forked from pool/wpa_supplicant
4588c1dba1
- add two patches from upstream to fix reading private key
passwords from the configuration file (bsc#1099835)
- add patch for git 89971d8b1e328a2f79699c953625d1671fd40384
wpa_supplicant-bnc-1099835-clear-default_passwd_cb.patch
- add patch for git f665c93e1d28fbab3d9127a8c3985cc32940824f
wpa_supplicant-bnc-1099835-fix-private-key-password.patch
OBS-URL: https://build.opensuse.org/request/show/624258
OBS-URL: https://build.opensuse.org/package/show/hardware/wpa_supplicant?expand=0&rev=78
72 lines
2.5 KiB
Diff
72 lines
2.5 KiB
Diff
commit 89971d8b1e328a2f79699c953625d1671fd40384
|
|
Author: Jouni Malinen <j@w1.fi>
|
|
Date: Mon Jul 17 12:06:17 2017 +0300
|
|
|
|
OpenSSL: Clear default_passwd_cb more thoroughly
|
|
|
|
Previously, the pointer to strdup passwd was left in OpenSSL library
|
|
default_passwd_cb_userdata and even the default_passwd_cb was left set
|
|
on an error path. To avoid unexpected behavior if something were to
|
|
manage to use there pointers, clear them explicitly once done with
|
|
loading of the private key.
|
|
|
|
Signed-off-by: Jouni Malinen <j@w1.fi>
|
|
|
|
diff --git a/src/crypto/tls_openssl.c b/src/crypto/tls_openssl.c
|
|
index c790b53ea..903c38cff 100644
|
|
--- a/src/crypto/tls_openssl.c
|
|
+++ b/src/crypto/tls_openssl.c
|
|
@@ -2775,6 +2775,19 @@ static int tls_connection_engine_private_key(struct tls_connection *conn)
|
|
}
|
|
|
|
|
|
+static void tls_clear_default_passwd_cb(SSL_CTX *ssl_ctx, SSL *ssl)
|
|
+{
|
|
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
|
|
+ if (ssl) {
|
|
+ SSL_set_default_passwd_cb(ssl, NULL);
|
|
+ SSL_set_default_passwd_cb_userdata(ssl, NULL);
|
|
+ }
|
|
+#endif /* >= 1.1.0f && !LibreSSL */
|
|
+ SSL_CTX_set_default_passwd_cb(ssl_ctx, NULL);
|
|
+ SSL_CTX_set_default_passwd_cb_userdata(ssl_ctx, NULL);
|
|
+}
|
|
+
|
|
+
|
|
static int tls_connection_private_key(struct tls_data *data,
|
|
struct tls_connection *conn,
|
|
const char *private_key,
|
|
@@ -2891,14 +2904,12 @@ static int tls_connection_private_key(struct tls_data *data,
|
|
if (!ok) {
|
|
tls_show_errors(MSG_INFO, __func__,
|
|
"Failed to load private key");
|
|
+ tls_clear_default_passwd_cb(ssl_ctx, conn->ssl);
|
|
os_free(passwd);
|
|
return -1;
|
|
}
|
|
ERR_clear_error();
|
|
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
|
|
- SSL_set_default_passwd_cb(conn->ssl, NULL);
|
|
-#endif /* >= 1.1.0f && !LibreSSL */
|
|
- SSL_CTX_set_default_passwd_cb(ssl_ctx, NULL);
|
|
+ tls_clear_default_passwd_cb(ssl_ctx, conn->ssl);
|
|
os_free(passwd);
|
|
|
|
if (!SSL_check_private_key(conn->ssl)) {
|
|
@@ -2941,13 +2952,14 @@ static int tls_global_private_key(struct tls_data *data,
|
|
tls_read_pkcs12(data, NULL, private_key, passwd)) {
|
|
tls_show_errors(MSG_INFO, __func__,
|
|
"Failed to load private key");
|
|
+ tls_clear_default_passwd_cb(ssl_ctx, NULL);
|
|
os_free(passwd);
|
|
ERR_clear_error();
|
|
return -1;
|
|
}
|
|
+ tls_clear_default_passwd_cb(ssl_ctx, NULL);
|
|
os_free(passwd);
|
|
ERR_clear_error();
|
|
- SSL_CTX_set_default_passwd_cb(ssl_ctx, NULL);
|
|
|
|
if (!SSL_CTX_check_private_key(ssl_ctx)) {
|
|
tls_show_errors(MSG_INFO, __func__,
|