diff options
| author | Arne Schwabe | 2024-03-26 11:38:53 +0100 |
|---|---|---|
| committer | Gert Doering | 2024-03-26 12:31:40 +0100 |
| commit | 4b95656536be1f402a55ef5dffe140fa78e7eb51 (patch) | |
| tree | 06a73a2c360e76a39b49297b21c05ee71060db35 /src/openvpn | |
| parent | 6889d9e2f1458272ded4c035df40378ace3d7395 (diff) | |
| download | openvpn-4b95656536be1f402a55ef5dffe140fa78e7eb51.zip openvpn-4b95656536be1f402a55ef5dffe140fa78e7eb51.tar.gz | |
Add bracket in fingerprint message and do not warn about missing verification
Github: fixes OpenVPN/openvpn#516
Change-Id: Ia73d53002f4ba2658af18c17cce1b68f79de5781
Signed-off-by: Arne Schwabe <arne-openvpn@rfc2549.org>
Acked-by: Frank Lichtenheld <frank@lichtenheld.com>
Message-Id: <20240326103853.494572-1-frank@lichtenheld.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28474.html
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Diffstat (limited to 'src/openvpn')
| -rw-r--r-- | src/openvpn/init.c | 3 | ||||
| -rw-r--r-- | src/openvpn/ssl_verify.c | 4 |
2 files changed, 4 insertions, 3 deletions
diff --git a/src/openvpn/init.c b/src/openvpn/init.c index f2ce926..02205e7 100644 --- a/src/openvpn/init.c +++ b/src/openvpn/init.c @@ -3594,7 +3594,8 @@ do_option_warnings(struct context *c) && !o->tls_verify && o->verify_x509_type == VERIFY_X509_NONE && !(o->ns_cert_type & NS_CERT_CHECK_SERVER) - && !o->remote_cert_eku) + && !o->remote_cert_eku + && !(o->verify_hash_depth == 0 && o->verify_hash)) { msg(M_WARN, "WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info."); } diff --git a/src/openvpn/ssl_verify.c b/src/openvpn/ssl_verify.c index c7d7799..930769b 100644 --- a/src/openvpn/ssl_verify.c +++ b/src/openvpn/ssl_verify.c @@ -718,8 +718,8 @@ verify_cert(struct tls_session *session, openvpn_x509_cert_t *cert, int cert_dep const char *hex_fp = format_hex_ex(BPTR(&cert_fp), BLEN(&cert_fp), 0, 1, ":", &gc); msg(D_TLS_ERRORS, "TLS Error: --tls-verify/--peer-fingerprint" - "certificate hash verification failed. (got " - "fingerprint: %s", hex_fp); + "certificate hash verification failed. (got certificate " + "fingerprint: %s)", hex_fp); goto cleanup; } } |