diff options
| author | Arne Schwabe | 2023-05-24 15:24:24 +0200 |
|---|---|---|
| committer | Gert Doering | 2023-07-18 15:08:25 +0200 |
| commit | b241e815f16bd566a4824d26f381e468917c822b (patch) | |
| tree | daa637a54626499d762d638da0b1259bc0470d44 /src/openvpn/options.h | |
| parent | e376a00c2884c7cc3f965cdd08a8b66537264999 (diff) | |
| download | openvpn-b241e815f16bd566a4824d26f381e468917c822b.zip openvpn-b241e815f16bd566a4824d26f381e468917c822b.tar.gz | |
Implement using --peer-fingerprint without CA certificates
This is implements --peer-fingerprint command to support OpenVPN
authentication without involving a PKI.
The current implementation in OpenVPN for peer fingerprint has been already
extensively rewritten from the original submission from Jason [1]. The
commit preserved the original author since it was based on Jason code/idea.
This commit is based on two previous commits that prepare the infrastructure
to use a simple to use --peer-fingerprint directive instead of using
a --tls-verify script like the v1 of the patch proposed. The two commits
preparing this are:
- Extend verify-hash to allow multiple hashes
- Implement peer-fingerprint to check fingerprint of peer certificate
These preceding patches make this actual patch quite short. There are some
lines in this patch that bear some similarity to the ones like
if (!preverify_ok && !session->opt->verify_hash_no_ca)
vs
if (!preverify_ok && !session->opt->ca_file_none)
But these similarities are one line fragments and dictated by the
surrounding style and program flow, so even a complete black box
implementation will likely end up with the same lines.
[1] https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg16781.html
Change-Id: Ie74c3d606c5429455c293c367462244566a936e3
Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20230524132424.3098475-2-arne@rfc2549.org>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26723.html
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit c3746da7f04acf872f251d3673551963380c4d77)
Diffstat (limited to 'src/openvpn/options.h')
| -rw-r--r-- | src/openvpn/options.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/src/openvpn/options.h b/src/openvpn/options.h index 95f1158..f5890b9 100644 --- a/src/openvpn/options.h +++ b/src/openvpn/options.h @@ -604,6 +604,7 @@ struct options struct verify_hash_list *verify_hash; hash_algo_type verify_hash_algo; int verify_hash_depth; + bool verify_hash_no_ca; unsigned int ssl_flags; /* set to SSLF_x flags from ssl.h */ #ifdef ENABLE_PKCS11 |