Fix certificate serial number export

    contrib/OCSP_check/OCSP_check.sh:
             New barebone script to demonstrate how to use $tls_serial_{n}
             to perform simple OCSP queries using OpenSSL command line
             "openssl ocsp". Minimal sanity checks to fail if user tries to
             use it without customizing.

    openvpn.8:
             Added some notes about $tls_serial_{n} format and usage to the
             existing description.

    ssl.c:
             correctly manage and export serial numbers of any size (as
             parsed by OpenSSL) into the environment. Set to empty string
             in case of errors, as 0 and negative numbers are all possible
             (although illegal) certificate serial numbers. Use an OpenSSL
             BIO object to do the job. Conforms to coding style guidelines.

    See the discussion at

    http://article.gmane.org/gmane.network.openvpn.devel/3588

    for more details.

Signed-off-by: Davide Brini <dave_br@gmx.com>
Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
Acked-by: David Sommerseth <dazo@users.sourceforge.net>

1 files changed, 24 insertions, 3 deletions

diff --git a/ssl.c b/ssl.c
index 1ed5ace..e1c6363 100644
--- a/ssl.c
+++ b/ssl.c
@@ -788,9 +788,30 @@ verify_callback (int preverify_ok, X509_STORE_CTX * ctx)
 
   /* export serial number as environmental variable */
   {
-    const int serial = (int) ASN1_INTEGER_get (X509_get_serialNumber (ctx->current_cert));
-    openvpn_snprintf (envname, sizeof(envname), "tls_serial_%d", ctx->error_depth);
-    setenv_int (opt->es, envname, serial);
+    BIO *bio = NULL;
+    char serial[100];
+    int n1, n2;
+
+    CLEAR (serial);
+    if ((bio = BIO_new (BIO_s_mem ())) == NULL)
+      {
+        msg (M_WARN, "CALLBACK: Cannot create BIO (for tls_serial_%d)", ctx->error_depth);
+      }
+    else
+      {
+        /* "prints" the serial number onto the BIO and read it back */
+        if ( ! ( ( (n1 = i2a_ASN1_INTEGER(bio, X509_get_serialNumber (ctx->current_cert))) >= 0 ) &&
+                 ( (n2 = BIO_read (bio, serial, sizeof (serial)-1)) >= 0 ) &&
+                 ( n1 == n2 ) ) )
+          {
+            msg (M_WARN, "CALLBACK: Error reading/writing BIO (for tls_serial_%d)", ctx->error_depth);
+            CLEAR (serial);     /* empty string */
+          }
+
+        openvpn_snprintf (envname, sizeof(envname), "tls_serial_%d", ctx->error_depth);
+        setenv_str (opt->es, envname, serial);
+        BIO_free(bio);
+      }
   }
 
   /* export current untrusted IP */