diff mbox series

[Openvpn-devel,v1] ssl_verify: reject an empty certificate fingerprint

Message ID 20261110143703.15137-1-gert@greenie.muc.de
State New
Headers
Series [Openvpn-devel,v1] ssl_verify: reject an empty certificate fingerprint |

Commit Message

Gert Doering Nov. 10, 2026, 2:36 p.m. UTC 
  From: Razvan Cojocaru <razvanc@mailbox.org>

verify_cert() compares the configured hashes over the length of the
computed fingerprint. With mbedTLS built without SHA-1 the SHA-1
fingerprint is empty, so the zero-length compare matched the first
entry and --verify-hash <hash> SHA1 accepted any CA certificate at
depth 1. Reject an empty fingerprint instead.

The compare length has come from the computed fingerprint since
2193d7c0 ("crypto: Enable SHA256 fingerprint checking in --verify-hash").

Change-Id: Ibc9eb15714f14a9f49366fc84072087fc3f013c9
Signed-off-by: Razvan Cojocaru <razvanc@mailbox.org>
Acked-by: Steffan Karger <steffan@karger.me>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2152
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2152
This mail reflects revision 1 of this Change.

Acked-by according to Gerrit (reflected above):
Steffan Karger <steffan@karger.me>
diff mbox series

Patch

diff --git a/src/openvpn/ssl_verify.c b/src/openvpn/ssl_verify.c
index 0cdec1e..a5b57a5 100644
--- a/src/openvpn/ssl_verify.c
+++ b/src/openvpn/ssl_verify.c
@@ -697,6 +697,13 @@ 
                 goto cleanup;
         }
 
+        if (BLEN(&cert_fp) == 0)
+        {
+            msg(D_TLS_ERRORS, "TLS Error: cannot compute the certificate fingerprint for "
+                              "--verify-hash/--peer-fingerprint");
+            goto cleanup;
+        }
+
         const struct verify_hash_list *current_hash = opt->verify_hash;
 
         while (current_hash)