schannel: Reject subject_match, altsubject_match, suffix_match

Validation of these parameters has not been implemented with schannel.
Instead of ignoring them silently, reject the configuration to avoid
giving incorrect impression of the parameters being used if
wpa_supplicant is built with schannel instead of the default OpenSSL.

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/src/crypto/tls_schannel.c b/src/crypto/tls_schannel.c
index 2c2daa8a804b79d8b5152f892a750b3940f8b1e2..e1d0f597fe2caf101b62437983db5be5c6c7464d 100644 (file)
--- a/src/crypto/tls_schannel.c
+++ b/src/crypto/tls_schannel.c
@@ -692,6 +692,21 @@ int tls_connection_set_params(void *tls_ctx, struct tls_connection *conn,
        if (conn == NULL)
                return -1;
 
+       if (params->subject_match) {
+               wpa_printf(MSG_INFO, "TLS: subject_match not supported");
+               return -1;
+       }
+
+       if (params->altsubject_match) {
+               wpa_printf(MSG_INFO, "TLS: altsubject_match not supported");
+               return -1;
+       }
+
+       if (params->suffix_match) {
+               wpa_printf(MSG_INFO, "TLS: suffix_match not supported");
+               return -1;
+       }
+
        if (global->my_cert_store == NULL &&
            (global->my_cert_store = CertOpenSystemStore(0, TEXT("MY"))) ==
            NULL) {