch to the openvpn script that fixes two issues:

1. The DN's displayed in the Verify section are incomplete: the last part of 
the DN is cut of each time.
For example:
DN /C=US/ST=TX/O=Aidant.Enterprises/OU=IT/CN=delta.aidant.net/[email protected]
is reported as 
DN /C=US/ST=TX/O=Aidant.Enterprises/OU=IT/CN=delta.aidant.net
or
DN /C=be/O=AbitMORE bvba/CN=intranet.abitmore.be
is reported as
DN /C=be/O=AbitMORE bvba

2. Using the client config option tls-remote to explicitly require one 
specific server certificate results in an unmatched entry:
VERIFY X509NAME OK: /C=BE/O=AbitMORE_bvba/CN=intranet.abitmore.be: 24 Time(s)

I have chosen to add an additional line in the Verify section of the report 
that reports the tls-remote verification results. To keep the report aligned, 
I have also added "Depth: x" to the lines that were already there. I am not 
really sure about this Depth addition though. Maybe another word would be 
more appropriate to indicate the difference between tls-remote verification 
(X509Name) and default tls handshake certificate verification.

The verify section in my report now looks like this :
 Verify
    status: OK X509Name DN: /C=BE/O=AbitMORE_bvba/CN=intranet.abitmore.be: 721 
Time(s)
    status: OK depth: 0 DN: /C=BE/O=AbitMORE_bvba/CN=intranet.abitmore.be: 721 
Time(s)
    status: OK depth: 1 
DN: /C=BE/O=PHVriens_bvba/CN=PHVriens_Certificate_Authority/[email protected]: 
721 Time(s)
(sorry for the line wraps)

Regards,

Geert
-- 
Kobalt W.I.T.
Web & Information Technology
Brusselsesteenweg 152
1850 Grimbergen

Tel  : +32 479 339 655
Email: [email protected]

_______________________________________________
Logwatch-Devel mailing list
[email protected]
http://www2.list.logwatch.org:81/mailman/listinfo/logwatch-devel

Index: scripts/services/openvpn
===================================================================
RCS file: /var/cvs/logwatch/scripts/services/openvpn,v
retrieving revision 1.11
diff -u -r1.11 openvpn
--- scripts/services/openvpn    4 May 2008 15:15:31 -0000       1.11
+++ scripts/services/openvpn    28 May 2008 08:57:13 -0000
@@ -95,11 +95,16 @@
       ($ThisLine =~ /OpenVPN .* built on [A-Z][a-z]{2} [ 12]?[0-9] [0-9]{4}/)
    ) {
       # Don't care about these...
-   }  elsif (($status, $dn) = ( $ThisLine =~ /^VERIFY (.*): depth=.*, (.*)\// )) {
+   }  elsif (($status, $depth, $dn) = ( $ThisLine =~ /^VERIFY (.*): depth=(.*), (.*)/ )) {

                #TLS: tls_process: killed expiring key:
                #VERIFY OK: depth=0, /C=US/ST=TX/O=Aidant.Enterprises/OU=IT/CN=delta.aidant.net/[email protected]: 23 Time(s)
-      $VerifyList{"status: $status DN: $dn"}++;
+      $VerifyList{"status: $status depth: $depth DN: $dn"}++;
+   }  elsif (($status, $dn) = ( $ThisLine =~ /^VERIFY X509NAME (.*): (.*)/ )) {
+      #VERIFY X509NAME OK: /C=US/ST=TX/O=Aidant.Enterprises/OU=IT/CN=delta.aidant.net/[email protected]: 23 Time(s)
+      $VerifyList{"status: $status X509Name DN: $dn"}++;
    } elsif ($ThisLine =~ m/^MULTI: new incoming connection would exceed maximum number of clients/) {
       $MaxClients++;
    } elsif ($ThisLine =~ m/^OpenVPN [\d.]+ [\w-]+ [\[\]\w ]+ built on [\w]+ +[\d]+ [\d]+$/) {