mirror of https://github.com/hak5/openwrt.git
hostapd: add support for subject validation
The wpa_supplicant supports certificate subject validation via the subject match(2) and altsubject_match(2) fields. domain_match(2) and domain_suffix_match(2) fields are also supported for advanced matches. This validation is especially important when connecting to access points that use PAP as the Phase 2 authentication type. Without proper validation, the user's password can be transmitted to a rogue access point in plaintext without the user's knowledge. Most organizations already require these attributes to be included to ensure that the connection from the STA and the AP is secure. Includes LuCI changes via openwrt/luci#3444. From the documentation: subject_match - Constraint for server certificate subject. This substring is matched against the subject of the authentication server certificate. If this string is set, the server sertificate is only accepted if it contains this string in the subject. The subject string is in following format: /C=US/ST=CA/L=San Francisco/CN=Test AS/emailAddress=as .example.com subject_match2 - Constraint for server certificate subject. This field is like subject_match, but used for phase 2 (inside EAP-TTLS/PEAP/FAST tunnel) authentication. altsubject_match - Constraint for server certificate alt. subject. Semicolon separated string of entries to be matched against the alternative subject name of the authentication server certificate. If this string is set, the server sertificate is only accepted if it contains one of the entries in an alternative subject name extension. altSubjectName string is in following format: TYPE:VALUE Example: EMAIL:server@example.com Example: DNS:server.example.com;DNS:server2.example.com Following types are supported: EMAIL, DNS, URI altsubject_match2 - Constraint for server certificate alt. subject. This field is like altsubject_match, but used for phase 2 (inside EAP-TTLS/PEAP/FAST tunnel) authentication. domain_match - Constraint for server domain name. If set, this FQDN is used as a full match requirement for the server certificate in SubjectAltName dNSName element(s). If a matching dNSName is found, this constraint is met. If no dNSName values are present, this constraint is matched against SubjectName CN using same full match comparison. This behavior is similar to domain_suffix_match, but has the requirement of a full match, i.e., no subdomains or wildcard matches are allowed. Case-insensitive comparison is used, so "Example.com" matches "example.com", but would not match "test.Example.com". More than one match string can be provided by using semicolons to separate the strings (e.g., example.org;example.com). When multiple strings are specified, a match with any one of the values is considered a sufficient match for the certificate, i.e., the conditions are ORed together. domain_match2 - Constraint for server domain name. This field is like domain_match, but used for phase 2 (inside EAP-TTLS/PEAP/FAST tunnel) authentication. domain_suffix_match - Constraint for server domain name. If set, this FQDN is used as a suffix match requirement for the AAA server certificate in SubjectAltName dNSName element(s). If a matching dNSName is found, this constraint is met. If no dNSName values are present, this constraint is matched against SubjectName CN using same suffix match comparison. Suffix match here means that the host/domain name is compared one label at a time starting from the top-level domain and all the labels in domain_suffix_match shall be included in the certificate. The certificate may include additional sub-level labels in addition to the required labels. More than one match string can be provided by using semicolons to separate the strings (e.g., example.org;example.com). When multiple strings are specified, a match with any one of the values is considered a sufficient match for the certificate, i.e., the conditions are ORed together. For example, domain_suffix_match=example.com would match test.example.com but would not match test-example.com. This field is like domain_match, but used for phase 2 (inside EAP-TTLS/PEAP/FAST tunnel) authentication. domain_suffix_match2 - Constraint for server domain name. This field is like domain_suffix_match, but used for phase 2 (inside EAP-TTLS/PEAP/FAST tunnel) authentication. Signed-off-by: David Lam <david@thedavid.net>master
David Lam
Jo-Philipp Wich
parent
0e05093b12
commit
22b07ff73e
|
|
@ -7,7 +7,7 @@
|
|||
include $(TOPDIR)/rules.mk
|
||||
|
||||
PKG_NAME:=hostapd
|
||||
PKG_RELEASE:=2
|
||||
PKG_RELEASE:=3
|
||||
|
||||
PKG_SOURCE_URL:=http://w1.fi/hostap.git
|
||||
PKG_SOURCE_PROTO:=git
|
||||
|
|
|
|||
|
|
@ -202,6 +202,9 @@ hostapd_common_add_bss_config() {
|
|||
config_add_string radius_client_addr
|
||||
config_add_string iapp_interface
|
||||
config_add_string eap_type ca_cert client_cert identity anonymous_identity auth priv_key priv_key_pwd
|
||||
config_add_string subject_match subject_match2
|
||||
config_add_array altsubject_match altsubject_match2
|
||||
config_add_array domain_match domain_match2 domain_suffix_match domain_suffix_match2
|
||||
config_add_string ieee80211w_mgmt_cipher
|
||||
|
||||
config_add_int dynamic_vlan vlan_naming
|
||||
|
|
@ -872,6 +875,36 @@ wpa_supplicant_add_network() {
|
|||
append network_data "client_cert=\"$client_cert\"" "$N$T"
|
||||
append network_data "private_key=\"$priv_key\"" "$N$T"
|
||||
append network_data "private_key_passwd=\"$priv_key_pwd\"" "$N$T"
|
||||
|
||||
json_get_vars subject_match
|
||||
[ -n "$subject_match" ] && append network_data "subject_match=\"$subject_match\"" "$N$T"
|
||||
|
||||
json_get_values altsubject_match altsubject_match
|
||||
if [ -n "$altsubject_match" ]; then
|
||||
local list=
|
||||
for x in $altsubject_match; do
|
||||
append list "$x" ";"
|
||||
done
|
||||
append network_data "altsubject_match=\"$list\"" "$N$T"
|
||||
fi
|
||||
|
||||
json_get_values domain_match domain_match
|
||||
if [ -n "$domain_match" ]; then
|
||||
local list=
|
||||
for x in $domain_match; do
|
||||
append list "$x" ";"
|
||||
done
|
||||
append network_data "domain_match=\"$list\"" "$N$T"
|
||||
fi
|
||||
|
||||
json_get_values domain_suffix_match domain_suffix_match
|
||||
if [ -n "$domain_suffix_match" ]; then
|
||||
local list=
|
||||
for x in $domain_suffix_match; do
|
||||
append list "$x" ";"
|
||||
done
|
||||
append network_data "domain_suffix_match=\"$list\"" "$N$T"
|
||||
fi
|
||||
;;
|
||||
fast|peap|ttls)
|
||||
json_get_vars auth password ca_cert2 client_cert2 priv_key2 priv_key2_pwd
|
||||
|
|
@ -887,6 +920,36 @@ wpa_supplicant_add_network() {
|
|||
append network_data "password=\"$password\"" "$N$T"
|
||||
fi
|
||||
|
||||
json_get_vars subject_match
|
||||
[ -n "$subject_match" ] && append network_data "subject_match=\"$subject_match\"" "$N$T"
|
||||
|
||||
json_get_values altsubject_match altsubject_match
|
||||
if [ -n "$altsubject_match" ]; then
|
||||
local list=
|
||||
for x in $altsubject_match; do
|
||||
append list "$x" ";"
|
||||
done
|
||||
append network_data "altsubject_match=\"$list\"" "$N$T"
|
||||
fi
|
||||
|
||||
json_get_values domain_match domain_match
|
||||
if [ -n "$domain_match" ]; then
|
||||
local list=
|
||||
for x in $domain_match; do
|
||||
append list "$x" ";"
|
||||
done
|
||||
append network_data "domain_match=\"$list\"" "$N$T"
|
||||
fi
|
||||
|
||||
json_get_values domain_suffix_match domain_suffix_match
|
||||
if [ -n "$domain_suffix_match" ]; then
|
||||
local list=
|
||||
for x in $domain_suffix_match; do
|
||||
append list "$x" ";"
|
||||
done
|
||||
append network_data "domain_suffix_match=\"$list\"" "$N$T"
|
||||
fi
|
||||
|
||||
phase2proto="auth="
|
||||
case "$auth" in
|
||||
"auth"*)
|
||||
|
|
@ -896,6 +959,35 @@ wpa_supplicant_add_network() {
|
|||
auth="$(echo $auth | cut -b 5- )"
|
||||
[ "$eap_type" = "ttls" ] &&
|
||||
phase2proto="autheap="
|
||||
json_get_vars subject_match2
|
||||
[ -n "$subject_match2" ] && append network_data "subject_match2=\"$subject_match2\"" "$N$T"
|
||||
|
||||
json_get_values altsubject_match2 altsubject_match2
|
||||
if [ -n "$altsubject_match2" ]; then
|
||||
local list=
|
||||
for x in $altsubject_match2; do
|
||||
append list "$x" ";"
|
||||
done
|
||||
append network_data "altsubject_match2=\"$list\"" "$N$T"
|
||||
fi
|
||||
|
||||
json_get_values domain_match2 domain_match2
|
||||
if [ -n "$domain_match2" ]; then
|
||||
local list=
|
||||
for x in $domain_match2; do
|
||||
append list "$x" ";"
|
||||
done
|
||||
append network_data "domain_match2=\"$list\"" "$N$T"
|
||||
fi
|
||||
|
||||
json_get_values domain_suffix_match2 domain_suffix_match2
|
||||
if [ -n "$domain_suffix_match2" ]; then
|
||||
local list=
|
||||
for x in $domain_suffix_match2; do
|
||||
append list "$x" ";"
|
||||
done
|
||||
append network_data "domain_suffix_match2=\"$list\"" "$N$T"
|
||||
fi
|
||||
;;
|
||||
esac
|
||||
append network_data "phase2=\"$phase2proto$auth\"" "$N$T"
|
||||
|
|
|
|||
Loading…
Reference in New Issue