Attention is currently required from: Arne Schwabe.
Hello Arne Schwabe,
I'd like you to do a code review.
Please visit
https://gerrit.openvpn.net/c/openvpn/+/2152?usp=email
to review the following change.
Change subject: ssl_verify: reject an empty certificate fingerprint
......................................................................
ssl_verify: reject an empty certificate fingerprint
verify_cert() compares the configured hashes over the length of the
computed fingerprint. With mbedTLS built without SHA-1 the SHA-1
fingerprint is empty, so the zero-length compare matched the first
entry and --verify-hash <hash> SHA1 accepted any CA certificate at
depth 1. Reject an empty fingerprint instead.
The compare length has come from the computed fingerprint since
2193d7c0 ("crypto: Enable SHA256 fingerprint checking in --verify-hash").
Change-Id: Ibc9eb15714f14a9f49366fc84072087fc3f013c9
Signed-off-by: Razvan Cojocaru <[email protected]>
---
M src/openvpn/ssl_verify.c
1 file changed, 7 insertions(+), 0 deletions(-)
git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/52/2152/1
diff --git a/src/openvpn/ssl_verify.c b/src/openvpn/ssl_verify.c
index 0cdec1e..a5b57a5 100644
--- a/src/openvpn/ssl_verify.c
+++ b/src/openvpn/ssl_verify.c
@@ -697,6 +697,13 @@
goto cleanup;
}
+ if (BLEN(&cert_fp) == 0)
+ {
+ msg(D_TLS_ERRORS, "TLS Error: cannot compute the certificate
fingerprint for "
+ "--verify-hash/--peer-fingerprint");
+ goto cleanup;
+ }
+
const struct verify_hash_list *current_hash = opt->verify_hash;
while (current_hash)
--
To view, visit https://gerrit.openvpn.net/c/openvpn/+/2152?usp=email
To unsubscribe, or for help writing mail filters, visit
https://gerrit.openvpn.net/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Ibc9eb15714f14a9f49366fc84072087fc3f013c9
Gerrit-Change-Number: 2152
Gerrit-PatchSet: 1
Gerrit-Owner: Răzvan Cojocaru <[email protected]>
Gerrit-Reviewer: Arne Schwabe <[email protected]>
Gerrit-CC: openvpn-devel <[email protected]>
Gerrit-Attention: Arne Schwabe <[email protected]>
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
