From: Razvan Cojocaru <[email protected]>
verify_cert() compares the configured hashes over the length of the
computed fingerprint. With mbedTLS built without SHA-1 the SHA-1
fingerprint is empty, so the zero-length compare matched the first
entry and --verify-hash <hash> SHA1 accepted any CA certificate at
depth 1. Reject an empty fingerprint instead.
The compare length has come from the computed fingerprint since
2193d7c0 ("crypto: Enable SHA256 fingerprint checking in --verify-hash").
Change-Id: Ibc9eb15714f14a9f49366fc84072087fc3f013c9
Signed-off-by: Razvan Cojocaru <[email protected]>
Acked-by: Steffan Karger <[email protected]>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2152
---
This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2152
This mail reflects revision 1 of this Change.
Acked-by according to Gerrit (reflected above):
Steffan Karger <[email protected]>
diff --git a/src/openvpn/ssl_verify.c b/src/openvpn/ssl_verify.c
index 0cdec1e..a5b57a5 100644
--- a/src/openvpn/ssl_verify.c
+++ b/src/openvpn/ssl_verify.c
@@ -697,6 +697,13 @@
goto cleanup;
}
+ if (BLEN(&cert_fp) == 0)
+ {
+ msg(D_TLS_ERRORS, "TLS Error: cannot compute the certificate
fingerprint for "
+ "--verify-hash/--peer-fingerprint");
+ goto cleanup;
+ }
+
const struct verify_hash_list *current_hash = opt->verify_hash;
while (current_hash)
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
