Attention is currently required from: flichtenheld, plaisthos. MaxF has posted comments on this change by MaxF. ( http://gerrit.openvpn.net/c/openvpn/+/1801?usp=email )
Change subject: Make --x509-username-field work with Mbed TLS ...................................................................... Patch Set 3: (2 comments) File src/openvpn/ssl_verify_mbedtls.c: http://gerrit.openvpn.net/c/openvpn/+/1801/comment/9a79f378_a3860b2f?usp=email : PS2, Line 245: if (cn_index >= cn_len) > Strictly speaking we can abort here if `>= cn_len -1` since we always write 2 > characters I think the check should be cn_index > cn_len - 3, because we also need room for the '/0' byte. File tests/unit_tests/openvpn/test_ssl.c: http://gerrit.openvpn.net/c/openvpn/+/1801/comment/e0f5f42c_5c365a91?usp=email : PS2, Line 844: ret = backend_x509_get_username(username, sizeof(username), "serialNumber", cert); > Probably should add an additional test to exercise the length checks? I added that, and I noticed that the OpenSSL and Mbed TLS functions behaved differently when the buffer was too small. (The Mbed TLS version silently truncated the output.) So now I've also changed the behavior of the Mbed TLS function to match the OpenSSL version. -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/1801?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: Ic183f1f1f90561454b7b1128c95255368427cc4a Gerrit-Change-Number: 1801 Gerrit-PatchSet: 3 Gerrit-Owner: MaxF <[email protected]> Gerrit-Reviewer: flichtenheld <[email protected]> Gerrit-Reviewer: plaisthos <[email protected]> Gerrit-CC: openvpn-devel <[email protected]> Gerrit-Attention: plaisthos <[email protected]> Gerrit-Attention: flichtenheld <[email protected]> Gerrit-Comment-Date: Wed, 22 Jul 2026 15:20:17 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: flichtenheld <[email protected]>
_______________________________________________ Openvpn-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-devel
