Refactored client_config_dir_exclusive function

Signed-off-by: Adriaan de Jong <dejong@fox-it.com>
Acked-by: James Yonan <james@openvpn.net>
Signed-off-by: David Sommerseth <davids@redhat.com>

diff --git a/ssl.c b/ssl.c
index 54d9f30552aa638f7eb630a981e90a18e7e54154..fe1c277cb21401dd0dd1741c86decfec565175ad 100644 (file)
--- a/ssl.c
+++ b/ssl.c
@@ -3434,18 +3434,10 @@ key_method_2_read (struct buffer *buf, struct tls_multi *multi, struct tls_sessi
        }
     }
 
-  /* verify --client-config-dir based authentication */
-  if (ks->authenticated && session->opt->client_config_dir_exclusive)
+  /* Perform final authentication checks */
+  if (ks->authenticated)
     {
-      const char *cn = session->common_name;
-      const char *path = gen_path (session->opt->client_config_dir_exclusive, cn, &gc);
-      if (!cn || !strcmp (cn, CCD_DEFAULT) || !test_file (path))
-       {
-         ks->authenticated = false;
-         msg (D_TLS_ERRORS, "TLS Auth Error: --client-config-dir authentication failed for common name '%s' file='%s'",
-              session->common_name,
-              path ? path : "UNDEF");
-       }
+      verify_final_auth_checks(multi, session);
     }
 
 #ifdef ENABLE_OCC

diff --git a/ssl_verify.c b/ssl_verify.c
index df22b592017140e4474681bf946735bddd084003..4d1935914950af2b9ea707a04ba35c448c4673c2 100644 (file)
--- a/ssl_verify.c
+++ b/ssl_verify.c
@@ -36,3 +36,26 @@
 #ifdef USE_OPENSSL
 #include "ssl_verify_openssl.h"
 #endif
+
+void
+verify_final_auth_checks(struct tls_multi *multi, struct tls_session *session)
+{
+  /* verify --client-config-dir based authentication */
+  if (session->opt->client_config_dir_exclusive)
+    {
+      struct key_state *ks = &session->key[KS_PRIMARY];           /* primary key */
+      struct gc_arena gc = gc_new ();
+
+      const char *cn = session->common_name;
+      const char *path = gen_path (session->opt->client_config_dir_exclusive, cn, &gc);
+      if (!cn || !strcmp (cn, CCD_DEFAULT) || !test_file (path))
+       {
+         ks->authenticated = false;
+         msg (D_TLS_ERRORS, "TLS Auth Error: --client-config-dir authentication failed for common name '%s' file='%s'",
+              session->common_name,
+              path ? path : "UNDEF");
+       }
+
+      gc_free (&gc);
+    }
+}

diff --git a/ssl_verify.h b/ssl_verify.h
index 19e0bdc779c95c217e49f3f957a2ffa8b2af9b9b..1944a0f16913895b0c228a257a45c9cb02cb434b 100644 (file)
--- a/ssl_verify.h
+++ b/ssl_verify.h
@@ -40,5 +40,16 @@
 #include "ssl_verify_openssl.h"
 #endif
 
+/**
+ * Perform final authentication checks, including locking of the cn, the allowed
+ * certificate hashes, and whether a client config entry exists in the
+ * client config directory.
+ *
+ * @param multi                The TLS multi structure to verify locked structures.
+ * @param session      The current TLS session
+ *
+ */
+void verify_final_auth_checks(struct tls_multi *multi, struct tls_session *session);
+
 
 #endif /* SSL_VERIFY_H_ */