From 59051f8ecfb19cf02bf616c681abdccebe4d1188 Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Sun, 11 Jan 2015 00:37:21 +0200 Subject: [PATCH] TLS: Reject subject_match, altsubject_match, suffix_match Validation of these parameters has not been implemented in the internal TLS implementation. Instead of ignoring them silently, reject the configuration to avoid giving incorrect impression of the parameters being used if wpa_supplicant is built with the internal TLS implementation instead of the default OpenSSL. Signed-off-by: Jouni Malinen --- src/crypto/tls_internal.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/src/crypto/tls_internal.c b/src/crypto/tls_internal.c index 6563ed218..233795176 100644 --- a/src/crypto/tls_internal.c +++ b/src/crypto/tls_internal.c @@ -190,6 +190,21 @@ int tls_connection_set_params(void *tls_ctx, struct tls_connection *conn, if (cred == NULL) return -1; + if (params->subject_match) { + wpa_printf(MSG_INFO, "TLS: subject_match not supported"); + return -1; + } + + if (params->altsubject_match) { + wpa_printf(MSG_INFO, "TLS: altsubject_match not supported"); + return -1; + } + + if (params->suffix_match) { + wpa_printf(MSG_INFO, "TLS: suffix_match not supported"); + return -1; + } + if (tlsv1_set_ca_cert(cred, params->ca_cert, params->ca_cert_blob, params->ca_cert_blob_len, params->ca_path)) {