diff options
| author | Dmitry Shmidt <dimitrysh@google.com> | 2014-02-20 10:18:40 -0800 |
|---|---|---|
| committer | Dmitry Shmidt <dimitrysh@google.com> | 2014-02-20 10:18:40 -0800 |
| commit | 13ca8d8ea51a1aa5e24c6c956473a11b0c7daed4 (patch) | |
| tree | 7f4beaece38391e858e55616f3d79b00ea095129 /src/crypto | |
| parent | 73bb22fa892a8967f458db5459684617ac52c063 (diff) | |
| download | android_external_wpa_supplicant_8-13ca8d8ea51a1aa5e24c6c956473a11b0c7daed4.tar.gz android_external_wpa_supplicant_8-13ca8d8ea51a1aa5e24c6c956473a11b0c7daed4.tar.bz2 android_external_wpa_supplicant_8-13ca8d8ea51a1aa5e24c6c956473a11b0c7daed4.zip | |
Cumulative patch from commit 848905b12abf2df650c43cb821d36a13246baacb
848905b Avoid undefined references with CONFIG_WPA_TRACE_BFD=y
9e38836 wpa_debug: Remove 2048 byte message length limit
f667e03 P2P: Address few issues seen with P2P SD
e9a6f18 TLS: Add tls_disable_tlsv1_1 and tls_disable_tlsv1_2 phase1 params
cb10c7d RADIUS DAS: Add support for NAS identification attributes
0d7c5e1 RADIUS DAS: Remove PMKSA entry on Disconnect-Request
d87a6ac WPS: Fix STA state validation when processing PutWLANResponse
Change-Id: I4799cad2fe661db567eb3a92af2b3eefb7c96dab
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
Diffstat (limited to 'src/crypto')
| -rw-r--r-- | src/crypto/tls.h | 2 | ||||
| -rw-r--r-- | src/crypto/tls_openssl.c | 13 |
2 files changed, 15 insertions, 0 deletions
diff --git a/src/crypto/tls.h b/src/crypto/tls.h index feba13ff..88afae48 100644 --- a/src/crypto/tls.h +++ b/src/crypto/tls.h @@ -85,6 +85,8 @@ struct tls_config { #define TLS_CONN_DISABLE_SESSION_TICKET BIT(2) #define TLS_CONN_REQUEST_OCSP BIT(3) #define TLS_CONN_REQUIRE_OCSP BIT(4) +#define TLS_CONN_DISABLE_TLSv1_1 BIT(5) +#define TLS_CONN_DISABLE_TLSv1_2 BIT(6) /** * struct tls_connection_params - Parameters for TLS connection diff --git a/src/crypto/tls_openssl.c b/src/crypto/tls_openssl.c index 2fd7bbbe..0b4e2677 100644 --- a/src/crypto/tls_openssl.c +++ b/src/crypto/tls_openssl.c @@ -3182,6 +3182,19 @@ int tls_connection_set_params(void *tls_ctx, struct tls_connection *conn, #endif /* SSL_clear_options */ #endif /* SSL_OP_NO_TICKET */ +#ifdef SSL_OP_NO_TLSv1_1 + if (params->flags & TLS_CONN_DISABLE_TLSv1_1) + SSL_set_options(conn->ssl, SSL_OP_NO_TLSv1_1); + else + SSL_clear_options(conn->ssl, SSL_OP_NO_TLSv1_1); +#endif /* SSL_OP_NO_TLSv1_1 */ +#ifdef SSL_OP_NO_TLSv1_2 + if (params->flags & TLS_CONN_DISABLE_TLSv1_2) + SSL_set_options(conn->ssl, SSL_OP_NO_TLSv1_2); + else + SSL_clear_options(conn->ssl, SSL_OP_NO_TLSv1_2); +#endif /* SSL_OP_NO_TLSv1_2 */ + #ifdef HAVE_OCSP if (params->flags & TLS_CONN_REQUEST_OCSP) { SSL_CTX *ssl_ctx = tls_ctx; |