From 8f60293d3f1f19f65cd88da126e9ea266285bcf4 Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Mon, 17 Mar 2014 23:56:17 +0200 Subject: [PATCH] HS 2.0R2: Do not use OSU cert validation for EST There is no requirement for the EST server to use an OSU server certificate, so do not require friendly name and icon hash matches for EST cases. Signed-off-by: Jouni Malinen --- hs20/client/est.c | 8 +++++++- hs20/client/osu_client.c | 12 ++++++++---- hs20/client/osu_client.h | 1 + 3 files changed, 16 insertions(+), 5 deletions(-) diff --git a/hs20/client/est.c b/hs20/client/est.c index c1d514a98..5346c0993 100644 --- a/hs20/client/est.c +++ b/hs20/client/est.c @@ -1,6 +1,6 @@ /* * Hotspot 2.0 OSU client - EST client - * Copyright (c) 2012-2013, Qualcomm Atheros, Inc. + * Copyright (c) 2012-2014, Qualcomm Atheros, Inc. * * This software may be distributed under the terms of the BSD license. * See README for more details. @@ -108,8 +108,10 @@ int est_load_cacerts(struct hs20_osu_client *ctx, const char *url) os_snprintf(buf, buflen, "%s/cacerts", url); wpa_printf(MSG_INFO, "Download EST cacerts from %s", buf); write_summary(ctx, "Download EST cacerts from %s", buf); + ctx->no_osu_cert_validation = 1; res = http_download_file(ctx->http, buf, "Cert/est-cacerts.txt", ctx->ca_fname); + ctx->no_osu_cert_validation = 0; if (res < 0) { wpa_printf(MSG_INFO, "Failed to download EST cacerts from %s", buf); @@ -550,8 +552,10 @@ int est_build_csr(struct hs20_osu_client *ctx, const char *url) os_snprintf(buf, buflen, "%s/csrattrs", url); wpa_printf(MSG_INFO, "Download csrattrs from %s", buf); write_summary(ctx, "Download EST csrattrs from %s", buf); + ctx->no_osu_cert_validation = 1; res = http_download_file(ctx->http, buf, "Cert/est-csrattrs.txt", ctx->ca_fname); + ctx->no_osu_cert_validation = 0; os_free(buf); if (res < 0) { wpa_printf(MSG_INFO, "Failed to download EST csrattrs - assume no extra attributes are needed"); @@ -647,10 +651,12 @@ int est_simple_enroll(struct hs20_osu_client *ctx, const char *url, os_snprintf(buf, buflen, "%s/simpleenroll", url); wpa_printf(MSG_INFO, "EST simpleenroll URL: %s", buf); write_summary(ctx, "EST simpleenroll URL: %s", buf); + ctx->no_osu_cert_validation = 1; resp = http_post(ctx->http, buf, req, "application/pkcs10", "Content-Transfer-Encoding: base64", ctx->ca_fname, user, pw, client_cert, client_key, &resp_len); + ctx->no_osu_cert_validation = 0; os_free(buf); if (resp == NULL) { wpa_printf(MSG_INFO, "EST certificate enrollment failed"); diff --git a/hs20/client/osu_client.c b/hs20/client/osu_client.c index 6e6de6574..33e641f0c 100644 --- a/hs20/client/osu_client.c +++ b/hs20/client/osu_client.c @@ -302,7 +302,9 @@ static int download_cert(struct hs20_osu_client *ctx, xml_node_t *params, xml_node_get_text_free(ctx->xml, hash); write_summary(ctx, "Download certificate from %s", url); + ctx->no_osu_cert_validation = 1; res = http_download_file(ctx->http, url, TMP_CERT_DL_FILE, NULL); + ctx->no_osu_cert_validation = 0; xml_node_get_text_free(ctx->xml, url); if (res < 0) return -1; @@ -2692,7 +2694,8 @@ static int osu_cert_cb(void *_ctx, struct http_cert *cert) int found; char *host = NULL; - wpa_printf(MSG_INFO, "osu_cert_cb"); + wpa_printf(MSG_INFO, "osu_cert_cb(osu_cert_validation=%d)", + !ctx->no_osu_cert_validation); host = get_hostname(ctx->server_url); @@ -2736,7 +2739,8 @@ static int osu_cert_cb(void *_ctx, struct http_cert *cert) } } - for (j = 0; j < ctx->friendly_name_count; j++) { + for (j = 0; !ctx->no_osu_cert_validation && + j < ctx->friendly_name_count; j++) { int found = 0; for (i = 0; i < cert->num_othername; i++) { if (os_strcmp(cert->othername[i].oid, @@ -2775,7 +2779,7 @@ static int osu_cert_cb(void *_ctx, struct http_cert *cert) logo->hash, logo->hash_len); } - for (j = 0; j < ctx->icon_count; j++) { + for (j = 0; !ctx->no_osu_cert_validation && j < ctx->icon_count; j++) { int found = 0; char *name = ctx->icon_filename[j]; size_t name_len = os_strlen(name); @@ -2811,7 +2815,7 @@ static int osu_cert_cb(void *_ctx, struct http_cert *cert) } } - for (j = 0; j < ctx->icon_count; j++) { + for (j = 0; !ctx->no_osu_cert_validation && j < ctx->icon_count; j++) { int found = 0; for (i = 0; i < cert->num_logo; i++) { diff --git a/hs20/client/osu_client.h b/hs20/client/osu_client.h index 092d6e1ae..9a7059edf 100644 --- a/hs20/client/osu_client.h +++ b/hs20/client/osu_client.h @@ -34,6 +34,7 @@ struct hs20_osu_client { const char *summary_file; const char *ifname; const char *ca_fname; + int no_osu_cert_validation; /* for EST operations */ char *fqdn; char *server_url; struct osu_lang_text friendly_name[MAX_OSU_VALS];