Skip to contentSkip to conversation

Author: Jan Just Keijser <[email protected]...>

PATCH In review [email protected]... 4 participants 9 messages Oct 9, 2015 – Nov 9, 2015

lore
Share & tools
lore

[email protected]...

author
#0 lore raw

PATCH 1/1 Author: Jan Just Keijser <[email protected]...>

From: Jan Just Keijser <[email protected]...>

Add extended client certificate verification support.

Replace --client-cert-not-required with a more flexible option, that allows for no, optional or mandatory client certificate verification.

Signed-off-by Jan Just Keijser <[email protected]...>
---
 doc/openvpn.8             |   49 +++++++++++++++++++++++++++++++++++++++++++-
 src/openvpn/options.c     |   28 +++++++++++++++++++++++-
 src/openvpn/ssl_common.h  |    5 ++-
 src/openvpn/ssl_openssl.c |   15 +++++++++----
 4 files changed, 86 insertions(+), 11 deletions(-)
doc/openvpn.8 +47 -2
index 3eb2493..6ff2b4e 100644
@@ -3549,18 +3549,63 @@ to empty strings ("").  The authentication module/script MUST have logic
 to detect this condition and respond accordingly.
 .\"*********************************************************
 .TP
-.B \-\-client\-cert\-not\-required
+.B \-\-client\-cert\-not\-required (DEPRECATED)
 Don't require client certificate, client will authenticate
 using username/password only.  Be aware that using this directive
 is less secure than requiring certificates from all clients.
 
+
+.B Please note:
+This option is now deprecated and will be removed in OpenVPN v2.5.
+It is replaced by
+.B \-\-verify\-client\-cert
+which allows for more flexibility. The option 
+.B \-\-verify\-client\-cert none
+is functionally equivalent to 
+.B \-\-client\-cert\-not\-required
+.
+
+.\"*********************************************************
+.TP
+.B \-\-verify\-client\-cert none|optional|require
+Specify whether the client is required to supply a valid certificate.
+
+Possible options are
+
+.B none
+: a client certificate is not required. the client need to authenticate
+using username/password only.  Be aware that using this directive
+is less secure than requiring certificates from all clients.
+
 If you use this directive, the
 entire responsibility of authentication will rest on your
 .B \-\-auth\-user\-pass\-verify
 script, so keep in mind that bugs in your script
 could potentially compromise the security of your VPN.
 
-If you don't use this directive, but you also specify an
+.B \-\-verify\-client\-cert none
+is functionally equivalent to 
+.B \-\-client\-cert\-not\-required.
+
+.B optional
+: a client may present a certificate but it is not required to do so.
+When using this directive, you should also use a
+.B \-\-auth\-user\-pass\-verify
+script to ensure that clients are authenticated using a 
+certificate, a username and password, or possibly even both.
+
+Again, the entire responsibility of authentication will rest on your
+.B \-\-auth\-user\-pass\-verify
+script, so keep in mind that bugs in your script
+could potentially compromise the security of your VPN.
+
+.B require
+: this is the default option. A client is required to present a 
+certificate, otherwise VPN access is refused.
+
+If you don't use this directive (or use 
+.B \-\-verify\-client\-cert require
+) but you also specify an
 .B \-\-auth\-user\-pass\-verify
 script, then OpenVPN will perform double authentication.  The
 client certificate verification AND the
src/openvpn/options.c +26 -2
index 74276d4..65e4658 100644
@@ -437,6 +437,9 @@ static const char usage_message[] =
   "                  Only valid in a client-specific config file.\n"
   "--client-cert-not-required : Don't require client certificate, client\n"
   "                  will authenticate using username/password.\n"
+  "--verify-client-cert [none|optional|require] : perform no, optional or\n"
+  "                  mandatory client certificate verification.\n"
+  "                  Default is to require the client to supply a certificate.\n"
   "--username-as-common-name  : For auth-user-pass authentication, use\n"
   "                  the authenticated username as the common name,\n"
   "                  rather than the common name from the client cert.\n"

@@ -2091,8 +2094,8 @@ options_postprocess_verify_ce (const struct options *options, const struct conne
 	msg (M_USAGE, "--duplicate-cn requires --mode server");
       if (options->cf_max || options->cf_per)
 	msg (M_USAGE, "--connect-freq requires --mode server");
-      if (options->ssl_flags & SSLF_CLIENT_CERT_NOT_REQUIRED)
-	msg (M_USAGE, "--client-cert-not-required requires --mode server");
+      if (options->ssl_flags & SSLF_CLIENT_CERT_NOT_REQUIRED || options->ssl_flags & SSLF_CLIENT_CERT_OPTIONAL)
+	msg (M_USAGE, "--client-cert-not-required and --verify-client-cert require --mode server");
       if (options->ssl_flags & SSLF_USERNAME_AS_COMMON_NAME)
 	msg (M_USAGE, "--username-as-common-name requires --mode server");
       if (options->ssl_flags & SSLF_AUTH_USER_PASS_OPTIONAL)

@@ -5658,6 +5661,27 @@ add_option (struct options *options,
     {
       VERIFY_PERMISSION (OPT_P_GENERAL);
       options->ssl_flags |= SSLF_CLIENT_CERT_NOT_REQUIRED;
+      msg (M_WARN, "DEPRECATED OPTION: --client-cert-not-required, use --verify-client-cert instead");
+    }
+  else if (streq (p[0], "verify-client-cert") && !p[2])
+    {
+      VERIFY_PERMISSION (OPT_P_GENERAL);
+
+      /* Reset any existing flags */
+      options->ssl_flags &= ~SSLF_CLIENT_CERT_OPTIONAL;
+      options->ssl_flags &= ~SSLF_CLIENT_CERT_NOT_REQUIRED;
+      if (p[1])
+	{
+	  if (streq (p[1], "none"))
+	      options->ssl_flags |= SSLF_CLIENT_CERT_NOT_REQUIRED;
+	  else if (streq (p[1], "optional"))
+	      options->ssl_flags |= SSLF_CLIENT_CERT_OPTIONAL;
+	  else if (!streq (p[1], "require"))
+	    {
+	      msg (msglevel, "parameter to --verify-client-cert must be 'none', 'optional' or 'require'");
+	      goto err;
+	    }
+	}
     }
   else if (streq (p[0], "username-as-common-name") && !p[1])
     {
src/openvpn/ssl_common.h +3 -2
index 95cd2f7..8fab21f 100644
@@ -293,8 +293,9 @@ struct tls_options
 
   /* configuration file SSL-related boolean and low-permutation options */
 # define SSLF_CLIENT_CERT_NOT_REQUIRED (1<<0)
-# define SSLF_USERNAME_AS_COMMON_NAME  (1<<1)
-# define SSLF_AUTH_USER_PASS_OPTIONAL  (1<<2)
+# define SSLF_CLIENT_CERT_OPTIONAL     (1<<1)
+# define SSLF_USERNAME_AS_COMMON_NAME  (1<<2)
+# define SSLF_AUTH_USER_PASS_OPTIONAL  (1<<3)
 # define SSLF_OPT_VERIFY               (1<<4)
 # define SSLF_CRL_VERIFY_DIR           (1<<5)
 # define SSLF_TLS_VERSION_MIN_SHIFT    6
src/openvpn/ssl_openssl.c +10 -5
index df9fa87..6e29af4 100644
@@ -180,6 +180,9 @@ void
 tls_ctx_set_options (struct tls_root_ctx *ctx, unsigned int ssl_flags)
 {
   ASSERT(NULL != ctx);
+ 
+  /* default certificate verification flags */
+  int flags = SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT;
 
   /* process SSL options including minimum TLS version we will accept from peer */
   {

@@ -221,13 +224,15 @@ tls_ctx_set_options (struct tls_root_ctx *ctx, unsigned int ssl_flags)
   if (ssl_flags & SSLF_CLIENT_CERT_NOT_REQUIRED)
     {
       msg (M_WARN, "WARNING: POTENTIALLY DANGEROUS OPTION "
-	  "--client-cert-not-required may accept clients which do not present "
-	  "a certificate");
+	  "--client-cert-not-required and --verify-client-cert none "
+      "may accept clients which do not present a certificate");
+ 
+      flags = 0;
     }
-  else
+  else if (ssl_flags & SSLF_CLIENT_CERT_OPTIONAL)
+    flags = SSL_VERIFY_PEER;
 #endif
-  SSL_CTX_set_verify (ctx->ctx, SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
-		      verify_callback);
+  SSL_CTX_set_verify (ctx->ctx, flags, verify_callback);
 
   SSL_CTX_set_info_callback (ctx->ctx, info_callback);
 }
Signature · 1 line
1.7.1
#1 lore raw

PATCH 1/1 Add --verify-client-cert optional support for polarssl builds

Hi,

ACK to the --verify-client-cert patch from JJK.

Also, as promised earlier, patches to add --verify-client-cert optional support for Polarssl build. While adding this, I discovered that at some point (probably with the upgrade to polar 1.3), --client-cert-not-required was broken for PolarSSL builds. So two patches: one to fix the regression, and one to add --verify-client-support optional.

-Steffan

#2 lore raw

PATCH 1/2 polarssl: fix --client-cert-not-required

PolarSSL 1.3 determines whether to use a client key/cert based on the private key and/or certificate structs being allocated or not. We previously would always allocate the structs in tls_ctx_{client,server}_new(), which made polarssl clients without a client key/cert (can also be mgmt-external-key or pkcs11) fail to connect.

Note that this bug is not present in OpenVPN 2.3, because PolarSSL 1.2 does not contain the 'pk' abtraction layer and therefore behaves slightly different.

Signed-off-by Steffan Karger <[email protected]...>
---
 src/openvpn/ssl_polarssl.c | 33 +++++++++++++++++++++++----------
 1 file changed, 23 insertions(+), 10 deletions(-)
src/openvpn/ssl_polarssl.c +23 -10
index cd77aa5..27cd735 100644
@@ -77,11 +77,8 @@ tls_ctx_server_new(struct tls_root_ctx *ctx)
   CLEAR(*ctx);
 
   ALLOC_OBJ_CLEAR(ctx->dhm_ctx, dhm_context);
-  ALLOC_OBJ_CLEAR(ctx->priv_key, pk_context);
 
   ALLOC_OBJ_CLEAR(ctx->ca_chain, x509_crt);
-  ALLOC_OBJ_CLEAR(ctx->crt_chain, x509_crt);
-
 
   ctx->endpoint = SSL_IS_SERVER;
   ctx->initialised = true;

@@ -94,10 +91,7 @@ tls_ctx_client_new(struct tls_root_ctx *ctx)
   CLEAR(*ctx);
 
   ALLOC_OBJ_CLEAR(ctx->dhm_ctx, dhm_context);
-  ALLOC_OBJ_CLEAR(ctx->priv_key, pk_context);
-
   ALLOC_OBJ_CLEAR(ctx->ca_chain, x509_crt);
-  ALLOC_OBJ_CLEAR(ctx->crt_chain, x509_crt);
 
   ctx->endpoint = SSL_IS_CLIENT;
   ctx->initialised = true;

@@ -109,16 +103,20 @@ tls_ctx_free(struct tls_root_ctx *ctx)
   if (ctx)
     {
       pk_free(ctx->priv_key);
-      free(ctx->priv_key);
+      if (ctx->priv_key)
+	free(ctx->priv_key);
 
       x509_crt_free(ctx->ca_chain);
-      free(ctx->ca_chain);
+      if (ctx->ca_chain)
+	free(ctx->ca_chain);
 
       x509_crt_free(ctx->crt_chain);
-      free(ctx->crt_chain);
+      if (ctx->crt_chain)
+	free(ctx->crt_chain);
 
       dhm_free(ctx->dhm_ctx);
-      free(ctx->dhm_ctx);
+      if (ctx->dhm_ctx)
+	free(ctx->dhm_ctx);
 
 #if defined(ENABLE_PKCS11)
       if (ctx->priv_key_pkcs11 != NULL) {

@@ -272,6 +270,11 @@ tls_ctx_load_cert_file (struct tls_root_ctx *ctx, const char *cert_file,
 {
   ASSERT(NULL != ctx);
 
+  if (!ctx->crt_chain)
+    {
+      ALLOC_OBJ_CLEAR(ctx->crt_chain, x509_crt);
+    }
+
   if (!strcmp (cert_file, INLINE_FILE_TAG) && cert_inline)
     {
       if (!polar_ok(x509_crt_parse(ctx->crt_chain,

@@ -295,6 +298,11 @@ tls_ctx_load_priv_file (struct tls_root_ctx *ctx, const char *priv_key_file,
   int status;
   ASSERT(NULL != ctx);
 
+  if (!ctx->priv_key)
+    {
+      ALLOC_OBJ_CLEAR(ctx->priv_key, pk_context);
+    }
+
   if (!strcmp (priv_key_file, INLINE_FILE_TAG) && priv_key_inline)
     {
       status = pk_parse_key(ctx->priv_key,

@@ -527,6 +535,11 @@ tls_ctx_load_extra_certs (struct tls_root_ctx *ctx, const char *extra_certs_file
 {
   ASSERT(NULL != ctx);
 
+  if (!ctx->crt_chain)
+    {
+      ALLOC_OBJ_CLEAR (ctx->crt_chain, x509_crt);
+    }
+
   if (!strcmp (extra_certs_file, INLINE_FILE_TAG) && extra_certs_inline)
     {
       if (!polar_ok(x509_crt_parse(ctx->crt_chain,
Signature · 1 line
2.1.4
#3 lore raw

Re: [Openvpn-devel] [PATCH 1/2] polarssl: fix --client-cert-not-required

Am 16.10.15 um 00:43 schrieb Steffan Karger:

Quoted 10 lines

PolarSSL 1.3 determines whether to use a client key/cert based on the private key and/or certificate structs being allocated or not. We previously would always allocate the structs in tls_ctx_{client,server}_new(), which made polarssl clients without a client key/cert (can also be mgmt-external-key or pkcs11) fail to connect.

Note that this bug is not present in OpenVPN 2.3, because PolarSSL 1.2 does not contain the 'pk' abtraction layer and therefore behaves slightly different.

ACK. The code does exactly what the commit message says.

Arne

#4 lore raw

[Openvpn-devel] [PATCH applied] Re: polarssl: fix --client-cert-not-required

In reply to Steffan Karger

Your patch has been applied to the master branch.

commit 444a93eab38d117d4f802e95a318d71ea886bcc6

Author: Steffan Karger
Date:   Fri Oct 16 00:43:14 2015 +0200
     polarssl: fix --client-cert-not-required

     Signed-off-by: Steffan Karger <[email protected]...>
     Acked-by: Arne Schwabe <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/10287
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering

#5 lore raw

PATCH 2/2 polarssl: add --verify-client-cert optional support

In reply to Steffan Karger

This adds support for the --verify-client-cert optional option in PolarSSL builds, as was earlier added for OpenSSL builds by Jan-Just Keijser.

This patch also adds an additional sanity check that this option may only be used in combination with some other authentication method, and changes the warning message about this option to be displayed only once on startup, instead of for each connecting client.

Signed-off-by Steffan Karger <[email protected]...>
---
 src/openvpn/options.c      | 13 ++++++++++---
 src/openvpn/ssl_openssl.c  |  8 +++-----
 src/openvpn/ssl_polarssl.c | 10 ++++------
 3 files changed, 17 insertions(+), 14 deletions(-)
src/openvpn/options.c +10 -3
index b2248b0..c88a180 100644
@@ -2053,8 +2053,8 @@ options_postprocess_verify_ce (const struct options *options, const struct conne
 			     || PLUGIN_OPTION_LIST (options)
 			     || MAN_CLIENT_AUTH_ENABLED (options));
 	  const char *postfix = "must be used with --management-client-auth, an --auth-user-pass-verify script, or plugin";
-	  if ((options->ssl_flags & SSLF_CLIENT_CERT_NOT_REQUIRED) && !ccnr)
-	    msg (M_USAGE, "--client-cert-not-required %s", postfix);
+	  if ((options->ssl_flags & (SSLF_CLIENT_CERT_NOT_REQUIRED|SSLF_CLIENT_CERT_OPTIONAL)) && !ccnr)
+	    msg (M_USAGE, "--verify-client-cert none|optional %s", postfix);
 	  if ((options->ssl_flags & SSLF_USERNAME_AS_COMMON_NAME) && !ccnr)
 	    msg (M_USAGE, "--username-as-common-name %s", postfix);
 	  if ((options->ssl_flags & SSLF_AUTH_USER_PASS_OPTIONAL) && !ccnr)

@@ -2088,7 +2088,7 @@ options_postprocess_verify_ce (const struct options *options, const struct conne
 	msg (M_USAGE, "--duplicate-cn requires --mode server");
       if (options->cf_max || options->cf_per)
 	msg (M_USAGE, "--connect-freq requires --mode server");
-      if (options->ssl_flags & SSLF_CLIENT_CERT_NOT_REQUIRED || options->ssl_flags & SSLF_CLIENT_CERT_OPTIONAL)
+      if (options->ssl_flags & (SSLF_CLIENT_CERT_NOT_REQUIRED|SSLF_CLIENT_CERT_OPTIONAL))
 	msg (M_USAGE, "--client-cert-not-required and --verify-client-cert require --mode server");
       if (options->ssl_flags & SSLF_USERNAME_AS_COMMON_NAME)
 	msg (M_USAGE, "--username-as-common-name requires --mode server");

@@ -2136,6 +2136,13 @@ options_postprocess_verify_ce (const struct options *options, const struct conne
       (options->shared_secret_file != NULL) > 1)
     msg (M_USAGE, "specify only one of --tls-server, --tls-client, or --secret");
 
+  if (options->ssl_flags & (SSLF_CLIENT_CERT_NOT_REQUIRED|SSLF_CLIENT_CERT_OPTIONAL))
+    {
+      msg (M_WARN, "WARNING: POTENTIALLY DANGEROUS OPTION "
+	  "--verify-client-cert none|optional (or --client-cert-not-required) "
+	  "may accept clients which do not present a certificate");
+    }
+
   if (options->tls_server || options->tls_client)
     {
 #ifdef ENABLE_PKCS11
src/openvpn/ssl_openssl.c +3 -5
index 3528ed4..3462d34 100644
@@ -256,14 +256,12 @@ tls_ctx_set_options (struct tls_root_ctx *ctx, unsigned int ssl_flags)
 #if P2MP_SERVER
   if (ssl_flags & SSLF_CLIENT_CERT_NOT_REQUIRED)
     {
-      msg (M_WARN, "WARNING: POTENTIALLY DANGEROUS OPTION "
-	  "--client-cert-not-required and --verify-client-cert none "
-      "may accept clients which do not present a certificate");
-
       flags = 0;
     }
   else if (ssl_flags & SSLF_CLIENT_CERT_OPTIONAL)
-    flags = SSL_VERIFY_PEER;
+    {
+      flags = SSL_VERIFY_PEER;
+    }
 #endif
   SSL_CTX_set_verify (ctx->ctx, flags, verify_callback);
src/openvpn/ssl_polarssl.c +4 -6
index 27cd735..cf38e69 100644
@@ -776,18 +776,16 @@ void key_state_ssl_init(struct key_state_ssl *ks_ssl,
 
       /* Initialise SSL verification */
 #if P2MP_SERVER
-      if (session->opt->ssl_flags & SSLF_CLIENT_CERT_NOT_REQUIRED)
+      if (session->opt->ssl_flags & SSLF_CLIENT_CERT_OPTIONAL)
 	{
-	  msg (M_WARN, "WARNING: POTENTIALLY DANGEROUS OPTION "
-	   "--client-cert-not-required may accept clients which do not present "
-	   "a certificate");
+	  ssl_set_authmode(ks_ssl->ctx, SSL_VERIFY_OPTIONAL);
 	}
-      else
+      else if (!(session->opt->ssl_flags & SSLF_CLIENT_CERT_NOT_REQUIRED))
 #endif
       {
 	ssl_set_authmode (ks_ssl->ctx, SSL_VERIFY_REQUIRED);
-	ssl_set_verify (ks_ssl->ctx, verify_callback, session);
       }
+      ssl_set_verify (ks_ssl->ctx, verify_callback, session);
 
       /* TODO: PolarSSL does not currently support sending the CA chain to the client */
       ssl_set_ca_chain (ks_ssl->ctx, ssl_ctx->ca_chain, NULL, NULL );
Signature · 1 line
2.1.4
author
#6 lore raw

Re: [Openvpn-devel] [PATCH 2/2] polarssl: add --verify-client-cert optional support

Ack to this patch (but remember to apply my patch first :))

JJK

Quoted 103 lines · Steffan Karger

This adds support for the --verify-client-cert optional option in PolarSSL builds, as was earlier added for OpenSSL builds by Jan-Just Keijser.

This patch also adds an additional sanity check that this option may only be used in combination with some other authentication method, and changes the warning message about this option to be displayed only once on startup, instead of for each connecting client.

Signed-off-by Steffan Karger <[email protected]...>
---
 src/openvpn/options.c      | 13 ++++++++++---
 src/openvpn/ssl_openssl.c  |  8 +++-----
 src/openvpn/ssl_polarssl.c | 10 ++++------
 3 files changed, 17 insertions(+), 14 deletions(-)
src/openvpn/options.c +10 -3
index b2248b0..c88a180 100644
@@ -2053,8 +2053,8 @@ options_postprocess_verify_ce (const struct options *options, const struct conne
 			     || PLUGIN_OPTION_LIST (options)
 			     || MAN_CLIENT_AUTH_ENABLED (options));
 	  const char *postfix = "must be used with --management-client-auth, an --auth-user-pass-verify script, or plugin";
-	  if ((options->ssl_flags & SSLF_CLIENT_CERT_NOT_REQUIRED) && !ccnr)
-	    msg (M_USAGE, "--client-cert-not-required %s", postfix);
+	  if ((options->ssl_flags & (SSLF_CLIENT_CERT_NOT_REQUIRED|SSLF_CLIENT_CERT_OPTIONAL)) && !ccnr)
+	    msg (M_USAGE, "--verify-client-cert none|optional %s", postfix);
 	  if ((options->ssl_flags & SSLF_USERNAME_AS_COMMON_NAME) && !ccnr)
 	    msg (M_USAGE, "--username-as-common-name %s", postfix);
 	  if ((options->ssl_flags & SSLF_AUTH_USER_PASS_OPTIONAL) && !ccnr)

@@ -2088,7 +2088,7 @@ options_postprocess_verify_ce (const struct options *options, const struct conne
 	msg (M_USAGE, "--duplicate-cn requires --mode server");
       if (options->cf_max || options->cf_per)
 	msg (M_USAGE, "--connect-freq requires --mode server");
-      if (options->ssl_flags & SSLF_CLIENT_CERT_NOT_REQUIRED || options->ssl_flags & SSLF_CLIENT_CERT_OPTIONAL)
+      if (options->ssl_flags & (SSLF_CLIENT_CERT_NOT_REQUIRED|SSLF_CLIENT_CERT_OPTIONAL))
 	msg (M_USAGE, "--client-cert-not-required and --verify-client-cert require --mode server");
       if (options->ssl_flags & SSLF_USERNAME_AS_COMMON_NAME)
 	msg (M_USAGE, "--username-as-common-name requires --mode server");

@@ -2136,6 +2136,13 @@ options_postprocess_verify_ce (const struct options *options, const struct conne
       (options->shared_secret_file != NULL) > 1)
     msg (M_USAGE, "specify only one of --tls-server, --tls-client, or --secret");
 
+  if (options->ssl_flags & (SSLF_CLIENT_CERT_NOT_REQUIRED|SSLF_CLIENT_CERT_OPTIONAL))
+    {
+      msg (M_WARN, "WARNING: POTENTIALLY DANGEROUS OPTION "
+	  "--verify-client-cert none|optional (or --client-cert-not-required) "
+	  "may accept clients which do not present a certificate");
+    }
+
   if (options->tls_server || options->tls_client)
     {
 #ifdef ENABLE_PKCS11
src/openvpn/ssl_openssl.c +3 -5
index 3528ed4..3462d34 100644
@@ -256,14 +256,12 @@ tls_ctx_set_options (struct tls_root_ctx *ctx, unsigned int ssl_flags)
 #if P2MP_SERVER
   if (ssl_flags & SSLF_CLIENT_CERT_NOT_REQUIRED)
     {
-      msg (M_WARN, "WARNING: POTENTIALLY DANGEROUS OPTION "
-	  "--client-cert-not-required and --verify-client-cert none "
-      "may accept clients which do not present a certificate");
-
       flags = 0;
     }
   else if (ssl_flags & SSLF_CLIENT_CERT_OPTIONAL)
-    flags = SSL_VERIFY_PEER;
+    {
+      flags = SSL_VERIFY_PEER;
+    }
 #endif
   SSL_CTX_set_verify (ctx->ctx, flags, verify_callback);
src/openvpn/ssl_polarssl.c +4 -6
index 27cd735..cf38e69 100644
@@ -776,18 +776,16 @@ void key_state_ssl_init(struct key_state_ssl *ks_ssl,
 
       /* Initialise SSL verification */
 #if P2MP_SERVER
-      if (session->opt->ssl_flags & SSLF_CLIENT_CERT_NOT_REQUIRED)
+      if (session->opt->ssl_flags & SSLF_CLIENT_CERT_OPTIONAL)
 	{
-	  msg (M_WARN, "WARNING: POTENTIALLY DANGEROUS OPTION "
-	   "--client-cert-not-required may accept clients which do not present "
-	   "a certificate");
+	  ssl_set_authmode(ks_ssl->ctx, SSL_VERIFY_OPTIONAL);
 	}
-      else
+      else if (!(session->opt->ssl_flags & SSLF_CLIENT_CERT_NOT_REQUIRED))
 #endif
       {
 	ssl_set_authmode (ks_ssl->ctx, SSL_VERIFY_REQUIRED);
-	ssl_set_verify (ks_ssl->ctx, verify_callback, session);
       }
+      ssl_set_verify (ks_ssl->ctx, verify_callback, session);
 
       /* TODO: PolarSSL does not currently support sending the CA chain to the client */
       ssl_set_ca_chain (ks_ssl->ctx, ssl_ctx->ca_chain, NULL, NULL );
#7 lore raw

[Openvpn-devel] [PATCH applied] Re: polarssl: add --verify-client-cert optional support

In reply to Steffan Karger

Your patch has been applied to the master branch.

commit f107c62051ebbf4a2b661fcba8703fe26485c7af

Author: Steffan Karger
Date:   Fri Oct 16 00:43:15 2015 +0200
     polarssl: add --verify-client-cert optional support

     Signed-off-by: Steffan Karger <[email protected]...>
     Acked-by: Jan Just Keijser <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/10288
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering

#8 lore raw
In reply to [email protected]...

Your patch has been applied to the master branch.

commit b8cdb213d4fa5a56074115faceb2e0da373bab8f

Author: Jan Just Keijser
Date:   Fri Oct 9 11:39:19 2015 +0200
     Author: Jan Just Keijser <[email protected]...>

     Signed-off-by: Jan Just Keijser <[email protected]...>
     Acked-by: Steffan Karger <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/10213
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering