Re: [PATCH 5/7] server: Add boolean config option "verify_peername" under "[authenticate.server]".

[Ken Milmore <ken.milmore@gmail.com>]

On 08/06/2025 19:30, Chuck Lever wrote:
> Perhaps a better option would be to test the socket's source address
> against the certificate's SAN field, if the SAN field contains one or
> more IP addresses. For a client with DHCP-assigned IP addresses, simply
> don't put an IP address in its certificate.

Well that's effectively what happens if you pass a textualized IP address to gnutls_certificate_verify_peers3(),
it is checked against the SAN as per RFC6125. But see the "verify_peeraddr" patch for that.
 
> 
> That check could then be enabled all the time, and perhaps could be
> changed to "warn" instead of "reject".
> 
> Still, this feels a little unnecessary. If a client's certificate is
> used by another peer, that means both the certificate and the client's
> private key are compromised. The usual way to handle that is with a
> certificate revocation.
> 

Yes, but again, this is not to intended to guard against certificate leakage.
It is to enable secure discrimination between peers, otherwise clients can access each other's shares if they simply change IP address.

Clearly if you implement tags or some other mechanism of securely linking the certificate to the client, then that would also work
and would be more flexible.

This works and is useful for some limited use cases, which happen to include my use case! ;-)