}
+static int x509_sha256_oid(struct asn1_oid *oid)
+{
+ return oid->len == 9 &&
+ oid->oid[0] == 2 /* joint-iso-itu-t */ &&
+ oid->oid[1] == 16 /* country */ &&
+ oid->oid[2] == 840 /* us */ &&
+ oid->oid[3] == 1 /* organization */ &&
+ oid->oid[4] == 101 /* gov */ &&
+ oid->oid[5] == 3 /* csor */ &&
+ oid->oid[6] == 4 /* nistAlgorithm */ &&
+ oid->oid[7] == 2 /* hashAlgs */ &&
+ oid->oid[8] == 1 /* sha256 */;
+}
+
+
/**
* x509_certificate_parse - Parse a X.509 certificate in DER format
* @buf: Pointer to the X.509 certificate in DER format
size_t data_len;
struct asn1_hdr hdr;
struct asn1_oid oid;
- u8 hash[20];
+ u8 hash[32];
size_t hash_len;
if (!x509_pkcs_oid(&cert->signature.oid) ||
goto skip_digest_oid;
}
+ if (x509_sha256_oid(&oid)) {
+ if (cert->signature.oid.oid[6] !=
+ 11 /* sha2561WithRSAEncryption */) {
+ wpa_printf(MSG_DEBUG, "X509: digestAlgorithm SHA256 "
+ "does not match with certificate "
+ "signatureAlgorithm (%lu)",
+ cert->signature.oid.oid[6]);
+ os_free(data);
+ return -1;
+ }
+ goto skip_digest_oid;
+ }
+
if (!x509_digest_oid(&oid)) {
wpa_printf(MSG_DEBUG, "X509: Unrecognized digestAlgorithm");
os_free(data);
wpa_hexdump(MSG_MSGDUMP, "X509: Certificate hash (SHA1)",
hash, hash_len);
break;
- case 2: /* md2WithRSAEncryption */
case 11: /* sha256WithRSAEncryption */
+#ifdef NEED_SHA256
+ sha256_vector(1, &cert->tbs_cert_start, &cert->tbs_cert_len,
+ hash);
+ hash_len = 32;
+ wpa_hexdump(MSG_MSGDUMP, "X509: Certificate hash (SHA256)",
+ hash, hash_len);
+ break;
+#else /* NEED_SHA256 */
+ wpa_printf(MSG_INFO, "X509: SHA256 support disabled");
+ os_free(data);
+ return -1;
+#endif /* NEED_SHA256 */
+ case 2: /* md2WithRSAEncryption */
case 12: /* sha384WithRSAEncryption */
case 13: /* sha512WithRSAEncryption */
default:
NEED_SHA256=y
endif
+ifdef CONFIG_IEEE80211W
+CFLAGS += -DCONFIG_IEEE80211W
+NEED_SHA256=y
+endif
+
ifdef NEED_SHA256
OBJS += ../src/crypto/sha256.o
+CFLAGS += -DNEED_SHA256
endif
ifdef CONFIG_WIRELESS_EXTENSION
CFLAGS += -DCONFIG_PEERKEY
endif
-ifdef CONFIG_IEEE80211W
-CFLAGS += -DCONFIG_IEEE80211W
-NEED_SHA256=y
-endif
-
ifdef CONFIG_IEEE80211R
CFLAGS += -DCONFIG_IEEE80211R
OBJS += ../src/rsn_supp/wpa_ft.o
../src/crypto/crypto_$(CONFIG_CRYPTO).o \
../src/crypto/md5.o ../src/crypto/sha1.o ../src/crypto/aes.o \
../src/crypto/rc4.o ../src/crypto/des.o ../src/crypto/aes_wrap.o \
+ ../src/crypto/sha256.o \
../src/tls/bignum.o ../src/tls/rsa.o
test_x509v3: $(OBJSx)
$(LDO) $(LDFLAGS) -o test_x509v3 $(OBJSx)