1. openvpn
  2. Commit 992e9cec40539a155afa9eae10502aa62f617965
Browse code

Log serial number of revoked certificate

As it appears commit 767e4c56becbfeea525e4695a810593f373883cd "Log
serial number of revoked certificate" hasn't survive refactoring
of CRL handling.

In most of situations admin of OpenVPN server needs to know which
particular certificate is used by client.
In the case when certificate is valid, environment variable can be
used for that but once it is revoked, no user scripts are invoked
so there is no way to get serial number, only subject is logged.

Let's log certificate serial in case it is revoked and additionally
log certificate depth & subject in crl-verify "dir" mode for better
consistency with crl file (non-dir) mode.

v2: log if serial is not availble, require it in crl-verify dir mode

Signed-off-by: Vladislav Grishenko <themiron@yandex-team.ru>
Acked-by: Lev Stipakov <lstipakov@gmail.com>
Message-Id: <20200805102333.3109-1-themiron@yandex-team.ru>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg20642.html
Signed-off-by: Gert Doering <gert@greenie.muc.de>

Vladislav Grishenko authored on 2020/08/05 19:23:33
Showing 3 changed files
src/openvpn/ssl_verify.c
History View file @ 992e9ce
... ... 
@@ -599,7 +599,8 @@ cleanup:
599 599 
  * check peer cert against CRL directory
600 600 
  */
601 601 
 static result_t
602 
-verify_check_crl_dir(const char *crl_dir, openvpn_x509_cert_t *cert)
602 
+verify_check_crl_dir(const char *crl_dir, openvpn_x509_cert_t *cert,
603 
+                     const char *subject, int cert_depth)
603 604 
 {
604 605 
     result_t ret = FAILURE;
605 606 
     char fn[256];
... ... 
@@ -607,6 +608,12 @@ verify_check_crl_dir(const char *crl_dir, openvpn_x509_cert_t *cert)
607 607 
     struct gc_arena gc = gc_new();
608 608
609 609 
     char *serial = backend_x509_get_serial(cert, &gc);
610 
+    if (!serial)
611 
+    {
612 
+        msg(D_HANDSHAKE, "VERIFY CRL: depth=%d, %s, serial number is not available",
613 
+            cert_depth, subject);
614 
+        goto cleanup;
615 
+    }
610 616
611 617 
     if (!openvpn_snprintf(fn, sizeof(fn), "%s%c%s", crl_dir, OS_SPECIFIC_DIRSEP, serial))
612 618 
     {
... ... 
@@ -616,7 +623,8 @@ verify_check_crl_dir(const char *crl_dir, openvpn_x509_cert_t *cert)
616 616 
     fd = platform_open(fn, O_RDONLY, 0);
617 617 
     if (fd >= 0)
618 618 
     {
619 
-        msg(D_HANDSHAKE, "VERIFY CRL: certificate serial number %s is revoked", serial);
619 
+        msg(D_HANDSHAKE, "VERIFY CRL: depth=%d, %s, serial=%s is revoked",
620 
+            cert_depth, subject, serial);
620 621 
         goto cleanup;
621 622 
     }
622 623
... ... 
@@ -758,7 +766,7 @@ verify_cert(struct tls_session *session, openvpn_x509_cert_t *cert, int cert_dep
758 758 
     {
759 759 
         if (opt->ssl_flags & SSLF_CRL_VERIFY_DIR)
760 760 
         {
761 
-            if (SUCCESS != verify_check_crl_dir(opt->crl_file, cert))
761 
+            if (SUCCESS != verify_check_crl_dir(opt->crl_file, cert, subject, cert_depth))
762 762 
             {
763 763 
                 goto cleanup;
764 764 
             }
src/openvpn/ssl_verify_mbedtls.c
History View file @ 992e9ce
... ... 
@@ -68,6 +68,7 @@ verify_callback(void *session_obj, mbedtls_x509_crt *cert, int cert_depth,
68 68 
         int ret = 0;
69 69 
         char errstr[512] = { 0 };
70 70 
         char *subject = x509_get_subject(cert, &gc);
71 
+        char *serial = backend_x509_get_serial(cert, &gc);
71 72
72 73 
         ret = mbedtls_x509_crt_verify_info(errstr, sizeof(errstr)-1, "", *flags);
73 74 
         if (ret <= 0 && !openvpn_snprintf(errstr, sizeof(errstr),
... ... 
@@ -82,8 +83,8 @@ verify_callback(void *session_obj, mbedtls_x509_crt *cert, int cert_depth,
82 82
83 83 
         if (subject)
84 84 
         {
85 
-            msg(D_TLS_ERRORS, "VERIFY ERROR: depth=%d, subject=%s: %s",
86 
-                cert_depth, subject, errstr);
85 
+            msg(D_TLS_ERRORS, "VERIFY ERROR: depth=%d, subject=%s, serial=%s: %s",
86 
+                cert_depth, subject, serial ? serial : "<not available>", errstr);
87 87 
         }
88 88 
         else
89 89 
         {
src/openvpn/ssl_verify_openssl.c
History View file @ 992e9ce
... ... 
@@ -71,6 +71,7 @@ verify_callback(int preverify_ok, X509_STORE_CTX *ctx)
71 71 
     {
72 72 
         /* get the X509 name */
73 73 
         char *subject = x509_get_subject(current_cert, &gc);
74 
+        char *serial = backend_x509_get_serial(current_cert, &gc);
74 75
75 76 
         if (!subject)
76 77 
         {
... ... 
@@ -89,10 +90,10 @@ verify_callback(int preverify_ok, X509_STORE_CTX *ctx)
89 89 
         }
90 90
91 91 
         /* Remote site specified a certificate, but it's not correct */
92 
-        msg(D_TLS_ERRORS, "VERIFY ERROR: depth=%d, error=%s: %s",
92 
+        msg(D_TLS_ERRORS, "VERIFY ERROR: depth=%d, error=%s: %s, serial=%s",
93 93 
             X509_STORE_CTX_get_error_depth(ctx),
94 94 
             X509_verify_cert_error_string(X509_STORE_CTX_get_error(ctx)),
95 
-            subject);
95 
+            subject, serial ? serial : "<not available>");
96 96
97 97 
         ERR_clear_error();
98 98