[pve-devel] [PATCH v3 proxmox-websocket-tunnel 3/4] add fingerprint validation
Fabian Ebner
f.ebner at proxmox.com
Tue Jan 4 12:37:30 CET 2022
Am 22.12.21 um 14:52 schrieb Fabian Grünbichler:
> in case we have no explicit fingerprint, we use openssl's regular "PEER"
> verification. if we have a fingerprint, we ignore openssl altogether and
> just verify the fingerprint of the presented leaf certificate.
>
> Signed-off-by: Fabian Grünbichler <f.gruenbichler at proxmox.com>
> ---
>
> Notes:
> v3: switch to using hex instead of no-longer-existing digest_to_hex
> v2: new
>
> src/main.rs | 47 ++++++++++++++++++++++++++++++++++++++++++++---
> 1 file changed, 44 insertions(+), 3 deletions(-)
>
> diff --git a/src/main.rs b/src/main.rs
> index 582214c..49d6ffe 100644
> --- a/src/main.rs
> +++ b/src/main.rs
> @@ -134,9 +134,50 @@ impl CtrlTunnel {
> }
>
> let mut ssl_connector_builder = SslConnector::builder(SslMethod::tls())?;
> - if fingerprint.is_some() {
> - // FIXME actually verify fingerprint via callback!
> - ssl_connector_builder.set_verify(openssl::ssl::SslVerifyMode::NONE);
> + if let Some(expected) = fingerprint {
> + ssl_connector_builder.set_verify_callback(
> + openssl::ssl::SslVerifyMode::NONE,
> + move |_valid, ctx| {
> + let cert = match ctx.current_cert() {
> + Some(cert) => cert,
> + None => {
> + eprintln!("SSL context lacks current certificate.");
> + return false;
> + }
> + };
> +
> + let depth = ctx.error_depth();
> + if depth != 0 {
> + return true;
> + }
Sorry about my ignorance. Does using SslVerifyMode::NONE imply that
there is an error? At depth 0? Why is it fine to return true if not?
> +
> + let fp = match cert.digest(openssl::hash::MessageDigest::sha256()) {
> + Ok(fp) => fp,
> + Err(err) => {
> + // should not happen
> + eprintln!("failed to calculate certificate FP - {}", err);
> + return false;
> + }
> + };
> + let fp_string = hex::encode(&fp);
> + let fp_string = fp_string
> + .as_bytes()
> + .chunks(2)
> + .map(|v| std::str::from_utf8(v).unwrap())
> + .collect::<Vec<&str>>()
> + .join(":");
> +
> + let expected = expected.to_lowercase();
> + if expected == fp_string {
> + true
> + } else {
> + eprintln!("certificate fingerprint does not match expected fingerprint!");
> + eprintln!("expected: {}", expected);
> + eprintln!("encountered: {}", fp_string);
> + false
> + }
> + },
> + );
> } else {
> ssl_connector_builder.set_verify(openssl::ssl::SslVerifyMode::PEER);
> }
More information about the pve-devel
mailing list