diff options
| author | Steffan Karger | 2016-10-28 17:54:47 +0200 |
|---|---|---|
| committer | David Sommerseth | 2016-11-16 11:39:38 +0100 |
| commit | 160504a2955c4478cd2c0323452929e07016a336 (patch) | |
| tree | 52c294dfefe5883d9193b532a3de2765f5a28025 /Changes.rst | |
| parent | 8b42c197626430118ed126c1b8256ba5ae1f699a (diff) | |
| download | openvpn-160504a2955c4478cd2c0323452929e07016a336.zip openvpn-160504a2955c4478cd2c0323452929e07016a336.tar.gz | |
Refactor CRL handling
This patch refactors the CRL handling to rely more on the implementation
of the crypto library. It will insert the CRL at the correct time to keep
it up to date, but all additional verification logic is removed from
ssl_verify_<backend>.c. "Less code of our own, less bugs of our own."
In practice, this means extra checks will be performed on the CRL, such as
checking it validBefore and validAfter fields.
This patch was originally written by Ivo Manca, and then molded by Steffan
before sending to the list. All bugs are Steffan's fault.
Thanks also go to Antonio Quartulli for useful feedback. He'll send
follow-up patches to improve CRL handling performance.
Signed-off-by: Ivo Manca <ivo.manca@fox-it.com>
Signed-off-by: Steffan Karger <steffan.karger@fox-it.com>
Acked-by: David Sommerseth <davids@openvpn.net>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1477670087-30063-1-git-send-email-steffan.karger@fox-it.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg12809.html
Signed-off-by: David Sommerseth <davids@openvpn.net>
Diffstat (limited to 'Changes.rst')
| -rw-r--r-- | Changes.rst | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/Changes.rst b/Changes.rst index 2b99a1d..f57b750 100644 --- a/Changes.rst +++ b/Changes.rst @@ -120,6 +120,12 @@ Deprecated features will then use ``--key-method 2`` by default. Note that this requires changing the option in both the client and server side configs. +- CRLs are now handled by the crypto library (OpenSSL or mbed TLS), instead of + inside OpenVPN itself. The crypto library implementations are more strict + than the OpenVPN implementation was. This might reject peer certificates + that would previously be accepted. If this occurs, OpenVPN will log the + crypto library's error description. + User-visible Changes -------------------- |