size_t len;	ext = X509_get_ext_d2i(cert, NID_subject_alt_name, NULL, NULL);	for (i = 0; ext && i < sk_GENERAL_NAME_num(ext); i++) {		gen = sk_GENERAL_NAME_value(ext, i);		switch (gen->type) {		case GEN_EMAIL:			field = "EMAIL";			break;		case GEN_DNS:			field = "DNS";			break;		case GEN_URI:			field = "URI";			break;		default:			field = NULL;			wpa_printf(MSG_DEBUG, "TLS: altSubjectName: "				   "unsupported type=%d", gen->type);			break;		}		if (!field)			continue;		wpa_printf(MSG_DEBUG, "TLS: altSubjectName: %s:%s",			   field, gen->d.ia5->data);		len = os_strlen(field) + 1 +			strlen((char *) gen->d.ia5->data) + 1;		tmp = os_malloc(len);		if (tmp == NULL)			continue;		snprintf(tmp, len, "%s:%s", field, gen->d.ia5->data);		if (strstr(tmp, match))			found++;		os_free(tmp);	}	return found;}#endif#if 0static int tls_verify_cb(int preverify_ok, X509_STORE_CTX *x509_ctx){	char buf[256];	X509 *err_cert;	int err, depth;	SSL *ssl;	struct tls_connection *conn;	char *match, *altmatch;	err_cert = X509_STORE_CTX_get_current_cert(x509_ctx);	err = X509_STORE_CTX_get_error(x509_ctx);	depth = X509_STORE_CTX_get_error_depth(x509_ctx);	ssl = X509_STORE_CTX_get_ex_data(x509_ctx,					 SSL_get_ex_data_X509_STORE_CTX_idx());	X509_NAME_oneline(X509_get_subject_name(err_cert), buf, sizeof(buf));	conn = SSL_get_app_data(ssl);	match = conn ? conn->subject_match : NULL;	altmatch = conn ? conn->altsubject_match : NULL;	if (!preverify_ok) {		wpa_printf(MSG_WARNING, "TLS: Certificate verification failed,"			   " error %d (%s) depth %d for '%s'", err,			   X509_verify_cert_error_string(err), depth, buf);	} else {		wpa_printf(MSG_DEBUG, "TLS: tls_verify_cb - "			   "preverify_ok=%d err=%d (%s) depth=%d buf='%s'",			   preverify_ok, err,			   X509_verify_cert_error_string(err), depth, buf);		if (depth == 0 && match && strstr(buf, match) == NULL) {			wpa_printf(MSG_WARNING, "TLS: Subject '%s' did not "				   "match with '%s'", buf, match);			preverify_ok = 0;		} else if (depth == 0 && altmatch &&			   !tls_match_altsubject(err_cert, altmatch)) {			wpa_printf(MSG_WARNING, "TLS: altSubjectName match "				   "'%s' not found", altmatch);			preverify_ok = 0;		}	}	return preverify_ok;}#endifint tls_connection_set_params(void *tls_ctx, struct tls_connection *conn,			      const struct tls_connection_params *params){	int ret;	if (conn == NULL || params == NULL)		return -1;	os_free(conn->subject_match);	conn->subject_match = NULL;	if (params->subject_match) {		conn->subject_match = os_strdup(params->subject_match);		if (conn->subject_match == NULL)			return -1;	}	os_free(conn->altsubject_match);	conn->altsubject_match = NULL;	if (params->altsubject_match) {		conn->altsubject_match = os_strdup(params->altsubject_match);		if (conn->altsubject_match == NULL)			return -1;	}	/* TODO: gnutls_certificate_set_verify_flags(xcred, flags); 	 * to force peer validation(?) */	if (params->ca_cert) {		conn->verify_peer = 1;		ret = gnutls_certificate_set_x509_trust_file(			conn->xcred, params->ca_cert, GNUTLS_X509_FMT_PEM);		if (ret < 0) {			wpa_printf(MSG_DEBUG, "Failed to read CA cert '%s' "				   "in PEM format: %s", params->ca_cert,				   gnutls_strerror(ret));			ret = gnutls_certificate_set_x509_trust_file(				conn->xcred, params->ca_cert,				GNUTLS_X509_FMT_DER);			if (ret < 0) {				wpa_printf(MSG_DEBUG, "Failed to read CA cert "					   "'%s' in DER format: %s",					   params->ca_cert,					   gnutls_strerror(ret));				return -1;			}		}	}	if (params->client_cert && params->private_key) {		/* TODO: private_key_passwd? */		ret = gnutls_certificate_set_x509_key_file(			conn->xcred, params->client_cert, params->private_key,			GNUTLS_X509_FMT_PEM);		if (ret < 0) {			wpa_printf(MSG_DEBUG, "Failed to read client cert/key "				   "in PEM format: %s", gnutls_strerror(ret));			ret = gnutls_certificate_set_x509_key_file(				conn->xcred, params->client_cert,				params->private_key, GNUTLS_X509_FMT_DER);			if (ret < 0) {				wpa_printf(MSG_DEBUG, "Failed to read client "					   "cert/key in DER format: %s",					   gnutls_strerror(ret));				return ret;			}		}	} else if (params->private_key) {		int pkcs12_ok = 0;#ifdef PKCS12_FUNCS		/* Try to load in PKCS#12 format */#if LIBGNUTLS_VERSION_NUMBER >= 0x010302		ret = gnutls_certificate_set_x509_simple_pkcs12_file(			conn->xcred, params->private_key, GNUTLS_X509_FMT_DER,			params->private_key_passwd);		if (ret != 0) {			wpa_printf(MSG_DEBUG, "Failed to load private_key in "				   "PKCS#12 format: %s", gnutls_strerror(ret));			return -1;		} else			pkcs12_ok = 1;#endif /* LIBGNUTLS_VERSION_NUMBER >= 0x010302 */#endif /* PKCS12_FUNCS */		if (!pkcs12_ok) {			wpa_printf(MSG_DEBUG, "GnuTLS: PKCS#12 support not "				   "included");			return -1;		}	}	conn->tls_ia = params->tls_ia;	conn->params_set = 1;	ret = gnutls_credentials_set(conn->session, GNUTLS_CRD_CERTIFICATE,				     conn->xcred);	if (ret < 0) {		wpa_printf(MSG_INFO, "Failed to configure credentials: %s",			   gnutls_strerror(ret));	}#ifdef GNUTLS_IA	if (conn->iacred_cli)		gnutls_ia_free_client_credentials(conn->iacred_cli);	ret = gnutls_ia_allocate_client_credentials(&conn->iacred_cli);	if (ret) {		wpa_printf(MSG_DEBUG, "Failed to allocate IA credentials: %s",			   gnutls_strerror(ret));		return -1;	}	ret = gnutls_credentials_set(conn->session, GNUTLS_CRD_IA,				     conn->iacred_cli);	if (ret) {		wpa_printf(MSG_DEBUG, "Failed to configure IA credentials: %s",			   gnutls_strerror(ret));		gnutls_ia_free_client_credentials(conn->iacred_cli);		conn->iacred_cli = NULL;		return -1;	}#endif /* GNUTLS_IE */	return ret;}int tls_global_set_params(void *tls_ctx,			  const struct tls_connection_params *params){	struct tls_global *global = tls_ctx;	int ret;	/* Currently, global parameters are only set when running in server	 * mode. */	global->server = 1;	if (global->params_set) {		gnutls_certificate_free_credentials(global->xcred);		global->params_set = 0;	}	ret = gnutls_certificate_allocate_credentials(&global->xcred);	if (ret) {		wpa_printf(MSG_DEBUG, "Failed to allocate global credentials "			   "%s", gnutls_strerror(ret));		return -1;	}	if (params->ca_cert) {		ret = gnutls_certificate_set_x509_trust_file(			global->xcred, params->ca_cert, GNUTLS_X509_FMT_PEM);		if (ret < 0) {			wpa_printf(MSG_DEBUG, "Failed to read CA cert '%s' "				   "in PEM format: %s", params->ca_cert,				   gnutls_strerror(ret));			ret = gnutls_certificate_set_x509_trust_file(				global->xcred, params->ca_cert,				GNUTLS_X509_FMT_DER);			if (ret < 0) {				wpa_printf(MSG_DEBUG, "Failed to read CA cert "					   "'%s' in DER format: %s",					   params->ca_cert,					   gnutls_strerror(ret));				goto fail;			}		}	}	if (params->client_cert && params->private_key) {		/* TODO: private_key_passwd? */		ret = gnutls_certificate_set_x509_key_file(			global->xcred, params->client_cert,			params->private_key, GNUTLS_X509_FMT_PEM);		if (ret < 0) {			wpa_printf(MSG_DEBUG, "Failed to read client cert/key "				   "in PEM format: %s", gnutls_strerror(ret));			ret = gnutls_certificate_set_x509_key_file(				global->xcred, params->client_cert,				params->private_key, GNUTLS_X509_FMT_DER);			if (ret < 0) {				wpa_printf(MSG_DEBUG, "Failed to read client "					   "cert/key in DER format: %s",					   gnutls_strerror(ret));				goto fail;			}		}	} else if (params->private_key) {		int pkcs12_ok = 0;#ifdef PKCS12_FUNCS		/* Try to load in PKCS#12 format */#if LIBGNUTLS_VERSION_NUMBER >= 0x010302		ret = gnutls_certificate_set_x509_simple_pkcs12_file(			global->xcred, params->private_key,			GNUTLS_X509_FMT_DER, params->private_key_passwd);		if (ret != 0) {			wpa_printf(MSG_DEBUG, "Failed to load private_key in "				   "PKCS#12 format: %s", gnutls_strerror(ret));			goto fail;		} else			pkcs12_ok = 1;#endif /* LIBGNUTLS_VERSION_NUMBER >= 0x010302 */#endif /* PKCS12_FUNCS */		if (!pkcs12_ok) {			wpa_printf(MSG_DEBUG, "GnuTLS: PKCS#12 support not "				   "included");			goto fail;		}	}	global->params_set = 1;	return 0;fail:	gnutls_certificate_free_credentials(global->xcred);	return -1;}int tls_global_set_verify(void *ssl_ctx, int check_crl){	/* TODO */	return 0;}int tls_connection_set_verify(void *ssl_ctx, struct tls_connection *conn,			      int verify_peer){	if (conn == NULL || conn->session == NULL)		return -1;	conn->verify_peer = verify_peer;	gnutls_certificate_server_set_request(conn->session,					      verify_peer ? GNUTLS_CERT_REQUIRE					      : GNUTLS_CERT_REQUEST);	return 0;}int tls_connection_get_keys(void *ssl_ctx, struct tls_connection *conn,			    struct tls_keys *keys){#ifdef GNUTLS_INTERNAL_STRUCTURE_HACK	security_parameters_st *sec;#endif /* GNUTLS_INTERNAL_STRUCTURE_HACK */	if (conn == NULL || conn->session == NULL || keys == NULL)		return -1;	os_memset(keys, 0, sizeof(*keys));#ifdef GNUTLS_INTERNAL_STRUCTURE_HACK	sec = &conn->session->security_parameters;	keys->master_key = sec->master_secret;	keys->master_key_len = TLS_MASTER_SIZE;	keys->client_random = sec->client_random;	keys->server_random = sec->server_random;#else /* GNUTLS_INTERNAL_STRUCTURE_HACK */	keys->client_random =		(u8 *) gnutls_session_get_client_random(conn->session);	keys->server_random =		(u8 *) gnutls_session_get_server_random(conn->session);	/* No access to master_secret */#endif /* GNUTLS_INTERNAL_STRUCTURE_HACK */#ifdef GNUTLS_IA	gnutls_ia_extract_inner_secret(conn->session,				       (char *) conn->inner_secret);	keys->inner_secret = conn->inner_secret;	keys->inner_secret_len = TLS_MASTER_SIZE;#endif /* GNUTLS_IA */	keys->client_random_len = TLS_RANDOM_SIZE;	keys->server_random_len = TLS_RANDOM_SIZE;	return 0;}int tls_connection_prf(void *tls_ctx, struct tls_connection *conn,		       const char *label, int server_random_first,		       u8 *out, size_t out_len){#if LIBGNUTLS_VERSION_NUMBER >= 0x010302	if (conn == NULL || conn->session == NULL)		return -1;	return gnutls_prf(conn->session, os_strlen(label), label,			  server_random_first, 0, NULL, out_len, (char *) out);#else /* LIBGNUTLS_VERSION_NUMBER >= 0x010302 */	return -1;#endif /* LIBGNUTLS_VERSION_NUMBER >= 0x010302 */}static int tls_connection_verify_peer(struct tls_connection *conn){	unsigned int status, num_certs, i;	struct os_time now;	const gnutls_datum_t *certs;	gnutls_x509_crt_t cert;	if (gnutls_certificate_verify_peers2(conn->session, &status) < 0) {		wpa_printf(MSG_INFO, "TLS: Failed to verify peer "			   "certificate chain");		return -1;	}	if (conn->verify_peer && (status & GNUTLS_CERT_INVALID)) {		wpa_printf(MSG_INFO, "TLS: Peer certificate not trusted");		return -1;	}	if (status & GNUTLS_CERT_SIGNER_NOT_FOUND) {		wpa_printf(MSG_INFO, "TLS: Peer certificate does not have a "			   "known issuer");		return -1;	}	if (status & GNUTLS_CERT_REVOKED) {		wpa_printf(MSG_INFO, "TLS: Peer certificate has been revoked");		return -1;	}	os_get_time(&now);	certs = gnutls_certificate_get_peers(conn->session, &num_certs);	if (certs == NULL) {		wpa_printf(MSG_INFO, "TLS: No peer certificate chain "			   "received");		return -1;	}	for (i = 0; i < num_certs; i++) {		char *buf;		size_t len;		if (gnutls_x509_crt_init(&cert) < 0) {			wpa_printf(MSG_INFO, "TLS: Certificate initialization "				   "failed");			return -1;		}		if (gnutls_x509_crt_import(cert, &certs[i],					   GNUTLS_X509_FMT_DER) < 0) {			wpa_printf(MSG_INFO, "TLS: Could not parse peer "				   "certificate %d/%d", i + 1, num_certs);			gnutls_x509_crt_deinit(cert);			return -1;		}		gnutls_x509_crt_get_dn(cert, NULL, &len);		len++;		buf = os_malloc(len + 1);		if (buf) {			buf[0] = buf[len] = '\0';			gnutls_x509_crt_get_dn(cert, buf, &len);		}		wpa_printf(MSG_DEBUG, "TLS: Peer cert chain %d/%d: %s",			   i + 1, num_certs, buf);		if (i == 0) {