DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

Extend domain_match and domain_suffix_match to allow list of values

Browse source 
These wpa_supplicant network profile parameters could be used to specify
a single match string that would be used against the dNSName items in
subjectAltName or CN. There may be use cases where more than one
alternative match string would be useful, so extend these to allow a
semicolon delimited list of values to be used (e.g.,
"example.org;example.com"). If any of the specified values matches any
of the dNSName/CN values in the server certificate, consider the
certificate as meeting this requirement.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
This commit is contained in:
Jouni Malinen 2019-04-09 16:18:19 +03:00 • committed by Jouni Malinen
parent dcc0ccd5b0
commit 242e857285
6 changed files with 138 additions and 37 deletions
Download patch file Download diff file Expand all files Collapse all files

12
wpa_supplicant/wpa_supplicant.conf
View file

@ -1180,6 +1180,12 @@ fast_reauth=1
# certificate may include additional sub-level labels in addition to the
# required labels.
#
# More than one match string can be provided by using semicolons to
# separate the strings (e.g., example.org;example.com). When multiple
# strings are specified, a match with any one of the values is considered
# a sufficient match for the certificate, i.e., the conditions are ORed
# together.
#
# For example, domain_suffix_match=example.com would match
# test.example.com but would not match test-example.com.
# domain_match: Constraint for server domain name
@ -1192,6 +1198,12 @@ fast_reauth=1
# no subdomains or wildcard matches are allowed. Case-insensitive
# comparison is used, so "Example.com" matches "example.com", but would
# not match "test.Example.com".
#
# More than one match string can be provided by using semicolons to
# separate the strings (e.g., example.org;example.com). When multiple
# strings are specified, a match with any one of the values is considered
# a sufficient match for the certificate, i.e., the conditions are ORed
# together.
# phase1: Phase1 (outer authentication, i.e., TLS tunnel) parameters
# (string with field-value pairs, e.g., "peapver=0" or
# "peapver=1 peaplabel=1")