From: Jouni Malinen <jouni@codeaurora.org>
Date: Mon, 17 Sep 2018 14:23:10 +0000 (+0300)
Subject: DPP: Fix test functionality for invalid keys with OpenSSL 1.1.0
X-Git-Tag: hostap_2_7~177
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2b92c4f3c0ceb8b872492295c640369f7e8f8f6a;p=thirdparty%2Fhostap.git

DPP: Fix test functionality for invalid keys with OpenSSL 1.1.0

It looks like at least OpenSSL 1.1.0i includes the extra checks in
EC_POINT_set_affine_coordinates_GFp() that break the previously used
mechanism for generating invalid keys. Fix this by using the alternative
design that was used with OpenSSL 1.1.1 and BoringSSL.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
---

diff --git a/src/common/dpp.c b/src/common/dpp.c
index 74a524d21..c359d5561 100644
--- a/src/common/dpp.c
+++ b/src/common/dpp.c
@@ -6219,14 +6219,14 @@ static int dpp_test_gen_invalid_key(struct wpabuf *msg,
 
 		if (EC_POINT_set_affine_coordinates_GFp(group, point, x, y,
 							ctx) != 1) {
-#if OPENSSL_VERSION_NUMBER >= 0x10101000L || defined(OPENSSL_IS_BORINGSSL)
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L || defined(OPENSSL_IS_BORINGSSL)
 		/* Unlike older OpenSSL versions, OpenSSL 1.1.1 and BoringSSL
 		 * return an error from EC_POINT_set_affine_coordinates_GFp()
 		 * when the point is not on the curve. */
 			break;
-#else /* >=1.1.1 or OPENSSL_IS_BORINGSSL */
+#else /* >=1.1.0 or OPENSSL_IS_BORINGSSL */
 			goto fail;
-#endif /* >= 1.1.1 or OPENSSL_IS_BORINGSSL */
+#endif /* >= 1.1.0 or OPENSSL_IS_BORINGSSL */
 		}
 
 		if (!EC_POINT_is_on_curve(group, point, ctx))