[PATCH] tls_openssl.c

[polish]

 	Hello Jouni,

   i'm sending you this patch again. Patch solve problem with processing 
alt_subject_match options (possible security risk and processing more than 
one extension (same type DNS for example)  in option). This version is 
applicable to wpa_supplicant-0.5-2006-11-11 snapshot and add wpa_printf 
debug messages.
   Please take a look at patch and send me response, necessary modification 
i would like to make for you.

 	Best regards	Polish

-- 
**********************************************************
*  starnem a porad nic, rozum jako kdyby se nam vyhybal  *
**********************************************************
-------------- next part --------------
--- tls_openssl.c.orig	2006-11-05 18:20:31.000000000 +0100
+++ tls_openssl.c	2006-11-17 20:59:37.000000000 +0100
@@ -952,43 +952,61 @@
 	int i, found = 0;
 	size_t len;
 
-	ext = X509_get_ext_d2i(cert, NID_subject_alt_name, NULL, NULL);
+	size_t m_len, m_space;
+  char *m_match,  *match_tmp;
+  char *match_copy = os_strdup( match );
+
+  match_tmp = match_copy;
+  while(( m_match = strtok( match_tmp, ";" )) != NULL ) {
+    match_tmp = NULL;
+    m_space = strspn( m_match, " " );
+    m_match = m_match + m_space;
+    m_len = os_strlen( m_match );
+
+    ext = X509_get_ext_d2i(cert, NID_subject_alt_name, NULL, NULL);
+
+    for (i = 0; ext && i < sk_GENERAL_NAME_num(ext); i++) {
+      gen = sk_GENERAL_NAME_value(ext, i);
+      switch (gen->type) {
+	      case GEN_EMAIL:
+	        field = "EMAIL";
+	        break;
+	      case GEN_DNS:
+	        field = "DNS";
+	        break;
+	      case GEN_URI:
+	        field = "URI";
+	        break;
+	      default:
+	        field = NULL;
+	        wpa_printf(MSG_DEBUG, "TLS: altSubjectName: " "unsupported type=%d", gen->type);
+	        break;
+			}
+
+			if(!field)
+				continue;
 
-	for (i = 0; ext && i < sk_GENERAL_NAME_num(ext); i++) {
-		gen = sk_GENERAL_NAME_value(ext, i);
-		switch (gen->type) {
-		case GEN_EMAIL:
-			field = "EMAIL";
-			break;
-		case GEN_DNS:
-			field = "DNS";
-			break;
-		case GEN_URI:
-			field = "URI";
-			break;
-		default:
-			field = NULL;
-			wpa_printf(MSG_DEBUG, "TLS: altSubjectName: "
-				   "unsupported type=%d", gen->type);
-			break;
-		}
 
-		if (!field)
-			continue;
+			wpa_printf(MSG_DEBUG, "TLS: altSubjectName: %s:%s", field, gen->d.ia5->data);
+			len = os_strlen(field) + 1 + os_strlen((char *) gen->d.ia5->data) + 1;
+			if( len == (m_len + 1)) {
+			  wpa_printf( MSG_DEBUG, "TLS: length of altsubjectmatch strings are equal \n" ); 
+			  tmp = os_malloc(len);
+			  if(tmp == NULL)
+			     continue;
+				
+				os_snprintf(tmp, len, "%s:%s", field, gen->d.ia5->data);
+        wpa_printf( MSG_DEBUG, "TLS: tls_match_altsubject() : tmp= %s\nxpl: m_match= %s\n", tmp, m_match );
+        if(os_strncmp(tmp, m_match, m_len) == 0) {
+          wpa_printf( MSG_DEBUG, "TLS: tls_match_altsubject() : test ok\n" );
+					found++;
+				}
+				os_free(tmp);
+			}
+		}
 
-		wpa_printf(MSG_DEBUG, "TLS: altSubjectName: %s:%s",
-			   field, gen->d.ia5->data);
-		len = os_strlen(field) + 1 +
-			os_strlen((char *) gen->d.ia5->data) + 1;
-		tmp = os_malloc(len);
-		if (tmp == NULL)
-			continue;
-		os_snprintf(tmp, len, "%s:%s", field, gen->d.ia5->data);
-		tmp[len - 1] = '\0';
-		if (os_strstr(tmp, match))
-			found++;
-		os_free(tmp);
 	}
+	os_free( match_copy );
 
 	return found;
 }