DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

OpenSSL: Allow systemwide policies to be overridden

Browse source 
Some distributions (e.g., Debian) have started introducting systemwide
OpenSSL policies to disable older protocol versions and ciphers
throughout all programs using OpenSSL. This can result in significant
number of interoperability issues with deployed EAP implementations.

Allow explicit wpa_supplicant (EAP peer) and hostapd (EAP server)
parameters to be used to request systemwide policies to be overridden if
older versions are needed to be able to interoperate with devices that
cannot be updated to support the newer protocol versions or keys. The
default behavior is not changed here, i.e., the systemwide policies will
be followed if no explicit override configuration is used. The overrides
should be used only if really needed since they can result in reduced
security.

In wpa_supplicant, tls_disable_tlsv1_?=0 value in the phase1 network
profile parameter can be used to explicitly enable TLS versions that are
disabled in the systemwide configuration. For example,
phase1="tls_disable_tlsv1_0=0 tls_disable_tlsv1_1=0" would request TLS
v1.0 and TLS v1.1 to be enabled even if the systemwide policy enforces
TLS v1.2 as the minimum version. Similarly, openssl_ciphers parameter
can be used to override systemwide policy, e.g., with
openssl_ciphers="DEFAULT@SECLEVEL=1" to drop from security level 2 to 1
in Debian to allow shorter keys to be used.

In hostapd, tls_flags parameter can be used to configure similar
options. E.g., tls_flags=[ENABLE-TLSv1.0][ENABLE-TLSv1.1]

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2019-01-05 17:02:33 +02:00
parent e3afbd796c
commit cc9c4feccc
6 changed files with 93 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

47
src/crypto/tls_openssl.c
View file

@ -2533,6 +2533,38 @@ static int tls_set_conn_flags(struct tls_connection *conn, unsigned int flags,
else
SSL_clear_options(ssl, SSL_OP_NO_TLSv1_3);
#endif /* SSL_OP_NO_TLSv1_3 */
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
if (flags & (TLS_CONN_ENABLE_TLSv1_0 |
TLS_CONN_ENABLE_TLSv1_1 |
TLS_CONN_ENABLE_TLSv1_2)) {
int version = 0;
/* Explicit request to enable TLS versions even if needing to
* override systemwide policies. */
if (flags & TLS_CONN_ENABLE_TLSv1_0) {
version = TLS1_VERSION;
} else if (flags & TLS_CONN_ENABLE_TLSv1_1) {
if (!(flags & TLS_CONN_DISABLE_TLSv1_0))
version = TLS1_1_VERSION;
} else if (flags & TLS_CONN_ENABLE_TLSv1_2) {
if (!(flags & (TLS_CONN_DISABLE_TLSv1_0 |
TLS_CONN_DISABLE_TLSv1_1)))
version = TLS1_2_VERSION;
}
if (!version) {
wpa_printf(MSG_DEBUG,
"OpenSSL: Invalid TLS version configuration");
return -1;
}
if (SSL_set_min_proto_version(ssl, version) != 1) {
wpa_printf(MSG_DEBUG,
"OpenSSL: Failed to set minimum TLS version");
return -1;
}
}
#endif /* >= 1.1.0 */
#ifdef CONFIG_SUITEB
#ifdef OPENSSL_IS_BORINGSSL
/* Start with defaults from BoringSSL */
@ -2635,7 +2667,22 @@ static int tls_set_conn_flags(struct tls_connection *conn, unsigned int flags,
return -1;
}
}
#else /* OPENSSL_IS_BORINGSSL */
if (!(flags & (TLS_CONN_SUITEB | TLS_CONN_SUITEB_NO_ECDH)) &&
openssl_ciphers && SSL_set_cipher_list(ssl, openssl_ciphers) != 1) {
wpa_printf(MSG_INFO,
"OpenSSL: Failed to set openssl_ciphers '%s'",
openssl_ciphers);
return -1;
}
#endif /* OPENSSL_IS_BORINGSSL */
#else /* CONFIG_SUITEB */
if (openssl_ciphers && SSL_set_cipher_list(ssl, openssl_ciphers) != 1) {
wpa_printf(MSG_INFO,
"OpenSSL: Failed to set openssl_ciphers '%s'",
openssl_ciphers);
return -1;
}
#endif /* CONFIG_SUITEB */
return 0;