This adds one more step in completing hs20-osu-client support when using
BoringSSL instead of OpenSSL. EST client can now parse the cacerts file.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This adds experimental support for using OCSP with libcurl that is built
against BoringSSL. This needs small modifications to libcurl to allow
CURLOPT_SSL_VERIFYSTATUS to be used to call
SSL_enable_ocsp_stapling(connssl->handle) in ossl_connect_step1().
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
BoringSSL has dropped OpenSSL functionality that was used in the EST
implementation. For now, disable EST with BoringSSL to allow
hs20-osu-client to be built.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
fqdn was not freed before return in case the server uses an unsupported
location for the PPS MO in the addMO command.
Signed-off-by: Nishant Chaprana <n.chaprana@samsung.com>
Allow user to specify the path to the spp.xsd file for hs20-osu-client
instead of requiring this to be spp.xsd in the current working
directory.
Signed-off-by: Ben Greear <greearb@candelatech.com>
This gives more flexibility when generating keys so that users do not
have to edit files to generate their own specific keys.
Update HS 2.0 OSU server notes as well.
Signed-off-by: Ben Greear <greearb@candelatech.com>
The command line option 'i' is not handled, so I assume it should
not be in the short-options list.
Fix missing word in error message as well.
Signed-off-by: Ben Greear <greearb@candelatech.com>
In case someone is compiling their own libcurl and wants to link it
statically, for instance, the new CUST_CURL_LINKAGE parameter can be
used to override the default -lcurl argument.
Signed-off-by: Ben Greear <greearb@candelatech.com>
In some error cases, pointers were dereferenced before NULL check is
done. Fix this by adding checks before the dereference.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
These hs20-osu-client parameters were never applicable for Android
builds and were just copied from the non-Android Makefile as a reminder,
but not removed once rest of the Android build was fixed.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
These need to be done in the libxml2 build, not in hs20-osu-client. This
workaround was previously used to allow parts of the build to go
through, but that was not a complete fix and resulted in warnings now
that external/libxml2 in Android 5.0 is defining the same parameters.
Remove these from hs20-osu-client Android.mk to avoid that warning.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Numbers of hs20-osu-client functions do not use all of the parameters
currently. This makes the compiler output difficult to read due to
undesired warning messages. Get rid of those specific warnings for now.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
The LOCAL_EXPORT_C_INCLUDE_DIRS from ICU did not seem to fully resolve
the build (e.g., "mm -B" failed to build, but following that with "mm"
allowed the build to complete). For now, add the include directory
manually here for Android 5.0.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
As part of OSU, the AAA TrustRoot cert is downloaded into SP/<fqdn>
directory. On Android, wpa_supplicant runs with Wifi uid privileges, and
hence might not have read access to the AAA TrustRoot present SP/<fqdn>
directory. Hence, make AID_WIFI as the group owner of SP/<fqdn>
directory and allow the members of AID_WIFI group to read files present
in this directory.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Add password and machine_managed flag to database in case of machine
managed subscription to fix EAP-TTLS connection failure to production
AP. In case of user managed subscription, the entered password is added
to DB from the PHP script. However in machine managed subscription,
machine generated password is added only in SOAP messages and PPS MO. So
connection to production will fail as the generated password is not
present in the database used by AAA server.
Signed-off-by: Sreenath Sharma <sreenath.mailing.lists@gmail.com>
Incorrect TrustRoot path "PolicyUpdate/TrustRoot" was used. The
TrustRoot path is required to be "Policy/PolicyUpdate/TrustRoot" as
defined in Section 9.1 of Hotspot 2.0 (Release 2) specification. Fix the
path to "Policy/PolicyUpdate/TrustRoot".
Signed-off-by: ASHUTOSH NARAYAN <ashutoshx.narayan@intel.com>
Previously, both failure and success cases used same return value 0.
Indicate failures differently to make hs20-osu-client return value more
useful for subscription remediation cases.
Signed-off-by: ASHUTOSH NARAYAN <ashutoshx.narayan@intel.com>
Use an explicit memset call to clear any hs20-osu-client configuration
parameter that contains private information like keys or identity. This
brings in an additional layer of protection by reducing the length of
time this type of private data is kept in memory.
Signed-off-by: Jouni Malinen <j@w1.fi>
This is meant mainly for testing purposes and as a reference
implementation showing how OSU SPP server could be implemented. This is
not suitable for any real production use in its current form.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
deinit_ctx() may print debug information, so do not call
wpa_debug_close_file() before deinit_ctx().
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
OCSP validation is required only for the OSU operations and since the
EST server may use a different server certificate, it may not
necessarily support OCSP.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
There is no requirement for the EST server to use an OSU server
certificate, so do not require friendly name and icon hash matches for
EST cases.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Some of the code paths could have ended up ignoring CA file name from
command line due to overly complex way of setting ctx->ca_fname.
Configure this more consistently in osu_client.c as soon as the CA file
name has been determined.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This hs20-osu-client client command can be used to parse a DER encoded
X.509v3 certificate with the logotype extensions and
id-wfa-hotspot-friendlyName values shown in detail.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This adds a reference implementation of Hotspot 2.0 Release 2 OSU
client. While this implements all of the required functionality, it is
likely that a significant extensions would be used to integrate this
with user interfaces and operating system configuration components.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
