cron2 has submitted this change. ( http://gerrit.openvpn.net/c/openvpn/+/918?usp=email )
Change subject: Fix compatibility with mbedTLS 2.28.10+ and 3.6.3+ ...................................................................... Fix compatibility with mbedTLS 2.28.10+ and 3.6.3+ From release notes: In TLS clients, if mbedtls_ssl_set_hostname() has not been called, mbedtls_ssl_handshake() now fails with MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME if certificate-based authentication of the server is attempted. This is because authenticating a server without knowing what name to expect is usually insecure. To restore the old behavior, either call mbedtls_ssl_set_hostname() with NULL as the hostname [...] Change-Id: I8bbb6ffdac7d0029dbf3c13e62c11b61813c15ef Signed-off-by: Frank Lichtenheld <fr...@lichtenheld.com> Acked-by: MaxF <m...@max-fillinger.net> Message-Id: <20250327113356.11233-1-g...@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg31262.html Signed-off-by: Gert Doering <g...@greenie.muc.de> --- M src/openvpn/ssl_mbedtls.c 1 file changed, 4 insertions(+), 0 deletions(-) diff --git a/src/openvpn/ssl_mbedtls.c b/src/openvpn/ssl_mbedtls.c index 92b52fe..e15c391 100644 --- a/src/openvpn/ssl_mbedtls.c +++ b/src/openvpn/ssl_mbedtls.c @@ -1246,6 +1246,10 @@ ALLOC_OBJ_CLEAR(ks_ssl->ctx, mbedtls_ssl_context); mbedtls_ssl_init(ks_ssl->ctx); mbed_ok(mbedtls_ssl_setup(ks_ssl->ctx, ks_ssl->ssl_config)); + /* We do verification in our own callback depending on the + * exact configuration. We do not rely on the default hostname + * verification. */ + ASSERT(mbed_ok(mbedtls_ssl_set_hostname(ks_ssl->ctx, NULL))); #if HAVE_MBEDTLS_SSL_SET_EXPORT_KEYS_CB /* Initialize keying material exporter, new style. */ -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/918?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: I8bbb6ffdac7d0029dbf3c13e62c11b61813c15ef Gerrit-Change-Number: 918 Gerrit-PatchSet: 4 Gerrit-Owner: flichtenheld <fr...@lichtenheld.com> Gerrit-Reviewer: MaxF <m...@max-fillinger.net> Gerrit-Reviewer: plaisthos <arne-open...@rfc2549.org> Gerrit-CC: openvpn-devel <openvpn-devel@lists.sourceforge.net> Gerrit-MessageType: merged
_______________________________________________ Openvpn-devel mailing list Openvpn-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-devel
