Re: [pve-devel] [PATCH v3 proxmox-websocket-tunnel 3/4] add fingerprint validation

[Fabian Ebner <f.ebner@proxmox.com>]

Am 22.12.21 um 14:52 schrieb Fabian Grünbichler:
> in case we have no explicit fingerprint, we use openssl's regular "PEER"
> verification. if we have a fingerprint, we ignore openssl altogether and
> just verify the fingerprint of the presented leaf certificate.
> 
> Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
> ---
> 
> Notes:
>      v3: switch to using hex instead of no-longer-existing digest_to_hex
>      v2: new
> 
>   src/main.rs | 47 ++++++++++++++++++++++++++++++++++++++++++++---
>   1 file changed, 44 insertions(+), 3 deletions(-)
> 
> diff --git a/src/main.rs b/src/main.rs
> index 582214c..49d6ffe 100644
> --- a/src/main.rs
> +++ b/src/main.rs
> @@ -134,9 +134,50 @@ impl CtrlTunnel {
>           }
>   
>           let mut ssl_connector_builder = SslConnector::builder(SslMethod::tls())?;
> -        if fingerprint.is_some() {
> -            // FIXME actually verify fingerprint via callback!
> -            ssl_connector_builder.set_verify(openssl::ssl::SslVerifyMode::NONE);
> +        if let Some(expected) = fingerprint {
> +            ssl_connector_builder.set_verify_callback(
> +                openssl::ssl::SslVerifyMode::NONE,
> +                move |_valid, ctx| {
> +                    let cert = match ctx.current_cert() {
> +                        Some(cert) => cert,
> +                        None => {
> +                            eprintln!("SSL context lacks current certificate.");
> +                            return false;
> +                        }
> +                    };
> +
> +                    let depth = ctx.error_depth();
> +                    if depth != 0 {
> +                        return true;
> +                    }

Sorry about my ignorance. Does using SslVerifyMode::NONE imply that 
there is an error? At depth 0? Why is it fine to return true if not?

> +
> +                    let fp = match cert.digest(openssl::hash::MessageDigest::sha256()) {
> +                        Ok(fp) => fp,
> +                        Err(err) => {
> +                            // should not happen
> +                            eprintln!("failed to calculate certificate FP - {}", err);
> +                            return false;
> +                        }
> +                    };
> +                    let fp_string = hex::encode(&fp);
> +                    let fp_string = fp_string
> +                        .as_bytes()
> +                        .chunks(2)
> +                        .map(|v| std::str::from_utf8(v).unwrap())
> +                        .collect::<Vec<&str>>()
> +                        .join(":");
> +
> +                    let expected = expected.to_lowercase();
> +                    if expected == fp_string {
> +                        true
> +                    } else {
> +                        eprintln!("certificate fingerprint does not match expected fingerprint!");
> +                        eprintln!("expected:    {}", expected);
> +                        eprintln!("encountered: {}", fp_string);
> +                        false
> +                    }
> +                },
> +            );
>           } else {
>               ssl_connector_builder.set_verify(openssl::ssl::SslVerifyMode::PEER);
>           }