"preverify_ok=%d err=%d (%s) depth=%d buf='%s'",			   preverify_ok, err,			   X509_verify_cert_error_string(err), depth, buf);		if (depth == 0 && match && os_strstr(buf, match) == NULL) {			wpa_printf(MSG_WARNING, "TLS: Subject '%s' did not "				   "match with '%s'", buf, match);			preverify_ok = 0;		} else if (depth == 0 && altmatch &&			   !tls_match_altsubject(err_cert, altmatch)) {			wpa_printf(MSG_WARNING, "TLS: altSubjectName match "				   "'%s' not found", altmatch);			preverify_ok = 0;		}	}	return preverify_ok;}#ifndef OPENSSL_NO_STDIOstatic int tls_load_ca_der(void *_ssl_ctx, const char *ca_cert){	SSL_CTX *ssl_ctx = _ssl_ctx;	X509_LOOKUP *lookup;	int ret = 0;	lookup = X509_STORE_add_lookup(ssl_ctx->cert_store,				       X509_LOOKUP_file());	if (lookup == NULL) {		tls_show_errors(MSG_WARNING, __func__,				"Failed add lookup for X509 store");		return -1;	}	if (!X509_LOOKUP_load_file(lookup, ca_cert, X509_FILETYPE_ASN1)) {		unsigned long err = ERR_peek_error();		tls_show_errors(MSG_WARNING, __func__,				"Failed load CA in DER format");		if (ERR_GET_LIB(err) == ERR_LIB_X509 &&		    ERR_GET_REASON(err) == X509_R_CERT_ALREADY_IN_HASH_TABLE) {			wpa_printf(MSG_DEBUG, "OpenSSL: %s - ignoring "				   "cert already in hash table error",				   __func__);		} else			ret = -1;	}	return ret;}#endif /* OPENSSL_NO_STDIO */static int tls_connection_ca_cert(void *_ssl_ctx, struct tls_connection *conn,				  const char *ca_cert, const u8 *ca_cert_blob,				  size_t ca_cert_blob_len, const char *ca_path){	SSL_CTX *ssl_ctx = _ssl_ctx;	/*	 * Remove previously configured trusted CA certificates before adding	 * new ones.	 */	X509_STORE_free(ssl_ctx->cert_store);	ssl_ctx->cert_store = X509_STORE_new();	if (ssl_ctx->cert_store == NULL) {		wpa_printf(MSG_DEBUG, "OpenSSL: %s - failed to allocate new "			   "certificate store", __func__);		return -1;	}	if (ca_cert_blob) {		X509 *cert = d2i_X509(NULL, (OPENSSL_d2i_TYPE) &ca_cert_blob,				      ca_cert_blob_len);		if (cert == NULL) {			tls_show_errors(MSG_WARNING, __func__,					"Failed to parse ca_cert_blob");			return -1;		}		if (!X509_STORE_add_cert(ssl_ctx->cert_store, cert)) {			unsigned long err = ERR_peek_error();			tls_show_errors(MSG_WARNING, __func__,					"Failed to add ca_cert_blob to "					"certificate store");			if (ERR_GET_LIB(err) == ERR_LIB_X509 &&			    ERR_GET_REASON(err) ==			    X509_R_CERT_ALREADY_IN_HASH_TABLE) {				wpa_printf(MSG_DEBUG, "OpenSSL: %s - ignoring "					   "cert already in hash table error",					   __func__);			} else {				X509_free(cert);				return -1;			}		}		X509_free(cert);		wpa_printf(MSG_DEBUG, "OpenSSL: %s - added ca_cert_blob "			   "to certificate store", __func__);		SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, tls_verify_cb);		return 0;	}#ifdef CONFIG_NATIVE_WINDOWS	if (ca_cert && tls_cryptoapi_ca_cert(ssl_ctx, conn->ssl, ca_cert) ==	    0) {		wpa_printf(MSG_DEBUG, "OpenSSL: Added CA certificates from "			   "system certificate store");		SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, tls_verify_cb);		return 0;	}#endif /* CONFIG_NATIVE_WINDOWS */	if (ca_cert || ca_path) {#ifndef OPENSSL_NO_STDIO		if (SSL_CTX_load_verify_locations(ssl_ctx, ca_cert, ca_path) !=		    1) {			tls_show_errors(MSG_WARNING, __func__,					"Failed to load root certificates");			if (ca_cert &&			    tls_load_ca_der(ssl_ctx, ca_cert) == 0) {				wpa_printf(MSG_DEBUG, "OpenSSL: %s - loaded "					   "DER format CA certificate",					   __func__);			} else				return -1;		} else {			wpa_printf(MSG_DEBUG, "TLS: Trusted root "				   "certificate(s) loaded");			tls_get_errors(ssl_ctx);		}		SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, tls_verify_cb);#else /* OPENSSL_NO_STDIO */		wpa_printf(MSG_DEBUG, "OpenSSL: %s - OPENSSL_NO_STDIO",			   __func__);		return -1;#endif /* OPENSSL_NO_STDIO */	} else {		/* No ca_cert configured - do not try to verify server		 * certificate */		SSL_set_verify(conn->ssl, SSL_VERIFY_NONE, NULL);	}	return 0;}static int tls_global_ca_cert(SSL_CTX *ssl_ctx, const char *ca_cert){	if (ca_cert) {		if (SSL_CTX_load_verify_locations(ssl_ctx, ca_cert, NULL) != 1)		{			tls_show_errors(MSG_WARNING, __func__,					"Failed to load root certificates");			return -1;		}		wpa_printf(MSG_DEBUG, "TLS: Trusted root "			   "certificate(s) loaded");#ifndef OPENSSL_NO_STDIO		/* Add the same CAs to the client certificate requests */		SSL_CTX_set_client_CA_list(ssl_ctx,					   SSL_load_client_CA_file(ca_cert));#endif /* OPENSSL_NO_STDIO */	}	return 0;}int tls_global_set_verify(void *ssl_ctx, int check_crl){	int flags;	if (check_crl) {		X509_STORE *cs = SSL_CTX_get_cert_store(ssl_ctx);		if (cs == NULL) {			tls_show_errors(MSG_INFO, __func__, "Failed to get "					"certificate store when enabling "					"check_crl");			return -1;		}		flags = X509_V_FLAG_CRL_CHECK;		if (check_crl == 2)			flags |= X509_V_FLAG_CRL_CHECK_ALL;		X509_STORE_set_flags(cs, flags);	}	return 0;}static int tls_connection_set_subject_match(struct tls_connection *conn,					    const char *subject_match,					    const char *altsubject_match){	os_free(conn->subject_match);	conn->subject_match = NULL;	if (subject_match) {		conn->subject_match = os_strdup(subject_match);		if (conn->subject_match == NULL)			return -1;	}	os_free(conn->altsubject_match);	conn->altsubject_match = NULL;	if (altsubject_match) {		conn->altsubject_match = os_strdup(altsubject_match);		if (conn->altsubject_match == NULL)			return -1;	}	return 0;}int tls_connection_set_verify(void *ssl_ctx, struct tls_connection *conn,			      int verify_peer){	static int counter = 0;	if (conn == NULL)		return -1;	if (verify_peer) {		SSL_set_verify(conn->ssl, SSL_VERIFY_PEER |			       SSL_VERIFY_FAIL_IF_NO_PEER_CERT |			       SSL_VERIFY_CLIENT_ONCE, tls_verify_cb);	} else {		SSL_set_verify(conn->ssl, SSL_VERIFY_NONE, NULL);	}	SSL_set_accept_state(conn->ssl);	/*	 * Set session id context in order to avoid fatal errors when client	 * tries to resume a session. However, set the context to a unique	 * value in order to effectively disable session resumption for now	 * since not all areas of the server code are ready for it (e.g.,	 * EAP-TTLS needs special handling for Phase 2 after abbreviated TLS	 * handshake).	 */	counter++;	SSL_set_session_id_context(conn->ssl,				   (const unsigned char *) &counter,				   sizeof(counter));	return 0;}static int tls_connection_client_cert(struct tls_connection *conn,				      const char *client_cert,				      const u8 *client_cert_blob,				      size_t client_cert_blob_len){	if (client_cert == NULL && client_cert_blob == NULL)		return 0;	if (client_cert_blob &&	    SSL_use_certificate_ASN1(conn->ssl, (u8 *) client_cert_blob,				     client_cert_blob_len) == 1) {		wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_certificate_ASN1 --> "			   "OK");		return 0;	} else if (client_cert_blob) {		tls_show_errors(MSG_DEBUG, __func__,				"SSL_use_certificate_ASN1 failed");	}	if (client_cert == NULL)		return -1;#ifndef OPENSSL_NO_STDIO	if (SSL_use_certificate_file(conn->ssl, client_cert,				     SSL_FILETYPE_ASN1) == 1) {		wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_certificate_file (DER)"			   " --> OK");		return 0;	} else {		tls_show_errors(MSG_DEBUG, __func__,				"SSL_use_certificate_file (DER) failed");	}	if (SSL_use_certificate_file(conn->ssl, client_cert,				     SSL_FILETYPE_PEM) == 1) {		wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_certificate_file (PEM)"			   " --> OK");		return 0;	} else {		tls_show_errors(MSG_DEBUG, __func__,				"SSL_use_certificate_file (PEM) failed");	}#else /* OPENSSL_NO_STDIO */	wpa_printf(MSG_DEBUG, "OpenSSL: %s - OPENSSL_NO_STDIO", __func__);#endif /* OPENSSL_NO_STDIO */	return -1;}static int tls_global_client_cert(SSL_CTX *ssl_ctx, const char *client_cert){#ifndef OPENSSL_NO_STDIO	if (client_cert == NULL)		return 0;	if (SSL_CTX_use_certificate_file(ssl_ctx, client_cert,					 SSL_FILETYPE_ASN1) != 1 &&	    SSL_CTX_use_certificate_file(ssl_ctx, client_cert,					 SSL_FILETYPE_PEM) != 1) {		tls_show_errors(MSG_INFO, __func__,				"Failed to load client certificate");		return -1;	}	return 0;#else /* OPENSSL_NO_STDIO */	if (client_cert == NULL)		return 0;	wpa_printf(MSG_DEBUG, "OpenSSL: %s - OPENSSL_NO_STDIO", __func__);	return -1;#endif /* OPENSSL_NO_STDIO */}static int tls_passwd_cb(char *buf, int size, int rwflag, void *password){	if (password == NULL) {		return 0;	}	os_strlcpy(buf, (char *) password, size);	return os_strlen(buf);}#ifdef PKCS12_FUNCSstatic int tls_parse_pkcs12(SSL_CTX *ssl_ctx, SSL *ssl, PKCS12 *p12,			    const char *passwd){	EVP_PKEY *pkey;	X509 *cert;	STACK_OF(X509) *certs;	int res = 0;	char buf[256];	pkey = NULL;	cert = NULL;	certs = NULL;	if (!PKCS12_parse(p12, passwd, &pkey, &cert, &certs)) {		tls_show_errors(MSG_DEBUG, __func__,				"Failed to parse PKCS12 file");		PKCS12_free(p12);		return -1;	}	wpa_printf(MSG_DEBUG, "TLS: Successfully parsed PKCS12 data");	if (cert) {		X509_NAME_oneline(X509_get_subject_name(cert), buf,				  sizeof(buf));		wpa_printf(MSG_DEBUG, "TLS: Got certificate from PKCS12: "			   "subject='%s'", buf);		if (ssl) {			if (SSL_use_certificate(ssl, cert) != 1)				res = -1;		} else {			if (SSL_CTX_use_certificate(ssl_ctx, cert) != 1)				res = -1;		}		X509_free(cert);	}	if (pkey) {		wpa_printf(MSG_DEBUG, "TLS: Got private key from PKCS12");		if (ssl) {			if (SSL_use_PrivateKey(ssl, pkey) != 1)				res = -1;		} else {			if (SSL_CTX_use_PrivateKey(ssl_ctx, pkey) != 1)				res = -1;		}		EVP_PKEY_free(pkey);	}	if (certs) {		while ((cert = sk_X509_pop(certs)) != NULL) {			X509_NAME_oneline(X509_get_subject_name(cert), buf,					  sizeof(buf));			wpa_printf(MSG_DEBUG, "TLS: additional certificate"				   " from PKCS12: subject='%s'", buf);			/*			 * There is no SSL equivalent for the chain cert - so			 * always add it to the context...			 */			if (SSL_CTX_add_extra_chain_cert(ssl_ctx, cert) != 1) {				res = -1;				break;			}		}		sk_X509_free(certs);	}	PKCS12_free(p12);	if (res < 0)		tls_get_errors(ssl_ctx);	return res;}#endif  /* PKCS12_FUNCS */static int tls_read_pkcs12(SSL_CTX *ssl_ctx, SSL *ssl, const char *private_key,			   const char *passwd){#ifdef PKCS12_FUNCS	FILE *f;	PKCS12 *p12;	f = fopen(private_key, "rb");	if (f == NULL)		return -1;	p12 = d2i_PKCS12_fp(f, NULL);	fclose(f);	if (p12 == NULL) {		tls_show_errors(MSG_INFO, __func__,				"Failed to use PKCS#12 file");		return -1;	}	return tls_parse_pkcs12(ssl_ctx, ssl, p12, passwd);#else /* PKCS12_FUNCS */	wpa_printf(MSG_INFO, "TLS: PKCS12 support disabled - cannot read "		   "p12/pfx files");	return -1;#endif  /* PKCS12_FUNCS */}static int tls_read_pkcs12_blob(SSL_CTX *ssl_ctx, SSL *ssl,				const u8 *blob, size_t len, const char *passwd){#ifdef PKCS12_FUNCS	PKCS12 *p12;	p12 = d2i_PKCS12(NULL, (OPENSSL_d2i_TYPE) &blob, len);	if (p12 == NULL) {		tls_show_errors(MSG_INFO, __func__,				"Failed to use PKCS#12 blob");		return -1;	}	return tls_parse_pkcs12(ssl_ctx, ssl, p12, passwd);#else /* PKCS12_FUNCS */	wpa_printf(MSG_INFO, "TLS: PKCS12 support disabled - cannot parse "		   "p12/pfx blobs");	return -1;#endif  /* PKCS12_FUNCS */}#ifndef OPENSSL_NO_ENGINEstatic int tls_engine_get_cert(struct tls_connection *conn,			       const char *cert_id,			       X509 **cert){	/* this runs after the private key is loaded so no PIN is required */	struct {		const char *cert_id;		X509 *cert;	} params;	params.cert_id = cert_id;	params.cert = NULL;	if (!ENGINE_ctrl_cmd(conn->engine, "LOAD_CERT_CTRL",			     0, &params, NULL, 1)) {		wpa_printf(MSG_ERROR, "ENGINE: cannot load client cert with id"			   " '%s' [%s]", cert_id,			   ERR_error_string(ERR_get_error(), NULL));		return TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED;	}	if (!params.cert) {		wpa_printf(MSG_ERROR, "ENGINE: did not properly cert with id"			   " '%s'", cert_id);		return TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED;	}	*cert = params.cert;	return 0;}#endif /* OPENSSL_NO_ENGINE */static int tls_connection_engine_client_cert(struct tls_connection *conn,					     const char *cert_id){#ifndef OPENSSL_NO_ENGINE	X509 *cert;	if (tls_engine_get_cert(conn, cert_id, &cert))		return -1;	if (!SSL_use_certificate(conn->ssl, cert)) {		tls_show_errors(MSG_ERROR, __func__,				"SSL_use_certificate failed");                X509_free(cert);		return -1;	}	X509_free(cert);	wpa_printf(MSG_DEBUG, "ENGINE: SSL_use_certificate --> "		   "OK");	return 0;#else /* OPENSSL_NO_ENGINE */	return -1;#endif /* OPENSSL_NO_ENGINE */}static int tls_connection_engine_ca_cert(void *_ssl_ctx,					 struct tls_connection *conn,					 const char *ca_cert_id){#ifndef OPENSSL_NO_ENGINE	X509 *cert;	SSL_CTX *ssl_ctx = _ssl_ctx;	if (tls_engine_get_cert(conn, ca_cert_id, &cert))		return -1;	/* start off the same as tls_connection_ca_cert */	X509_STORE_free(ssl_ctx->cert_store);