From nobody@FreeBSD.org  Sun Aug 16 14:46:30 2009
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 0DBA11065672
	for <freebsd-gnats-submit@FreeBSD.org>; Sun, 16 Aug 2009 14:46:30 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21])
	by mx1.freebsd.org (Postfix) with ESMTP id F0E398FC4D
	for <freebsd-gnats-submit@FreeBSD.org>; Sun, 16 Aug 2009 14:46:29 +0000 (UTC)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.14.3/8.14.3) with ESMTP id n7GEkTwx074594
	for <freebsd-gnats-submit@FreeBSD.org>; Sun, 16 Aug 2009 14:46:29 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.14.3/8.14.3/Submit) id n7GEkTJS074593;
	Sun, 16 Aug 2009 14:46:29 GMT
	(envelope-from nobody)
Message-Id: <200908161446.n7GEkTJS074593@www.freebsd.org>
Date: Sun, 16 Aug 2009 14:46:29 GMT
From: Wes Morgan <morganw@chemikals.org>
To: freebsd-gnats-submit@FreeBSD.org
Cc: <rpaulo@freebsd.org>
Subject: wpa_supplicant cannot verify SHA256 signed certificates
X-Send-Pr-Version: www-3.1
X-GNATS-Notify:

>Number:         137841
>Category:       bin
>Synopsis:       [patch] wpa_supplicant(8) cannot verify SHA256 signed certificates
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-net
>State:          patched
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Aug 16 14:50:12 UTC 2009
>Closed-Date:    
>Last-Modified:  Thu Jul 07 12:34:34 UTC 2011
>Originator:     Wes Morgan
>Release:        8.0-BETA2
>Organization:
>Environment:
FreeBSD catalyst 8.0-BETA2 FreeBSD 8.0-BETA2 #0: Sat Aug  1 07:14:50 CDT 2009     root@catalyst:/usr/obj/usr/src/sys/CATALYST  i386

>Description:
wpa_supplicant cannot verify a SHA256 signed certificate.
>How-To-Repeat:
Using XCA or OpenSSL, generate a set of certificates signed with the SHA256 digest. Attempts to use them with wpa_supplicant will fail.
>Fix:
Apply patch from vendor git respository for bug 323.

http://hostap.epitest.fi/gitweb/gitweb.cgi?p=hostap.git;a=commitdiff;h=e1ffdfc18be9027b5ff9ae254f92b6255930ac71


Patch attached with submission follows:

From: Jouni Malinen <j@w1.fi>
Date: Sun, 16 Aug 2009 07:25:13 +0000 (+0300)
Subject: Enable SHA256 digest support in OpenSSL
X-Git-Url: http://hostap.epitest.fi/gitweb/gitweb.cgi?p=hostap.git;a=commitdiff_plain;h=e1ffdfc18be9027b5ff9ae254f92b6255930ac71

Enable SHA256 digest support in OpenSSL

This is needed to allow X.509 certificates with SHA256 digest to be
used. [Bug 323]
---

diff --git a/src/crypto/tls_openssl.c b/src/crypto/tls_openssl.c
index d3ff2c5..1a716db 100644
--- a/src/crypto/tls_openssl.c
+++ b/src/crypto/tls_openssl.c
@@ -735,6 +735,9 @@ void * tls_init(const struct tls_config *conf)
 	if (tls_openssl_ref_count == 0) {
 		SSL_load_error_strings();
 		SSL_library_init();
+#ifndef OPENSSL_NO_SHA256
+		EVP_add_digest(EVP_sha256());
+#endif /* OPENSSL_NO_SHA256 */
 		/* TODO: if /dev/urandom is available, PRNG is seeded
 		 * automatically. If this is not the case, random data should
 		 * be added here. */


>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->freebsd-net 
Responsible-Changed-By: linimon 
Responsible-Changed-When: Sun Aug 16 16:01:47 UTC 2009 
Responsible-Changed-Why:  
Over to maintainer(s). 

http://www.freebsd.org/cgi/query-pr.cgi?pr=137841 
State-Changed-From-To: open->patched 
State-Changed-By: ae 
State-Changed-When: Thu Jul 7 12:31:23 UTC 2011 
State-Changed-Why:  
This issue was fixed in head/ with r214734. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=137841 
>Unformatted:
