@@ -324,6 +324,9 @@ User-visible Changes

 - ``--verify-hash`` can now take an optional flag which changes the hashing

   algorithm. It can be either SHA1 or SHA256.  The default if not provided is

   SHA1 to preserve backwards compatibility with existing configurations.

+- Restrict the supported --x509-alt-username extension fields to subjectAltName

+  and issuerAltName.  Other extensions probably didn't work anyway, and would

+  cause OpenVPN to crash when a client connects.

 Bugfixes

 --------

@@ -5307,6 +5307,8 @@ option will match against the chosen

 .B fieldname

 instead of the Common Name.

+Only the subjectAltName and issuerAltName X.509 extensions are supported.

+

 .B Please note:

 This option has a feature which will convert an all-lowercase

 .B fieldname

@@ -8083,6 +8083,10 @@ add_option(struct options *options,

                     "configuration", p[1]);

             }

         }

+        else if (!x509_username_field_ext_supported(s+4))

+        {

+            msg(msglevel, "Unsupported x509-username-field extension: %s", s);

+        }

         options->x509_username_field = p[1];

     }

 #endif /* ENABLE_X509ALTUSERNAME */

@@ -124,6 +124,14 @@ struct buffer x509_get_sha256_fingerprint(openvpn_x509_cert_t *cert,

 result_t backend_x509_get_username(char *common_name, int cn_len,

                                    char *x509_username_field, openvpn_x509_cert_t *peer_cert);

+#ifdef ENABLE_X509ALTUSERNAME

+/**

+ * Return true iff the supplied extension field is supported by the

+ * --x509-username-field option.

+ */

+bool x509_username_field_ext_supported(const char *extname);

+#endif

+

 /*

  * Return the certificate's serial number in decimal string representation.

  *

@@ -113,16 +113,29 @@ cleanup:

 }

 #ifdef ENABLE_X509ALTUSERNAME

+bool x509_username_field_ext_supported(const char *fieldname)

+{

+    int nid = OBJ_txt2nid(fieldname);

+    return nid == NID_subject_alt_name || nid == NID_issuer_alt_name;

+}

+

 static

 bool

 extract_x509_extension(X509 *cert, char *fieldname, char *out, int size)

 {

     bool retval = false;

     char *buf = 0;

-    GENERAL_NAMES *extensions;

-    int nid = OBJ_txt2nid(fieldname);

-    extensions = (GENERAL_NAMES *)X509_get_ext_d2i(cert, nid, NULL, NULL);

+    if (!x509_username_field_ext_supported(fieldname))

+    {

+        msg(D_TLS_ERRORS,

+            "ERROR: --x509-alt-username field 'ext:%s' not supported",

+            fieldname);

+        return false;

+    }

+

+    int nid = OBJ_txt2nid(fieldname);

+    GENERAL_NAMES *extensions = X509_get_ext_d2i(cert, nid, NULL, NULL);

     if (extensions)

     {

         int numalts;