TLS client: Do not verify CA certificates when ca_cert is not specified

In documentation is written: "If ca_cert and ca_path are not included,
server certificate will not be verified". This is the case when
wpa_supplicant is compiled with OpenSSL library, but when using the
internal TLS implementation and some certificates in CA chain are in
unsupported format (e.g., use SHA384 or SHA512 hash functions) then
verification fails even if ca_cert property is not specified.

This commit changes behavior so that certificate verification in
internal TLS implementation is really skipped when ca_cert is not
specified.

Signed-off-by: Pali Rohár <pali.rohar@gmail.com>

diff --git a/src/tls/tlsv1_client_read.c b/src/tls/tlsv1_client_read.c
index 9ce96803753a9adca8946108e25fbdbe6ad30e79..4fe95807af7bc804b0dcfb7630c4ba16bf365af3 100644 (file)
--- a/src/tls/tlsv1_client_read.c
+++ b/src/tls/tlsv1_client_read.c
@@ -364,7 +364,7 @@ static int tls_process_certificate(struct tlsv1_client *conn, u8 ct,
                pos += cert_len;
        }
 
-       if (conn->cred &&
+       if (conn->cred && conn->cred->ca_cert_verify &&
            x509_certificate_chain_validate(conn->cred->trusted_certs, chain,
                                            &reason, conn->disable_time_checks)
            < 0) {

diff --git a/src/tls/tlsv1_cred.c b/src/tls/tlsv1_cred.c
index 1ea6827b898ec16f95514eb1e89226ae1bd88e78..fbac96511d31d92a5babdc11ee890c79f1b4295c 100644 (file)
--- a/src/tls/tlsv1_cred.c
+++ b/src/tls/tlsv1_cred.c
@@ -190,6 +190,8 @@ int tlsv1_set_ca_cert(struct tlsv1_credentials *cred, const char *cert,
                      const u8 *cert_blob, size_t cert_blob_len,
                      const char *path)
 {
+       cred->ca_cert_verify = cert || cert_blob || path;
+
        if (tlsv1_set_cert_chain(&cred->trusted_certs, cert,
                                 cert_blob, cert_blob_len) < 0)
                return -1;

diff --git a/src/tls/tlsv1_cred.h b/src/tls/tlsv1_cred.h
index 68fbdc9230084791b0a5b71e952553d948edbe95..b1e3e00bdf0a42e5b2e50c3de2d79aebcc44f102 100644 (file)
--- a/src/tls/tlsv1_cred.h
+++ b/src/tls/tlsv1_cred.h
@@ -14,6 +14,8 @@ struct tlsv1_credentials {
        struct x509_certificate *cert;
        struct crypto_private_key *key;
 
+       unsigned int ca_cert_verify:1;
+
        /* Diffie-Hellman parameters */
        u8 *dh_p; /* prime */
        size_t dh_p_len;