ssl_verify_openssl.c: missing CRL errors cause omission of verify_cert() routine

[sdl]

In ssl_verify_openssl.c, line 80:
/* Log and ignore missing CRL errors */

If certificate error is X509_V_ERR_UNABLE_TO_GET_CRL, which is considered here as warning only, this IF branch performs:

ret = 1;
goto cleanup;

... causing omission of the subsequent verify_cert() (line 103) procedure.

[plaisthos]

Yes, but I am not seeing the problem here. The branch you are talking about is only called if the we end up with an error anyway ( if (!preverify_ok))

[sdl]

Yes, the branch is only called (if (!preverify_ok)). This means something is wrong with the certificate. But from the crypto library's point of view only. The OpenVPN project itself has been designed so there's an ssl reported certificate error (missing CRL), which is cosidered as a warning only with logging, not an error, in this piece of code. So this kind of error makes OpenVPN not reject connection, but proceed with it. And in this case, the following verify_cert() procedure has to be called to ensure OpenVPN's own certificate checks. In the current code, in case of missing CRL errors, verify_cert() procedure is omitted by "goto cleanup" statement, returning "ret = 1" immediately as success, which is a bug.

[tct]

cc

[Gert Döring]

@syzzer: can I interest you in having a look?