DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

Add domain_match network profile parameter

Browse source 
This is similar with domain_suffix_match, but required a full match of
the domain name rather than allowing suffix match (subdomains) or
wildcard certificates.

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2015-01-14 15:31:28 +02:00
parent 2099fed400
commit cebee30f31
10 changed files with 138 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

4
wpa_supplicant/config.c
View file

@ -1818,6 +1818,7 @@ static const struct parse_data ssid_fields[] = {
{ STRe(subject_match) },
{ STRe(altsubject_match) },
{ STRe(domain_suffix_match) },
{ STRe(domain_match) },
{ STRe(ca_cert2) },
{ STRe(ca_path2) },
{ STRe(client_cert2) },
@ -1827,6 +1828,7 @@ static const struct parse_data ssid_fields[] = {
{ STRe(subject_match2) },
{ STRe(altsubject_match2) },
{ STRe(domain_suffix_match2) },
{ STRe(domain_match2) },
{ STRe(phase1) },
{ STRe(phase2) },
{ STRe(pcsc) },
@ -2052,6 +2054,7 @@ static void eap_peer_config_free(struct eap_peer_config *eap)
os_free(eap->subject_match);
os_free(eap->altsubject_match);
os_free(eap->domain_suffix_match);
os_free(eap->domain_match);
os_free(eap->ca_cert2);
os_free(eap->ca_path2);
os_free(eap->client_cert2);
@ -2061,6 +2064,7 @@ static void eap_peer_config_free(struct eap_peer_config *eap)
os_free(eap->subject_match2);
os_free(eap->altsubject_match2);
os_free(eap->domain_suffix_match2);
os_free(eap->domain_match2);
os_free(eap->phase1);
os_free(eap->phase2);
os_free(eap->pcsc);

2
wpa_supplicant/config_file.c
View file

@ -691,6 +691,7 @@ static void wpa_config_write_network(FILE *f, struct wpa_ssid *ssid)
STR(subject_match);
STR(altsubject_match);
STR(domain_suffix_match);
STR(domain_match);
STR(ca_cert2);
STR(ca_path2);
STR(client_cert2);
@ -700,6 +701,7 @@ static void wpa_config_write_network(FILE *f, struct wpa_ssid *ssid)
STR(subject_match2);
STR(altsubject_match2);
STR(domain_suffix_match2);
STR(domain_match2);
STR(phase1);
STR(phase2);
STR(pcsc);

13
wpa_supplicant/wpa_supplicant.conf
View file

@ -873,7 +873,8 @@ fast_reauth=1
# /C=US/ST=CA/L=San Francisco/CN=Test AS/emailAddress=as@example.com
# Note: Since this is a substring match, this cannot be used securily to
# do a suffix match against a possible domain name in the CN entry. For
# such a use case, domain_suffix_match should be used instead.
# such a use case, domain_suffix_match or domain_match should be used
# instead.
# altsubject_match: Semicolon separated string of entries to be matched against
# the alternative subject name of the authentication server certificate.
# If this string is set, the server sertificate is only accepted if it
@ -896,6 +897,16 @@ fast_reauth=1
#
# For example, domain_suffix_match=example.com would match
# test.example.com but would not match test-example.com.
# domain_match: Constraint for server domain name
# If set, this FQDN is used as a full match requirement for the
# server certificate in SubjectAltName dNSName element(s). If a
# matching dNSName is found, this constraint is met. If no dNSName
# values are present, this constraint is matched against SubjectName CN
# using same full match comparison. This behavior is similar to
# domain_suffix_match, but has the requirement of a full match, i.e.,
# no subdomains or wildcard matches are allowed. Case-insensitive
# comparison is used, so "Example.com" matches "example.com", but would
# not match "test.Example.com".
# phase1: Phase1 (outer authentication, i.e., TLS tunnel) parameters
# (string with field-value pairs, e.g., "peapver=0" or
# "peapver=1 peaplabel=1")