diff options
author | V3n3RiX <venerix@koprulu.sector> | 2023-08-26 15:57:31 +0100 |
---|---|---|
committer | V3n3RiX <venerix@koprulu.sector> | 2023-08-26 15:57:31 +0100 |
commit | f6fd15e0418aea97c7ee77672468561cdac302e5 (patch) | |
tree | 6c13cdea083ccb5c111b15d7344bd8c0b4e61b73 /net-wireless/wpa_supplicant/files/wpa_supplicant-2.10-allow-legacy-renegotiation.patch | |
parent | f3471ff11210507b38c09f0e57df1bd601f629a5 (diff) |
gentoo auto-resync : 26:08:2023 - 15:57:31
Diffstat (limited to 'net-wireless/wpa_supplicant/files/wpa_supplicant-2.10-allow-legacy-renegotiation.patch')
-rw-r--r-- | net-wireless/wpa_supplicant/files/wpa_supplicant-2.10-allow-legacy-renegotiation.patch | 30 |
1 files changed, 30 insertions, 0 deletions
diff --git a/net-wireless/wpa_supplicant/files/wpa_supplicant-2.10-allow-legacy-renegotiation.patch b/net-wireless/wpa_supplicant/files/wpa_supplicant-2.10-allow-legacy-renegotiation.patch new file mode 100644 index 000000000000..574973fe6fe5 --- /dev/null +++ b/net-wireless/wpa_supplicant/files/wpa_supplicant-2.10-allow-legacy-renegotiation.patch @@ -0,0 +1,30 @@ +From: James Ralston <ralston@pobox.com> +Date: Sun, 1 May 2022 16:15:23 -0700 +Subject: Allow legacy renegotiation to fix PEAP issues with some servers + +Upstream: http://lists.infradead.org/pipermail/hostap/2022-May/040511.html +--- + src/crypto/tls_openssl.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/src/crypto/tls_openssl.c b/src/crypto/tls_openssl.c +index 273e5cb..ad3aa1a 100644 +--- a/src/crypto/tls_openssl.c ++++ b/src/crypto/tls_openssl.c +@@ -1056,6 +1056,16 @@ void * tls_init(const struct tls_config *conf) + SSL_CTX_set_options(ssl, SSL_OP_NO_SSLv2); + SSL_CTX_set_options(ssl, SSL_OP_NO_SSLv3); + ++ /* Many enterprise PEAP server implementations (e.g. used in large ++ corporations and universities) do not support RFC5746 secure ++ renegotiation, and starting with OpenSSL 3.0, ++ SSL_OP_LEGACY_SERVER_CONNECT is no longer set as part of SSL_OP_ALL. ++ So until we implement a way to request SSL_OP_LEGACY_SERVER_CONNECT ++ only in EAP peer mode, just set SSL_OP_LEGACY_SERVER_CONNECT ++ globally. */ ++ ++ SSL_CTX_set_options(ssl, SSL_OP_LEGACY_SERVER_CONNECT); ++ + SSL_CTX_set_mode(ssl, SSL_MODE_AUTO_RETRY); + + #ifdef SSL_MODE_NO_AUTO_CHAIN |