In eap_peer_tls_process_init, check (and ignore) data->ssl_ctx instead of

[mech_eap.git] / libeap / src / eap_peer / eap_tls_common.c

diff --git a/libeap/src/eap_peer/eap_tls_common.c b/libeap/src/eap_peer/eap_tls_common.c
index e7cbe62..279e15d 100644 (file)
--- a/libeap/src/eap_peer/eap_tls_common.c
+++ b/libeap/src/eap_peer/eap_tls_common.c
@@ -80,6 +80,10 @@ static void eap_tls_params_flags(struct tls_connection_params *params,
                params->flags |= TLS_CONN_DISABLE_TLSv1_2;
        if (os_strstr(txt, "tls_disable_tlsv1_2=0"))
                params->flags &= ~TLS_CONN_DISABLE_TLSv1_2;
+       if (os_strstr(txt, "tls_ext_cert_check=1"))
+               params->flags |= TLS_CONN_EXT_CERT_CHECK;
+       if (os_strstr(txt, "tls_ext_cert_check=0"))
+               params->flags &= ~TLS_CONN_EXT_CERT_CHECK;
 }
 
 
@@ -103,8 +107,8 @@ static void eap_tls_params_from_conf1(struct tls_connection_params *params,
        params->cert_id = config->cert_id;
        params->ca_cert_id = config->ca_cert_id;
        eap_tls_params_flags(params, config->phase1);
-    params->validate_ca_cb = config->validate_ca_cb;
-    params->validate_ca_ctx = config->validate_ca_ctx;
+    params->server_cert_cb = config->server_cert_cb;
+    params->server_cert_ctx = config->server_cert_ctx;
 }
 
 
@@ -128,6 +132,8 @@ static void eap_tls_params_from_conf2(struct tls_connection_params *params,
        params->cert_id = config->cert2_id;
        params->ca_cert_id = config->ca_cert2_id;
        eap_tls_params_flags(params, config->phase2);
+    params->server_cert_cb = config->server_cert_cb;
+    params->server_cert_ctx = config->server_cert_ctx;
 }
 
 
@@ -179,6 +185,8 @@ static int eap_tls_params_from_conf(struct eap_sm *sm,
 
        params->openssl_ciphers = config->openssl_ciphers;
 
+       sm->ext_cert_check = !!(params->flags & TLS_CONN_EXT_CERT_CHECK);
+
        return 0;
 }
 
@@ -192,8 +200,10 @@ static int eap_tls_init_connection(struct eap_sm *sm,
 
        if (config->ocsp)
                params->flags |= TLS_CONN_REQUEST_OCSP;
-       if (config->ocsp == 2)
+       if (config->ocsp >= 2)
                params->flags |= TLS_CONN_REQUIRE_OCSP;
+       if (config->ocsp == 3)
+               params->flags |= TLS_CONN_REQUIRE_OCSP_ALL;
        data->conn = tls_connection_init(data->ssl_ctx);
        if (data->conn == NULL) {
                wpa_printf(MSG_INFO, "SSL: Failed to initialize new TLS "
@@ -322,8 +332,8 @@ u8 * eap_peer_tls_derive_key(struct eap_sm *sm, struct eap_ssl_data *data,
        if (out == NULL)
                return NULL;
 
-       if (tls_connection_prf(data->ssl_ctx, data->conn, label, 0, 0,
-                              out, len)) {
+       if (tls_connection_export_key(data->ssl_ctx, data->conn, label, out,
+                                     len)) {
                os_free(out);
                return NULL;
        }
@@ -352,10 +362,8 @@ u8 * eap_peer_tls_derive_session_id(struct eap_sm *sm,
        struct tls_random keys;
        u8 *out;
 
-       if (tls_connection_get_random(sm->ssl_ctx, data->conn, &keys))
-               return NULL;
-
-       if (keys.client_random == NULL || keys.server_random == NULL)
+       if (tls_connection_get_random(sm->ssl_ctx, data->conn, &keys) ||
+           keys.client_random == NULL || keys.server_random == NULL)
                return NULL;
 
        *len = 1 + keys.client_random_len + keys.server_random_len;
@@ -819,14 +827,14 @@ const u8 * eap_peer_tls_process_init(struct eap_sm *sm,
        size_t left;
        unsigned int tls_msg_len;
 
-       /* Ignore errors before we do anything*/
-       (void) tls_get_errors(sm->ssl_ctx);
 
-       //// if (tls_get_errors(data->ssl_ctx)) {
-       ////    wpa_printf(MSG_INFO, "SSL: TLS errors detected");
-       ////    ret->ignore = TRUE;
-       ////    return NULL;
-       //// }
+       if (tls_get_errors(data->ssl_ctx)) {
+               wpa_printf(MSG_INFO, "SSL: TLS errors detected");
+        /* Next two lines commented out by Painless Security for Moonshot */
+            /* ret->ignore = TRUE;
+             * return NULL;
+                 */
+       }
 
        if (eap_type == EAP_UNAUTH_TLS_TYPE)
                pos = eap_hdr_validate(EAP_VENDOR_UNAUTH_TLS,
@@ -1040,6 +1048,9 @@ int eap_peer_select_phase2_methods(struct eap_peer_config *config,
                if (vendor == EAP_VENDOR_IETF && method == EAP_TYPE_NONE) {
                        wpa_printf(MSG_ERROR, "TLS: Unsupported Phase2 EAP "
                                   "method '%s'", start);
+                       os_free(methods);
+                       os_free(buf);
+                       return -1;
                } else {
                        num_methods++;
                        _methods = os_realloc_array(methods, num_methods,