OpenVPN/openvpn
1
0
Fork 0
mirror of https://github.com/OpenVPN/openvpn.git synced 2025-05-09 05:31:05 +08:00
Code Issues Packages Projects Releases Wiki Activity

Add bracket in fingerprint message and do not warn about missing verification

Browse Source 
Github: fixes OpenVPN/openvpn#516

Change-Id: Ia73d53002f4ba2658af18c17cce1b68f79de5781
Signed-off-by: Arne Schwabe <arne-openvpn@rfc2549.org>
Acked-by: Frank Lichtenheld <frank@lichtenheld.com>
Message-Id: <20240326103853.494572-1-frank@lichtenheld.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28474.html
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 4b95656536be1f402a55ef5dffe140fa78e7eb51)
This commit is contained in:
Arne Schwabe 2024-03-26 11:38:53 +01:00 committed by Gert Doering
parent 5591af1769
commit e36359aa7e
2 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/openvpn/init.c
View File

@ -3632,7 +3632,8 @@ do_option_warnings(struct context *c)
&& !o->tls_verify
&& o->verify_x509_type == VERIFY_X509_NONE
&& !(o->ns_cert_type & NS_CERT_CHECK_SERVER)
&& !o->remote_cert_eku)
&& !o->remote_cert_eku
&& !(o->verify_hash_depth == 0 && o->verify_hash))
{
msg(M_WARN, "WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.");
}

4
src/openvpn/ssl_verify.c
View File

@ -718,8 +718,8 @@ verify_cert(struct tls_session *session, openvpn_x509_cert_t *cert, int cert_dep
const char *hex_fp = format_hex_ex(BPTR(&cert_fp), BLEN(&cert_fp),
0, 1, ":", &gc);
msg(D_TLS_ERRORS, "TLS Error: --tls-verify/--peer-fingerprint"
"certificate hash verification failed. (got "
"fingerprint: %s", hex_fp);
"certificate hash verification failed. (got certificate "
"fingerprint: %s)", hex_fp);
goto cleanup;
}
}