Interesting find. I think the code still could use further improvement
(what if some new crypto library shenanigan gives us a "length 1" hash
next?) - we should compare "calculated length to expected length" as
well, or require that the length is SHA* hash length etc.
But for the time being, this improves our stance, and especially adds
a very clear error message ("computation failed").
Since we do not have a t_server infra with mbedTLS right now (fails too
many test cases) I've just thrown the 2.7 backport at GHA for a mbedtls
quick test.
Your patch has been applied to the master and release/2.7 branch (bugfix).
commit 11da41d10b9a772df0dec1862e25f3e303a56ce0 (master)
commit 98b1f8b94d2bd90397eabd27b2b6e919c79f8149 (release/2.7)
Author: Razvan Cojocaru
Date: Tue Nov 10 15:36:56 2026 +0100
ssl_verify: reject an empty certificate fingerprint
Signed-off-by: Razvan Cojocaru <[email protected]>
Acked-by: Steffan Karger <[email protected]>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2152
Message-Id: <[email protected]>
URL:
https://www.mail-archive.com/[email protected]/msg41110.html
Signed-off-by: Gert Doering <[email protected]>
--
kind regards,
Gert Doering
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
