HS 2.0R2: Do not use OSU cert validation for EST

There is no requirement for the EST server to use an OSU server
certificate, so do not require friendly name and icon hash matches for
EST cases.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>

diff --git a/hs20/client/est.c b/hs20/client/est.c
index c1d514a98943360ded7c09d449fc03232b413565..5346c0993992574f303a4a44cac92747ce0be62c 100644 (file)
--- a/hs20/client/est.c
+++ b/hs20/client/est.c
@@ -1,6 +1,6 @@
 /*
  * Hotspot 2.0 OSU client - EST client
- * Copyright (c) 2012-2013, Qualcomm Atheros, Inc.
+ * Copyright (c) 2012-2014, Qualcomm Atheros, Inc.
  *
  * This software may be distributed under the terms of the BSD license.
  * See README for more details.
@@ -108,8 +108,10 @@ int est_load_cacerts(struct hs20_osu_client *ctx, const char *url)
        os_snprintf(buf, buflen, "%s/cacerts", url);
        wpa_printf(MSG_INFO, "Download EST cacerts from %s", buf);
        write_summary(ctx, "Download EST cacerts from %s", buf);
+       ctx->no_osu_cert_validation = 1;
        res = http_download_file(ctx->http, buf, "Cert/est-cacerts.txt",
                                 ctx->ca_fname);
+       ctx->no_osu_cert_validation = 0;
        if (res < 0) {
                wpa_printf(MSG_INFO, "Failed to download EST cacerts from %s",
                           buf);
@@ -550,8 +552,10 @@ int est_build_csr(struct hs20_osu_client *ctx, const char *url)
        os_snprintf(buf, buflen, "%s/csrattrs", url);
        wpa_printf(MSG_INFO, "Download csrattrs from %s", buf);
        write_summary(ctx, "Download EST csrattrs from %s", buf);
+       ctx->no_osu_cert_validation = 1;
        res = http_download_file(ctx->http, buf, "Cert/est-csrattrs.txt",
                                 ctx->ca_fname);
+       ctx->no_osu_cert_validation = 0;
        os_free(buf);
        if (res < 0) {
                wpa_printf(MSG_INFO, "Failed to download EST csrattrs - assume no extra attributes are needed");
@@ -647,10 +651,12 @@ int est_simple_enroll(struct hs20_osu_client *ctx, const char *url,
                os_snprintf(buf, buflen, "%s/simpleenroll", url);
        wpa_printf(MSG_INFO, "EST simpleenroll URL: %s", buf);
        write_summary(ctx, "EST simpleenroll URL: %s", buf);
+       ctx->no_osu_cert_validation = 1;
        resp = http_post(ctx->http, buf, req, "application/pkcs10",
                         "Content-Transfer-Encoding: base64",
                         ctx->ca_fname, user, pw, client_cert, client_key,
                         &resp_len);
+       ctx->no_osu_cert_validation = 0;
        os_free(buf);
        if (resp == NULL) {
                wpa_printf(MSG_INFO, "EST certificate enrollment failed");

diff --git a/hs20/client/osu_client.c b/hs20/client/osu_client.c
index 6e6de6574045e755e86e26585e5a0ca586a9bb85..33e641f0cb333ea1d43d7776db84ec6fc6fedb51 100644 (file)
--- a/hs20/client/osu_client.c
+++ b/hs20/client/osu_client.c
@@ -302,7 +302,9 @@ static int download_cert(struct hs20_osu_client *ctx, xml_node_t *params,
        xml_node_get_text_free(ctx->xml, hash);
 
        write_summary(ctx, "Download certificate from %s", url);
+       ctx->no_osu_cert_validation = 1;
        res = http_download_file(ctx->http, url, TMP_CERT_DL_FILE, NULL);
+       ctx->no_osu_cert_validation = 0;
        xml_node_get_text_free(ctx->xml, url);
        if (res < 0)
                return -1;
@@ -2692,7 +2694,8 @@ static int osu_cert_cb(void *_ctx, struct http_cert *cert)
        int found;
        char *host = NULL;
 
-       wpa_printf(MSG_INFO, "osu_cert_cb");
+       wpa_printf(MSG_INFO, "osu_cert_cb(osu_cert_validation=%d)",
+                  !ctx->no_osu_cert_validation);
 
        host = get_hostname(ctx->server_url);
 
@@ -2736,7 +2739,8 @@ static int osu_cert_cb(void *_ctx, struct http_cert *cert)
                }
        }
 
-       for (j = 0; j < ctx->friendly_name_count; j++) {
+       for (j = 0; !ctx->no_osu_cert_validation &&
+                    j < ctx->friendly_name_count; j++) {
                int found = 0;
                for (i = 0; i < cert->num_othername; i++) {
                        if (os_strcmp(cert->othername[i].oid,
@@ -2775,7 +2779,7 @@ static int osu_cert_cb(void *_ctx, struct http_cert *cert)
                                  logo->hash, logo->hash_len);
        }
 
-       for (j = 0; j < ctx->icon_count; j++) {
+       for (j = 0; !ctx->no_osu_cert_validation && j < ctx->icon_count; j++) {
                int found = 0;
                char *name = ctx->icon_filename[j];
                size_t name_len = os_strlen(name);
@@ -2811,7 +2815,7 @@ static int osu_cert_cb(void *_ctx, struct http_cert *cert)
                }
        }
 
-       for (j = 0; j < ctx->icon_count; j++) {
+       for (j = 0; !ctx->no_osu_cert_validation && j < ctx->icon_count; j++) {
                int found = 0;
 
                for (i = 0; i < cert->num_logo; i++) {

diff --git a/hs20/client/osu_client.h b/hs20/client/osu_client.h
index 092d6e1ae7371f8de7da0bea3f0d4e2b8430d369..9a7059edfddb314b80eb5c6df4edd521c1332ac7 100644 (file)
--- a/hs20/client/osu_client.h
+++ b/hs20/client/osu_client.h
@@ -34,6 +34,7 @@ struct hs20_osu_client {
        const char *summary_file;
        const char *ifname;
        const char *ca_fname;
+       int no_osu_cert_validation; /* for EST operations */
        char *fqdn;
        char *server_url;
        struct osu_lang_text friendly_name[MAX_OSU_VALS];