From patchwork Tue Nov 10 14:36:56 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gert Doering X-Patchwork-Id: 5652 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:6022:20a6:b0:11a:a05e:cb97 with SMTP id 38csp1145588lad; Tue, 10 Nov 2026 06:37:16 -0800 (PST) X-Forwarded-Encrypted: i=2; AL+hErH+on/encRozqytMfL0O2xzlGMpM6guEv27tyGTNK9ookj0obR2LPZGnvKhcZUz2bAnkX2pmGRyrpQ=@openvpn.net X-Received: by 2002:a05:693c:639c:20b0:36e:2b8b:a098 with SMTP id 5a478bee46e88-37520215e38mr3787631eec.31.1794321436474; Tue, 10 Nov 2026 06:37:16 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1794321436; cv=none; d=google.com; s=arc-20260327; b=jj/tgTkVWZ6eqqV5iBH7vNN3a0VHd1LyUbEjF/1yzlk1icK9i0u3N33X0ZEJ3oPpGf EgZUUKWpFrZie89CoZMwuaEIaPSZhB55M8NdMmcMAHWKag5FldWXT7RZfMyhj/YCxlGv ujfoaZAKSdPYmZr339se4VWr20z0ZOQYb90Y5V0s3yQw31WflZVEHVuc+7GuvyVqKXZI aGGTVMjGc62MSew+LJ8AynfEOh/5h+89qDP/xzSAKUmFZW64XNa71Xde7cAPBygKle/B /YmDTTysK6RhUNla2J8/75jE3iQkyU9oVhHVuhTCw+6RkPDEgDHGLtJX7Y0UDSGCxEyg RLOg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature; bh=xFQcmKQSfpOlHU5VkpLsEyI/m99LDFoWoCVnH1NTH5o=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=U1WVz0yEAn7Wxie+F3sU6oA+5+bggwmziswfSgESW0QZAoxomH21CkJzMiIDW7w7e1 l3HYf5nOjSxEd9iRaa0RdgJZ+rOdrpDfrQTeRBc1p8c3hnf70RhL9RP1GI50RPFaU9FJ 2Q57ekiT0ouVSeu6wBuEVw/Olwez/k9km3K/1TLlykfmiXyLHZeKDAlyjOSJUQHzAK3L n9xBBxdF/17Y0IFETrCFk1ljvJ4V2mthpHkNtJ4FQmob0nGzwwv2YdEpeN5hoUeS75zG dXBln/71nyokz3RxmMb2Z448OtdcejNuZ6p1ZEasO/R8sHoRngQ22ybcleQagi0t0KLO QheQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=U4BEKxHJ; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=nKGw6c14; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=RhJALD7x; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 5a478bee46e88-37522099d83si8456798eec.78.2026.11.10.06.37.16 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 10 Nov 2026 06:37:16 -0800 (PST) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=U4BEKxHJ; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=nKGw6c14; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=RhJALD7x; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Unsubscribe-Post: List-Owner; bh=xFQcmKQSfpOlHU5VkpLsEyI/m99LDFoWoCVnH1NTH5o=; b=U4BEKxHJOfpIal M4c5QTbqNy5hQAGXWS8pEu4VB2/vpWXzImW8Fott8TedKhZODm47VKGb6TSqg0OJ46Be/D1afQxU2 EDnF8sP4XYWi31Rkm1jZxUKXbiNC5V1Eg5XHzXCYTZX7bzvp9NVEfZR+OnvvrmMHnxkDBjuv7jPQD H3Y=; Received: from [127.0.0.1] (helo=sfs-ml-3.v29.lw.sourceforge.com) by sfs-ml-3.v29.lw.sourceforge.com with esmtp (Exim 4.100.1) (envelope-from ) id 1xQmyH-000000005UU-49n3; Tue, 10 Nov 2026 14:37:13 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-3.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.100.1) (envelope-from ) id 1xQmyG-000000005UN-0k6w for openvpn-devel@lists.sourceforge.net; Tue, 10 Nov 2026 14:37:12 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Unsubscribe-Post:List-Subscribe:List-Post:List-Owner:List-Archive; bh=oiKerZ311hCMp6Rm9M3QWN4L05dPo+QnqEPczNBs0pg=; b=nKGw6c14B7XXZWbIH2fSWmz/xF EyV5AjDYH0A3M0CO4SyqpMLSDDE4+sESCjBZD+KfMOnJMCycl7kgIqrORcNhZO8tb4FdAWwjIztRo ys5ulJohIHZZ2Zc2qF8iLk8SJQqNyvCLS/qFl2nM9yWZVN0JcMlBiD1X5MeScrW85wDw=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Unsubscribe-Post: List-Subscribe:List-Post:List-Owner:List-Archive; bh=oiKerZ311hCMp6Rm9M3QWN4L05dPo+QnqEPczNBs0pg=; b=RhJALD7xBOrRDM29Clb91/2sij c4I/C5+30guji9oxx8pAT0Mixgd6/gSQ8MlUap8rPC22irLMLn037PYVwtUEq55B4KlWUjDXPnCmo I2b1RvOMgLlz4YVz0Z9/llGZpBfFbQFl+6GpDdzMFspfN/SpPxSCWy1r+1D6O5eTPoFY=; Received: from [193.149.48.129] (helo=blue.greenie.muc.de) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.100.1) id 1xQmyE-000000008R1-3eEs for openvpn-devel@lists.sourceforge.net; Tue, 10 Nov 2026 14:37:11 +0000 Received: from blue.greenie.muc.de (localhost [127.0.0.1]) by blue.greenie.muc.de (8.18.1/8.18.1) with ESMTP id 6AAEb3ji015175 for ; Tue, 10 Nov 2026 15:37:03 +0100 Received: (from gert@localhost) by blue.greenie.muc.de (8.18.2/8.18.1/Submit) id 6AAEb3ZQ015174 for openvpn-devel@lists.sourceforge.net; Tue, 10 Nov 2026 15:37:03 +0100 From: Gert Doering To: openvpn-devel@lists.sourceforge.net Date: Tue, 10 Nov 2026 15:36:56 +0100 Message-ID: <20261110143703.15137-1-gert@greenie.muc.de> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: 1.3 (+) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-2.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Razvan Cojocaru verify_cert() compares the configured hashes over the length of the computed fingerprint. With mbedTLS built without SHA-1 the SHA-1 fingerprint is empty, so the zero-length compare matched the first [...] Content analysis details: (1.3 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS X-Headers-End: 1xQmyE-000000008R1-3eEs Subject: [Openvpn-devel] [PATCH v1] ssl_verify: reject an empty certificate fingerprint X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1881482394387081588 X-GMAIL-MSGID: 1881482394387081588 From: Razvan Cojocaru verify_cert() compares the configured hashes over the length of the computed fingerprint. With mbedTLS built without SHA-1 the SHA-1 fingerprint is empty, so the zero-length compare matched the first entry and --verify-hash SHA1 accepted any CA certificate at depth 1. Reject an empty fingerprint instead. The compare length has come from the computed fingerprint since 2193d7c0 ("crypto: Enable SHA256 fingerprint checking in --verify-hash"). Change-Id: Ibc9eb15714f14a9f49366fc84072087fc3f013c9 Signed-off-by: Razvan Cojocaru Acked-by: Steffan Karger Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2152 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2152 This mail reflects revision 1 of this Change. Acked-by according to Gerrit (reflected above): Steffan Karger diff --git a/src/openvpn/ssl_verify.c b/src/openvpn/ssl_verify.c index 0cdec1e..a5b57a5 100644 --- a/src/openvpn/ssl_verify.c +++ b/src/openvpn/ssl_verify.c @@ -697,6 +697,13 @@ goto cleanup; } + if (BLEN(&cert_fp) == 0) + { + msg(D_TLS_ERRORS, "TLS Error: cannot compute the certificate fingerprint for " + "--verify-hash/--peer-fingerprint"); + goto cleanup; + } + const struct verify_hash_list *current_hash = opt->verify_hash; while (current_hash)