DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

TLS client: Do not verify CA certificates when ca_cert is not specified

Browse source 
In documentation is written: "If ca_cert and ca_path are not included,
server certificate will not be verified". This is the case when
wpa_supplicant is compiled with OpenSSL library, but when using the
internal TLS implementation and some certificates in CA chain are in
unsupported format (e.g., use SHA384 or SHA512 hash functions) then
verification fails even if ca_cert property is not specified.

This commit changes behavior so that certificate verification in
internal TLS implementation is really skipped when ca_cert is not
specified.

Signed-off-by: Pali Rohár <pali.rohar@gmail.com>
This commit is contained in:
Pali Rohár 2015-11-22 02:02:55 +01:00 committed by Jouni Malinen
parent 9b35afd6ac
commit 3665776e4e
3 changed files with 5 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/tls/tlsv1_client_read.c
View file

@ -364,7 +364,7 @@ static int tls_process_certificate(struct tlsv1_client *conn, u8 ct,
pos += cert_len; pos += cert_len;
} }
if (conn->cred && if (conn->cred && conn->cred->ca_cert_verify &&
x509_certificate_chain_validate(conn->cred->trusted_certs, chain, x509_certificate_chain_validate(conn->cred->trusted_certs, chain,
&reason, conn->disable_time_checks) &reason, conn->disable_time_checks)
< 0) { < 0) {

2
src/tls/tlsv1_cred.c
View file

@ -190,6 +190,8 @@ int tlsv1_set_ca_cert(struct tlsv1_credentials *cred, const char *cert,
const u8 *cert_blob, size_t cert_blob_len, const u8 *cert_blob, size_t cert_blob_len,
const char *path) const char *path)
{ {
cred->ca_cert_verify = cert || cert_blob || path;
if (tlsv1_set_cert_chain(&cred->trusted_certs, cert, if (tlsv1_set_cert_chain(&cred->trusted_certs, cert,
cert_blob, cert_blob_len) < 0) cert_blob, cert_blob_len) < 0)
return -1; return -1;

2
src/tls/tlsv1_cred.h
View file

@ -14,6 +14,8 @@ struct tlsv1_credentials {
struct x509_certificate *cert; struct x509_certificate *cert;
struct crypto_private_key *key; struct crypto_private_key *key;
unsigned int ca_cert_verify:1;
/* Diffie-Hellman parameters */ /* Diffie-Hellman parameters */
u8 *dh_p; /* prime */ u8 *dh_p; /* prime */
size_t dh_p_len; size_t dh_p_len;