From: Steffan Karger Date: Mon, 4 Apr 2016 19:59:38 +0000 (+0200) Subject: PolarSSL x509_get_sha1_hash now returns correct SHA1 fingerprint. X-Git-Tag: v2.4_alpha1~106 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=dd2fbc26eb7b32325793ae3f7d215f46e881e68c;p=thirdparty%2Fopenvpn.git PolarSSL x509_get_sha1_hash now returns correct SHA1 fingerprint. 509_get_sha1_hash() is supposed to return the certificate fingerprint, which is the hash of the entire certificate - including the signature - and not just the 'to be signed' data (cert->tbs in polarssl). This changes externally visible behavior for polarssl builds: it will change the value of the tls_digest_N values exported to the environment for scripts. v2 Steffan Karger: added commit message and Changes.rst entry. Code unchanged from v1 by James. Signed-off-by: James Yonan Signed-off-by: Steffan Karger Acked-by: Arne Schwabe Message-Id: URL: http://article.gmane.org/gmane.network.openvpn.devel/11396 Signed-off-by: Gert Doering --- diff --git a/Changes.rst b/Changes.rst index 93e4bd9da..5034b156b 100644 --- a/Changes.rst +++ b/Changes.rst @@ -63,7 +63,6 @@ User-visible Changes In --static mode connect-timeout specifies the timeout for TCP and proxy connection establishment - - connect-retry now specifies the maximum number of unsucessfully trying all remote/connection entries before exiting. @@ -92,6 +91,10 @@ User-visible Changes * Non-ephemeral key exchange using static (EC)DH keys * DSS private keys +- PolarSSL builds: changed the tls_digest_N values exported to the script + environment to be equal to the ones exported by OpenSSL builds, namely + the certificate fingerprint (was the hash of the 'to be signed' data). + Maintainer-visible changes -------------------------- diff --git a/src/openvpn/ssl_verify_polarssl.c b/src/openvpn/ssl_verify_polarssl.c index d1b9f02fb..73a9af1f7 100644 --- a/src/openvpn/ssl_verify_polarssl.c +++ b/src/openvpn/ssl_verify_polarssl.c @@ -175,7 +175,7 @@ unsigned char * x509_get_sha1_hash (x509_crt *cert, struct gc_arena *gc) { unsigned char *sha1_hash = gc_malloc(SHA_DIGEST_LENGTH, false, gc); - sha1(cert->tbs.p, cert->tbs.len, sha1_hash); + sha1(cert->raw.p, cert->raw.len, sha1_hash); return sha1_hash; }