Properly handle certificate serial numbers > 32 bits.

Version 2.1.3h

git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@6931 e7ae566f-a301-0410-adde-c780ea21d3b5

diff --git a/ssl.c b/ssl.c
index f1f0688b895ea3f7c56557359b4794ba74e0cb45..16e4c096022562845393555afff5dcfb9e6afa59 100644 (file)
--- a/ssl.c
+++ b/ssl.c
@@ -912,11 +912,19 @@ verify_callback (int preverify_ok, X509_STORE_CTX * ctx)
   setenv_str (opt->es, envname, common_name);
 #endif
 
-  /* export serial number as environmental variable */
+  /* export serial number as environmental variable,
+     use bignum in case serial number is large */
   {
-    const int serial = (int) ASN1_INTEGER_get (X509_get_serialNumber (ctx->current_cert));
+    ASN1_INTEGER *asn1_i;
+    BIGNUM *bignum;
+    char *dec;
+    asn1_i = X509_get_serialNumber(ctx->current_cert);
+    bignum = ASN1_INTEGER_to_BN(asn1_i, NULL);
+    dec = BN_bn2dec(bignum);
     openvpn_snprintf (envname, sizeof(envname), "tls_serial_%d", ctx->error_depth);
-    setenv_int (opt->es, envname, serial);
+    setenv_str (opt->es, envname, dec);
+    BN_free(bignum);
+    OPENSSL_free(dec);
   }
 
   /* export current untrusted IP */

diff --git a/version.m4 b/version.m4
index 2ca07396a56f83e669cdbf3a2aab34c7ee9ff0cb..72d6ea27b1aa8244c624fe2450febf67552fec01 100644 (file)
--- a/version.m4
+++ b/version.m4
@@ -1,5 +1,5 @@
 dnl define the OpenVPN version
-define(PRODUCT_VERSION,[2.1.3g])
+define(PRODUCT_VERSION,[2.1.3h])
 dnl define the TAP version
 define(PRODUCT_TAP_ID,[tap0901])
 define(PRODUCT_TAP_WIN32_MIN_MAJOR,[9])