DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

OpenSSL: Try to ensure we don't throw away the PIN unnecessarily

Browse source 
Now on an engine error we decode the error value and determine if the
issue is due to a true PIN error or not. If it is due to incorrrect PIN,
delete the PIN as usual, but if it isn't let the PIN be.

Signed-off-by: Mike Gerow <gerow@google.com>
This commit is contained in:
Mike Gerow 2015-04-15 17:57:51 -07:00 • committed by Jouni Malinen
parent fabc6dd8c4
commit fd4fb28179
3 changed files with 57 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

29
src/eap_peer/eap_tls_common.c
View file

@ -196,28 +196,25 @@ static int eap_tls_init_connection(struct eap_sm *sm,
}
res = tls_connection_set_params(data->ssl_ctx, data->conn, params);
if (res == TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED) {
if (res == TLS_SET_PARAMS_ENGINE_PRV_BAD_PIN) {
/*
* At this point with the pkcs11 engine the PIN might be wrong.
* We reset the PIN in the configuration to be sure to not use
* it again and the calling function must request a new one.
*/
os_free(config->pin);
config->pin = NULL;
} else if (res == TLS_SET_PARAMS_ENGINE_PRV_VERIFY_FAILED) {
wpa_printf(MSG_INFO, "TLS: Failed to load private key");
/*
* We do not know exactly but maybe the PIN was wrong,
* so ask for a new one.
* At this point with the pkcs11 engine the PIN is wrong. We
* reset the PIN in the configuration to be sure to not use it
* again and the calling function must request a new one.
*/
wpa_printf(MSG_INFO,
"TLS: Bad PIN provided, requesting a new one");
os_free(config->pin);
config->pin = NULL;
eap_sm_request_pin(sm);
sm->ignore = TRUE;
tls_connection_deinit(data->ssl_ctx, data->conn);
data->conn = NULL;
return -1;
} else if (res) {
} else if (res == TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED) {
wpa_printf(MSG_INFO, "TLS: Failed to initialize engine");
} else if (res == TLS_SET_PARAMS_ENGINE_PRV_VERIFY_FAILED) {
wpa_printf(MSG_INFO, "TLS: Failed to load private key");
sm->ignore = TRUE;
}
if (res) {
wpa_printf(MSG_INFO, "TLS: Failed to set TLS connection "
"parameters");
tls_connection_deinit(data->ssl_ctx, data->conn);