From ebb3055e13029acc4d6a47575ab8902b2137dcbe Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Sat, 16 Apr 2022 11:38:44 +0300 Subject: [PATCH] OpenSSL: Generate DH parameters automatically if not set with dh_file This is the recommended way of using DH in OpenSSL TLS handshake. Signed-off-by: Jouni Malinen --- hostapd/hostapd.conf | 11 +++++------ src/crypto/tls_openssl.c | 16 +++++++++++----- 2 files changed, 16 insertions(+), 11 deletions(-) diff --git a/hostapd/hostapd.conf b/hostapd/hostapd.conf index 6930ad20d..7fad30227 100644 --- a/hostapd/hostapd.conf +++ b/hostapd/hostapd.conf @@ -1254,12 +1254,11 @@ eap_server=0 # dh_file: File path to DH/DSA parameters file (in PEM format) # This is an optional configuration file for setting parameters for an -# ephemeral DH key exchange. In most cases, the default RSA authentication does -# not use this configuration. However, it is possible setup RSA to use -# ephemeral DH key exchange. In addition, ciphers with DSA keys always use -# ephemeral DH keys. This can be used to achieve forward secrecy. If the file -# is in DSA parameters format, it will be automatically converted into DH -# params. This parameter is required if anonymous EAP-FAST is used. +# ephemeral DH key exchange. If the file is in DSA parameters format, it will +# be automatically converted into DH params. If the used TLS library supports +# automatic DH parameter selection, that functionality will be used if this +# parameter is not set. DH parameters are required if anonymous EAP-FAST is +# used. # You can generate DH parameters file with OpenSSL, e.g., # "openssl dhparam -out /etc/hostapd.dh.pem 2048" #dh_file=/etc/hostapd.dh.pem diff --git a/src/crypto/tls_openssl.c b/src/crypto/tls_openssl.c index e2515323a..65ffd03a2 100644 --- a/src/crypto/tls_openssl.c +++ b/src/crypto/tls_openssl.c @@ -4001,10 +4001,12 @@ static int tls_global_dh(struct tls_data *data, const char *dh_file) EVP_PKEY *pkey = NULL, *tmpkey = NULL; bool dsa = false; - if (!dh_file) - return 0; if (!ssl_ctx) return -1; + if (!dh_file) { + SSL_CTX_set_dh_auto(ssl_ctx, 1); + return 0; + } bio = BIO_new_file(dh_file, "r"); if (!bio) { @@ -4066,10 +4068,14 @@ static int tls_global_dh(struct tls_data *data, const char *dh_file) DH *dh; BIO *bio; - if (dh_file == NULL) - return 0; - if (ssl_ctx == NULL) + if (!ssl_ctx) return -1; + if (!dh_file) { +#if OPENSSL_VERSION_NUMBER >= 0x10100000L + SSL_CTX_set_dh_auto(ssl_ctx, 1); +#endif + return 0; + } bio = BIO_new_file(dh_file, "r"); if (bio == NULL) {