mbedtls: improve error reporting in tls verify callback
PATCH 1/1 mbedtls: improve error reporting in tls verify callback
Instead of just printing the contents of the flags variable, try to convert it to a human-readable error string and print that instead.
This will for example print "The certificate is signed with an unacceptable key (eg bad curve, RSA too short).", instead of "flags=10000".
--- Changes.rst | 5 ++++- src/openvpn/ssl_verify_mbedtls.c | 20 +++++++++++++++++--- 2 files changed, 21 insertions(+), 4 deletions(-)
Changes.rst +4 -1
@@ -91,10 +91,13 @@ User-visible Changes * Non-ephemeral key exchange using static (EC)DH keys * DSS private keys -- PolarSSL builds: changed the tls_digest_N values exported to the script +- mbed TLS builds: changed the tls_digest_N values exported to the script environment to be equal to the ones exported by OpenSSL builds, namely the certificate fingerprint (was the hash of the 'to be signed' data). +- mbed TLS builds: minimum RSA key size is now 2048 bits. Shorter keys will + not be accepted, both local and from the peer. + Maintainer-visible changes --------------------------
src/openvpn/ssl_verify_mbedtls.c +17 -3
@@ -65,13 +65,27 @@ verify_callback (void *session_obj, mbedtls_x509_crt *cert, int cert_depth,/* did peer present cert which was signed by our root cert? */ if (*flags !=0 ) { +int ret =0 ; +char errstr[512 ] = {0 };char *subject =x509_get_subject (cert, &gc); + ret =mbedtls_x509_crt_verify_info (errstr,sizeof (errstr)-1 ,"" , *flags); +if (ret <=0 && !openvpn_snprintf (errstr,sizeof (errstr), +"Could not retrieve error string, flags=%" PRIx32, *flags)) + { + errstr[0 ] ='\0' ; + } +if (subject) -msg (D_TLS_ERRORS ,"VERIFY ERROR: depth=%d, flags=%x, %s" , cert_depth, *flags, subject); + { +msg (D_TLS_ERRORS ,"VERIFY ERROR: depth=%d, subject=%s: %s" , + cert_depth, subject, errstr); + }else -msg (D_TLS_ERRORS ,"VERIFY ERROR: depth=%d, flags=%x, could not extract X509 " -"subject string from certificate" , *flags, cert_depth); + { +msg (D_TLS_ERRORS ,"VERIFY ERROR: depth=%d, (could not extract X509 " +"subject string from certificate): %s" , cert_depth, errstr); + }/* Leave flags set to non-zero to indicate that the cert is not ok */ }
Signature · 1 line
2.7.4
Am 03.05.16 um 22:14 schrieb Steffan Karger:
Quoted 19 lines
Instead of just printing the contents of the flags variable, try to convert it to a human-readable error string and print that instead.
This will for example print "The certificate is signed with an unacceptable key (eg bad curve, RSA too short).", instead of "flags=10000".
Signed-off-by Steffan Karger <[email protected]...>--- Changes.rst | 5 ++++- src/openvpn/ssl_verify_mbedtls.c | 20 +++++++++++++++++--- 2 files changed, 21 insertions(+), 4 deletions(-)Changes.rst +0
-0@@ -91,10 +91,13 @@ User-visible Changes * Non-ephemeral key exchange using static (EC)DH keys
Changes.rst User-visible Changes · line 100
Quoted 10 lines
Changes.rst +4
-1* DSS private keys -- PolarSSL builds: changed the tls_digest_N values exported to the script +- mbed TLS builds: changed the tls_digest_N values exported to the script environment to be equal to the ones exported by OpenSSL builds, namely the certificate fingerprint (was the hash of the 'to be signed' data). +- mbed TLS builds: minimum RSA key size is now 2048 bits. Shorter keys will + not be accepted, both local and from the peer. +
ACK. ANd thanks for maintaining Changes.rst
Arne
Your patch has been applied to the master branch.
ACK from me as well, as it nicely shows the problem with our test certs in the logs now....
Thu May 5 12:53:54 2016 VERIFY ERROR: depth=0, subject=C=US, ST=California, L=P leasanton, O=OpenVPN community project, CN=server, [email protected]...
et: The certificate is signed with an unacceptable key (eg bad curve, RSA too sh ort).
commit 524999ab35c79f0d9732647756ad6e4d4e11d73d
Author: Steffan Karger Date: Tue May 3 22:14:38 2016 +0200
mbedtls: improve error reporting in tls verify callback
Signed-off-by: Steffan Karger <[email protected]...>
Acked-by: Arne Schwabe <[email protected]...>
Acked-by: Gert Doering <[email protected]...>
Message-Id: <[email protected]...>
URL: http://article.gmane.org/gmane.network.openvpn.devel/11594
Signed-off-by: Gert Doering <[email protected]...>--
kind regards,
Gert Doering