DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

OpenSSL: Do not accept SSL Client certificate for server

Browse source 
If the extended key usage of the AAA server certificate indicates
that the certificate is for client use, reject the TLS handshake.

Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
This commit is contained in:
Jouni Malinen 2013-12-13 19:20:01 -08:00 committed by Jouni Malinen
parent 6bf61fb288
commit 51e3eafb68
2 changed files with 15 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
src/crypto/tls.h
View file

@ -41,7 +41,8 @@ enum tls_fail_reason {
TLS_FAIL_ALTSUBJECT_MISMATCH = 6, TLS_FAIL_ALTSUBJECT_MISMATCH = 6,
TLS_FAIL_BAD_CERTIFICATE = 7, TLS_FAIL_BAD_CERTIFICATE = 7,
TLS_FAIL_SERVER_CHAIN_PROBE = 8, TLS_FAIL_SERVER_CHAIN_PROBE = 8,
TLS_FAIL_DOMAIN_SUFFIX_MISMATCH = 9 TLS_FAIL_DOMAIN_SUFFIX_MISMATCH = 9,
TLS_FAIL_SERVER_USED_CLIENT_CERT = 10
}; };
union tls_event_data { union tls_event_data {

13
src/crypto/tls_openssl.c
View file

@ -105,6 +105,7 @@ struct tls_connection {
unsigned int ca_cert_verify:1; unsigned int ca_cert_verify:1;
unsigned int cert_probe:1; unsigned int cert_probe:1;
unsigned int server_cert_only:1; unsigned int server_cert_only:1;
unsigned int server:1;
u8 srv_cert_hash[32]; u8 srv_cert_hash[32];
@ -1476,6 +1477,16 @@ static int tls_verify_cb(int preverify_ok, X509_STORE_CTX *x509_ctx)
TLS_FAIL_SERVER_CHAIN_PROBE); TLS_FAIL_SERVER_CHAIN_PROBE);
} }
if (!conn->server && err_cert && preverify_ok && depth == 0 &&
(err_cert->ex_flags & EXFLAG_XKUSAGE) &&
(err_cert->ex_xkusage & XKU_SSL_CLIENT)) {
wpa_printf(MSG_WARNING, "TLS: Server used client certificate");
openssl_tls_fail_event(conn, err_cert, err, depth, buf,
"Server used client certificate",
TLS_FAIL_SERVER_USED_CLIENT_CERT);
preverify_ok = 0;
}
if (preverify_ok && context->event_cb != NULL) if (preverify_ok && context->event_cb != NULL)
context->event_cb(context->cb_ctx, context->event_cb(context->cb_ctx,
TLS_CERT_CHAIN_SUCCESS, NULL); TLS_CERT_CHAIN_SUCCESS, NULL);
@ -2527,6 +2538,8 @@ openssl_handshake(struct tls_connection *conn, const struct wpabuf *in_data,
int res; int res;
struct wpabuf *out_data; struct wpabuf *out_data;
conn->server = !!server;
/* /*
* Give TLS handshake data from the server (if available) to OpenSSL * Give TLS handshake data from the server (if available) to OpenSSL
* for processing. * for processing.