feedc0de/esp-idf
1
0
Fork 0
forked from espressif/esp-idf
Code Pull Requests Activity

wpa_supplicant : Add disable for tls key usage check.

Browse Source 
Disable the key usage check this leads to false negative results
while using wfa certificates during testing.
This commit is contained in:
jgujarathi
2023-03-01 11:53:42 +05:30
parent d9d1c3e334
commit 20c316d4cf
1 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
components/wpa_supplicant/esp_supplicant/src/crypto/tls_mbedtls.c
View File

@@ -27,6 +27,7 @@
#include "mbedtls/ctr_drbg.h"
#include "mbedtls/entropy.h"
#include "mbedtls/debug.h"
#include "mbedtls/oid.h"
#ifdef ESPRESSIF_USE
#include "mbedtls/esp_debug.h"
#include "mbedtls/esp_config.h"
@@ -194,7 +195,6 @@ static int set_ca_cert(tls_context_t *tls, const unsigned char *cacert, size_t c
}
mbedtls_ssl_conf_authmode(&tls->conf, MBEDTLS_SSL_VERIFY_REQUIRED);
mbedtls_ssl_conf_ca_chain(&tls->conf, tls->cacert_ptr, NULL);
return 0;
}
@@ -290,6 +290,14 @@ static void tls_enable_sha1_config(tls_context_t *tls)
mbedtls_ssl_conf_cert_profile(&tls->conf, crt_profile);
mbedtls_ssl_conf_sig_algs(&tls->conf, tls_sig_algs_for_eap);
}
#ifdef CONFIG_ESP_WIFI_DISABLE_KEY_USAGE_CHECK
static int tls_disable_key_usages(void *data, mbedtls_x509_crt *cert, int depth, uint32_t *flags)
{
cert->MBEDTLS_PRIVATE(ext_types) &= ~MBEDTLS_X509_EXT_KEY_USAGE;
cert->MBEDTLS_PRIVATE(ext_types) &= ~MBEDTLS_X509_EXT_EXTENDED_KEY_USAGE;
return 0;
}
#endif /*CONFIG_ESP_WIFI_DISABLE_KEY_USAGE_CHECK*/
static const int eap_ciphersuite_preference[] =
{
@@ -519,6 +527,10 @@ static int set_client_config(const struct tls_connection_params *cfg, tls_contex
* but doesn't take that much processing power */
tls_set_ciphersuite(cfg, tls);
#ifdef CONFIG_ESP_WIFI_DISABLE_KEY_USAGE_CHECK
mbedtls_ssl_set_verify( &tls->ssl, tls_disable_key_usages, NULL );
#endif /*CONFIG_ESP_WIFI_DISABLE_KEY_USAGE_CHECK*/
#ifdef CONFIG_MBEDTLS_CERTIFICATE_BUNDLE
if (cfg->flags & TLS_CONN_USE_DEFAULT_CERT_BUNDLE) {
wpa_printf(MSG_INFO, "Using default cert bundle");