mbedtls: check that private key and certificate match on start
PATCH 1/1 mbedtls: check that private key and certificate match on start
Implement a long standing todo in the code, now that we use mbed TLS 2.x, which provides an interface for the check.
--- src/openvpn/ssl_mbedtls.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
src/openvpn/ssl_mbedtls.c +3 -5
@@ -363,11 +363,9 @@ tls_ctx_load_priv_file (struct tls_root_ctx *ctx, const char *priv_key_file,warn_if_group_others_accessible (priv_key_file); -/* TODO: Check Private Key */ -#if 0 -if (!SSL_CTX_check_private_key (ctx)) -msg (M_SSLERR ,"Private key does not match the certificate" ); -#endif +if (!mbed_ok (mbedtls_pk_check_pair (&ctx->crt_chain->pk, ctx->priv_key))) +msg (M_WARN ,"Private key does not match the certificate" ); +return 0 ; }
Signature · 1 line
2.7.4
A message that is not in the archive (sent off-list or not yet received): [email protected]...
Quoted 2 lines · Arne Schwabe
Is there a reason to only warn? I have not tested this
but OpenVPN fail later in combination or does the tls auth just "not work"?
It will fail later on (as it did before), but there is no good reason to only warn here. This should just fail right away. I'll send a v2 (probably tonight or tomorrow).
-Steffan
PATCH v2 1/1 mbedtls: check that private key and certificate match on start
Implement a long standing todo in the code, now that we use mbed TLS 2.x, which provides an interface for the check.
v2: bail out immediately on failure.
--- src/openvpn/ssl_mbedtls.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
src/openvpn/ssl_mbedtls.c +6 -5
@@ -363,11 +363,12 @@ tls_ctx_load_priv_file (struct tls_root_ctx *ctx, const char *priv_key_file,warn_if_group_others_accessible (priv_key_file); -/* TODO: Check Private Key */ -#if 0 -if (!SSL_CTX_check_private_key (ctx)) -msg (M_SSLERR ,"Private key does not match the certificate" ); -#endif +if (!mbed_ok (mbedtls_pk_check_pair (&ctx->crt_chain->pk, ctx->priv_key))) + { +msg (M_WARN ,"Private key does not match the certificate" ); +return 1 ; + } +return 0 ; }
Signature · 1 line
2.7.4
Am 05.05.16 um 11:02 schrieb Steffan Karger:
Quoted 5 lines
Implement a long standing todo in the code, now that we use mbed TLS 2.x, which provides an interface for the check.
v2: bail out immediately on failure.
ACK from me.
Arne
Your patch has been applied to the master branch.
commit 5c4acf3f7b2885270a9fb2d051a18759ab458c32
Author: Steffan Karger Date: Thu May 5 11:02:13 2016 +0200
mbedtls: check that private key and certificate match on start
Signed-off-by: Steffan Karger <[email protected]...>
Acked-by: Arne Schwabe <[email protected]...>
Message-Id: <[email protected]...>
URL: http://article.gmane.org/gmane.network.openvpn.devel/11599
Signed-off-by: Gert Doering <[email protected]...>--
kind regards,
Gert Doering