DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions
hostapd/src/crypto
History
Jouni Malinen 21cb63fffd OpenSSL: Fix client certificate chain building after PKCS#12 use 
If wpa_supplicant was first configured with PKCS #12 -based client
certificate chain and then used with another network profile that used a
different certificate chain from a X.509 certificate PEM file instead of
PKCS#12, the extra certificate chain was not reconstructed properly with
older versions of OpenSSL that 1.0.2. This could result in the
authentication failing due to the client certificate chain not being
complete or including incorrect certificates.

Fix this by clearing the extra certificate chain when setting up a new
TLS connection with OpenSSL 1.0.1. This allows OpenSSL to build the
chain using the default mechanism in case the new TLS exchange does not
use PKCS#12.

The following hwsim test case sequence was able to find the issue:
ap_wpa2_eap_tls_pkcs12 ap_wpa2_eap_tls_intermediate_ca_ocsp

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-07 17:54:23 +02:00
..
.gitignore Add rules for building src/crypto as a library 2009-12-05 22:03:46 +02:00
aes-cbc.c Add TEST_FAIL() condition to aes_128_cbc_encrypt/decrypt() 2015-11-28 20:46:36 +02:00
aes-ccm.c AES-CCM: Use os_memcmp_const() for hash/password comparisons 2014-07-02 12:38:47 +03:00
aes-ctr.c Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00
aes-eax.c crypto: Clear temporary heap allocations before freeing 2015-01-06 02:49:13 +02:00
aes-encblock.c Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00
aes-gcm.c AES-GCM: Use os_memcmp_const() for hash/password comparisons 2014-07-02 12:38:47 +03:00
aes-internal-dec.c Add support for using 192-bit and 256-bit keys with AES-GCM 2012-09-09 13:30:51 +03:00
aes-internal-enc.c Add support for using 192-bit and 256-bit keys with AES-GCM 2012-09-09 13:30:51 +03:00
aes-internal.c Add support for using 192-bit and 256-bit keys with AES-GCM 2012-09-09 13:30:51 +03:00
aes-omac1.c tests: Add TEST_FAIL() condition to omac1_aes_vector() 2015-10-17 20:40:36 +03:00
aes-siv.c crypto: Clear temporary heap allocations before freeing 2015-01-06 02:49:13 +02:00
aes-unwrap.c AES: Extend key wrap implementation to support longer data 2014-10-07 14:57:10 +03:00
aes-wrap.c AES: Extend key wrap implementation to support longer data 2014-10-07 14:57:10 +03:00
aes.h Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00
aes_i.h Add support for using 192-bit and 256-bit keys with AES-GCM 2012-09-09 13:30:51 +03:00
aes_siv.h Implement RFC 5297 AES-SIV 2014-10-19 12:43:38 +03:00
aes_wrap.h Extend AES-CMAC routines to support 256-bit keys 2015-01-24 19:37:42 +02:00
crypto.h crypto: Add CRYPTO_HASH_ALG_SHA384 and CRYPTO_HASH_ALG_SHA512 2015-11-29 18:21:08 +02:00
crypto_gnutls.c Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00
crypto_internal-cipher.c Fix AES block size handling for internal cipher 2012-09-09 14:12:59 +03:00
crypto_internal-modexp.c Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00
crypto_internal-rsa.c Add function for building RSA public key from n and e parameters 2014-05-19 23:27:30 +03:00
crypto_internal.c crypto: Add CRYPTO_HASH_ALG_SHA384 and CRYPTO_HASH_ALG_SHA512 2015-11-29 18:21:08 +02:00
crypto_libtomcrypt.c Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00
crypto_module_tests.c tests: Move EAP-SIM PRF module test into the hwsim framework 2015-11-24 00:00:21 +02:00
crypto_none.c Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00
crypto_openssl.c OpenSSL: Drop support for OpenSSL 0.9.8 2015-12-31 18:01:59 +02:00
des-internal.c Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00
des_i.h Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00
dh_group5.c Fix memory leak on NFC DH generation error path 2015-11-29 20:53:20 +02:00
dh_group5.h Add dh5_init_fixed() to allow fixed DH parameters to be used 2012-06-27 21:22:12 +03:00
dh_groups.c Fix memory leak on NFC DH generation error path 2015-11-29 20:53:20 +02:00
dh_groups.h Add Diffie-Hellman group definitions for MODP groups in RFC 5114 2013-01-12 17:51:54 +02:00
fips_prf_internal.c Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00
fips_prf_openssl.c BoringSSL: Support new SHA_CTX definition for EAP-SIM PRF 2015-12-04 11:30:36 +02:00
Makefile Add SHA384 and SHA512 implementations from LibTomCrypt library 2015-11-29 18:19:32 +02:00
md4-internal.c Add TEST_FAIL() support for internal hash functions 2015-11-29 21:01:33 +02:00
md5-internal.c Add TEST_FAIL() support for internal hash functions 2015-11-29 21:01:33 +02:00
md5.c crypto: Clear temporary stack buffers after use 2015-01-06 02:49:13 +02:00
md5.h FIPS: Remove md5-non-fips.c 2012-08-19 16:53:15 +03:00
md5_i.h Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00
milenage.c Milenage: Use os_memcmp_const() for hash/password comparisons 2014-07-02 12:38:47 +03:00
milenage.h Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00
ms_funcs.c Fix MSCHAP UTF-8 to UCS-2 conversion check for three-byte encoding 2015-10-10 18:38:37 +03:00
ms_funcs.h ms_funcs: Make challenge_hash() non-static 2015-03-29 22:27:00 +03:00
random.c random: Fix random_get_bytes() with CONFIG_FIPS=y 2015-08-01 21:08:11 +03:00
random.h Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00
rc4.c Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00
sha1-internal.c Remove unnecessary cleanup assignment in SHA1Final() 2015-12-28 18:12:03 +02:00
sha1-pbkdf2.c Convert remaining SSID routines from char* to u8* 2012-08-07 16:07:25 +03:00
sha1-prf.c crypto: Clear temporary stack buffers after use 2015-01-06 02:49:13 +02:00
sha1-tlsprf.c Explicitly clear temporary stack buffers in tls_prf_sha1_md5() 2015-03-29 16:43:03 +03:00
sha1-tprf.c Explicitly clear temporary stack buffer in sha1_t_prf() 2015-03-29 16:40:55 +03:00
sha1.c crypto: Clear temporary stack buffers after use 2015-01-06 02:49:13 +02:00
sha1.h Convert remaining SSID routines from char* to u8* 2012-08-07 16:07:25 +03:00
sha1_i.h Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00
sha256-internal.c Add TEST_FAIL() support for internal hash functions 2015-11-29 21:01:33 +02:00
sha256-kdf.c Explicitly clear temporary stack buffer in hmac_sha256_kdf() 2015-03-29 16:38:37 +03:00
sha256-prf.c crypto: Clear temporary stack buffers after use 2015-01-06 02:49:13 +02:00
sha256-tlsprf.c Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00
sha256.c OpenSSL: Implement SHA256 HMAC functions using HMAC API 2012-08-16 22:34:35 +03:00
sha256.h ERP: Add HMAC-SHA256 KDF (RFC 5295) 2014-12-04 12:08:59 +02:00
sha256_i.h Remove the GPL notification from files contributed by Jouni Malinen 2012-02-11 19:39:36 +02:00
sha384-internal.c Add SHA384 and SHA512 implementations from LibTomCrypt library 2015-11-29 18:19:32 +02:00
sha384-prf.c Fix key derivation for Suite B 192-bit AKM to use SHA384 2015-08-27 20:42:14 +03:00
sha384.h Fix key derivation for Suite B 192-bit AKM to use SHA384 2015-08-27 20:42:14 +03:00
sha384_i.h Add SHA384 and SHA512 implementations from LibTomCrypt library 2015-11-29 18:19:32 +02:00
sha512-internal.c Add SHA384 and SHA512 implementations from LibTomCrypt library 2015-11-29 18:19:32 +02:00
sha512_i.h Add SHA384 and SHA512 implementations from LibTomCrypt library 2015-11-29 18:19:32 +02:00
tls.h EAP-FAST: Enable AES256-based TLS cipher suites with OpenSSL 2015-12-31 20:52:58 +02:00
tls_gnutls.c Add ocsp=3 configuration parameter for multi-OCSP 2015-12-24 00:54:30 +02:00
tls_internal.c TLS client: Multi-OCSP check to cover intermediate CAs 2015-12-24 00:54:30 +02:00
tls_none.c TLS: Add functions for managing cached session state 2015-08-24 02:29:30 +03:00
tls_openssl.c OpenSSL: Fix client certificate chain building after PKCS#12 use 2016-01-07 17:54:23 +02:00
tls_openssl.h BoringSSL: Move OCSP implementation into a separate file 2015-12-04 20:08:31 +02:00
tls_openssl_ocsp.c BoringSSL: Move OCSP implementation into a separate file 2015-12-04 20:08:31 +02:00