Proxmox/pve-apiclient
5
0
Fork 0
mirror of git://git.proxmox.com/git/pve-apiclient.git synced 2024-12-21 13:34:10 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix validation of self-signed cert chains

Browse Source 
The interface here is a bit weird - if the verify callback returns 1
for a certificate higher up in the chain, this will propagate to the
next invocation of the callback for the next certificate, even if
openssl on its own would not trust the certificate.

By re-ordering the checks and keeping track of the fact that we
returned 1 despite openssl failing its own validation, the validation
logic should now cover all combinations of certificate count and
self-signed/system trust status.

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
This commit is contained in:
Fabian Grünbichler 2024-03-26 09:15:02 +01:00 committed by Thomas Lamprecht
parent dfee5e09ac
commit 6c8c78d01a
1 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/PVE/APIClient/LWP.pm
View File

@ -415,11 +415,18 @@ sub new {
$ssl_opts->{'SSL_verify_callback'} = sub {
my ($openssl_valid, undef, undef, undef, $cert, $depth) = @_;
# we don't care about intermediate or root certificates
return 1 if $depth != 0;
return 1 if $trust_openssl && $openssl_valid;
# Openssl encountered validation error, only allow validation to
# pass if fingerprint is verified
$trust_openssl = 0;
# We don't care about intermediate or root certificates if we don't
# trust openssl's validation result
return 1 if $depth != 0;
# We've reached the leaf certificate and the chain didn't pass
# openssl's validation - let's verify the fingerprint!
return verify_cert_callback($fingerprints, $cert, $verify_fingerprint_cb);
}
}