DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

Allow TLS flags to be configured (allow MD5, disable time checks)

Browse source 
Undocumented (at least for the time being) TLS parameters can now
be provided in wpa_supplicant configuration to enable some workarounds
for being able to connect insecurely to some networks. phase1 and
phase2 network parameters can use following options:
tls_allow_md5=1
- allow MD5 signature to be used (disabled by default with GnuTLS)
tls_disable_time_checks=1
- ignore certificate expiration time

For now, only the GnuTLS TLS wrapper implements support for these.
This commit is contained in:
Jouni Malinen 2009-12-20 19:28:47 +02:00
parent 4a1e97790d
commit 2944656925
3 changed files with 43 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

14
src/eap_peer/eap_tls_common.c
View file

@ -45,6 +45,18 @@ static int eap_tls_check_blob(struct eap_sm *sm, const char **name,
}
static void eap_tls_params_flags(struct tls_connection_params *params,
const char *txt)
{
if (txt == NULL)
return;
if (os_strstr(txt, "tls_allow_md5=1"))
params->flags |= TLS_CONN_ALLOW_SIGN_RSA_MD5;
if (os_strstr(txt, "tls_disable_time_checks=1"))
params->flags |= TLS_CONN_DISABLE_TIME_CHECKS;
}
static void eap_tls_params_from_conf1(struct tls_connection_params *params,
struct eap_peer_config *config)
{
@ -62,6 +74,7 @@ static void eap_tls_params_from_conf1(struct tls_connection_params *params,
params->key_id = config->key_id;
params->cert_id = config->cert_id;
params->ca_cert_id = config->ca_cert_id;
eap_tls_params_flags(params, config->phase1);
}
@ -82,6 +95,7 @@ static void eap_tls_params_from_conf2(struct tls_connection_params *params,
params->key_id = config->key2_id;
params->cert_id = config->cert2_id;
params->ca_cert_id = config->ca_cert2_id;
eap_tls_params_flags(params, config->phase2);
}