DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

Extend domain_match and domain_suffix_match to allow list of values

Browse source 
These wpa_supplicant network profile parameters could be used to specify
a single match string that would be used against the dNSName items in
subjectAltName or CN. There may be use cases where more than one
alternative match string would be useful, so extend these to allow a
semicolon delimited list of values to be used (e.g.,
"example.org;example.com"). If any of the specified values matches any
of the dNSName/CN values in the server certificate, consider the
certificate as meeting this requirement.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
This commit is contained in:
Jouni Malinen 2019-04-09 16:18:19 +03:00 • committed by Jouni Malinen
parent dcc0ccd5b0
commit 242e857285
6 changed files with 138 additions and 37 deletions
Download patch file Download diff file Expand all files Collapse all files

28
src/crypto/tls_wolfssl.c
View file

@ -643,9 +643,9 @@ static int tls_match_alt_subject(WOLFSSL_X509 *cert, const char *match)
static int domain_suffix_match(const char *val, size_t len, const char *match,
int full)
size_t match_len, int full)
{
size_t i, match_len;
size_t i;
/* Check for embedded nuls that could mess up suffix matching */
for (i = 0; i < len; i++) {
@ -656,7 +656,6 @@ static int domain_suffix_match(const char *val, size_t len, const char *match,
}
}
match_len = os_strlen(match);
if (match_len > len || (full && match_len != len))
return 0;
@ -674,7 +673,8 @@ static int domain_suffix_match(const char *val, size_t len, const char *match,
}
static int tls_match_suffix(WOLFSSL_X509 *cert, const char *match, int full)
static int tls_match_suffix_helper(WOLFSSL_X509 *cert, const char *match,
size_t match_len, int full)
{
WOLFSSL_ASN1_OBJECT *gen;
void *ext;
@ -697,7 +697,7 @@ static int tls_match_suffix(WOLFSSL_X509 *cert, const char *match, int full)
gen->obj, os_strlen((char *)gen->obj));
if (domain_suffix_match((const char *) gen->obj,
os_strlen((char *) gen->obj), match,
full) == 1) {
match_len, full) == 1) {
wpa_printf(MSG_DEBUG, "TLS: %s in dNSName found",
full ? "Match" : "Suffix match");
wolfSSL_sk_ASN1_OBJECT_free(ext);
@ -729,8 +729,8 @@ static int tls_match_suffix(WOLFSSL_X509 *cert, const char *match, int full)
continue;
wpa_hexdump_ascii(MSG_DEBUG, "TLS: Certificate commonName",
cn->data, cn->length);
if (domain_suffix_match(cn->data, cn->length, match, full) == 1)
{
if (domain_suffix_match(cn->data, cn->length,
match, match_len, full) == 1) {
wpa_printf(MSG_DEBUG, "TLS: %s in commonName found",
full ? "Match" : "Suffix match");
return 1;
@ -743,6 +743,20 @@ static int tls_match_suffix(WOLFSSL_X509 *cert, const char *match, int full)
}
static int tls_match_suffix(WOLFSSL_X509 *cert, const char *match, int full)
{
const char *token, *last = NULL;
/* Process each match alternative separately until a match is found */
while ((token = cstr_token(match, ";", &last))) {
if (tls_match_suffix_helper(cert, token, last - token, full))
return 1;
}
return 0;
}
static enum tls_fail_reason wolfssl_tls_fail_reason(int err)
{
switch (err) {