jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

HTTP (curl): Try SHA256 hash for OCSP certificate matching

Browse source 
Previously, only SHA1 hash -based server certificate matching was used,
but the OCSP response may use SHA256 instead of SHA1, so check the match
with both hash functions, if needed.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This commit is contained in:
Jouni Malinen 2017-05-09 23:35:59 +03:00 committed by Jouni Malinen
parent 95818ec174
commit d264c2e390
1 changed files with 24 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

29
src/utils/http_curl.c
View file

@ -1094,7 +1094,7 @@ static int ocsp_resp_cb(SSL *s, void *arg)
{ {
struct http_ctx *ctx = arg; struct http_ctx *ctx = arg;
const unsigned char *p; const unsigned char *p;
int len, status, reason; int len, status, reason, res;
OCSP_RESPONSE *rsp; OCSP_RESPONSE *rsp;
OCSP_BASICRESP *basic; OCSP_BASICRESP *basic;
OCSP_CERTID *id; OCSP_CERTID *id;
@ -1199,17 +1199,36 @@ static int ocsp_resp_cb(SSL *s, void *arg)
return 0; return 0;
} }
id = OCSP_cert_to_id(NULL, ctx->peer_cert, ctx->peer_issuer); id = OCSP_cert_to_id(EVP_sha256(), ctx->peer_cert, ctx->peer_issuer);
if (!id) { if (!id) {
wpa_printf(MSG_DEBUG, "OpenSSL: Could not create OCSP certificate identifier"); wpa_printf(MSG_DEBUG,
"OpenSSL: Could not create OCSP certificate identifier (SHA256)");
OCSP_BASICRESP_free(basic); OCSP_BASICRESP_free(basic);
OCSP_RESPONSE_free(rsp); OCSP_RESPONSE_free(rsp);
ctx->last_err = "Could not create OCSP certificate identifier"; ctx->last_err = "Could not create OCSP certificate identifier";
return 0; return 0;
} }
if (!OCSP_resp_find_status(basic, id, &status, &reason, &produced_at, res = OCSP_resp_find_status(basic, id, &status, &reason, &produced_at,
&this_update, &next_update)) { &this_update, &next_update);
if (!res) {
id = OCSP_cert_to_id(NULL, ctx->peer_cert, ctx->peer_issuer);
if (!id) {
wpa_printf(MSG_DEBUG,
"OpenSSL: Could not create OCSP certificate identifier (SHA1)");
OCSP_BASICRESP_free(basic);
OCSP_RESPONSE_free(rsp);
ctx->last_err =
"Could not create OCSP certificate identifier";
return 0;
}
res = OCSP_resp_find_status(basic, id, &status, &reason,
&produced_at, &this_update,
&next_update);
}
if (!res) {
wpa_printf(MSG_INFO, "OpenSSL: Could not find current server certificate from OCSP response%s", wpa_printf(MSG_INFO, "OpenSSL: Could not find current server certificate from OCSP response%s",
(ctx->ocsp == MANDATORY_OCSP) ? "" : (ctx->ocsp == MANDATORY_OCSP) ? "" :
" (OCSP not required)"); " (OCSP not required)");