GitLab/ocserv
1
0
Fork 0
mirror of https://gitlab.com/openconnect/ocserv.git synced 2026-10-14 02:22:03 +08:00
Code Issues Packages Projects Releases Wiki Activity

In certificate verification separate between no certificate and verification failure

Browse Source
This commit is contained in:
Nikos Mavrogiannopoulos
2015-02-19 11:47:20 +01:00
parent 370fa01de6
commit e865dcb354
1 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/tlslib.c
+7 -6
View File
@@ -368,6 +368,10 @@ static int verify_certificate_cb(gnutls_session_t session)
* structure. So you must have installed one or more CA certificates. * structure. So you must have installed one or more CA certificates.
*/ */
ret = gnutls_certificate_verify_peers2(session, &status); ret = gnutls_certificate_verify_peers2(session, &status);
if (ret == GNUTLS_E_NO_CERTIFICATE_FOUND) {
oclog(ws, LOG_ERR, "no certificate was found");
goto no_cert;
}
if (ret < 0) { if (ret < 0) {
oclog(ws, LOG_ERR, "error verifying client certificate: %s", gnutls_strerror(ret)); oclog(ws, LOG_ERR, "error verifying client certificate: %s", gnutls_strerror(ret));
goto fail; goto fail;
@@ -395,14 +399,11 @@ static int verify_certificate_cb(gnutls_session_t session)
/* notify gnutls to continue handshake normally */ /* notify gnutls to continue handshake normally */
return 0; return 0;
fail: no_cert:
/* In cisco client compatibility we don't hangup immediately, we
* simply use the flag (ws->cert_auth_ok). */
if (ws->config->cisco_client_compat != 0 || ws->config->cert_req != GNUTLS_CERT_REQUIRE) if (ws->config->cisco_client_compat != 0 || ws->config->cert_req != GNUTLS_CERT_REQUIRE)
return 0; return 0;
else fail:
return GNUTLS_E_CERTIFICATE_ERROR; return GNUTLS_E_CERTIFICATE_ERROR;
} }
void tls_global_init(tls_st *creds) void tls_global_init(tls_st *creds)