DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

OpenSSL: Generate DH parameters automatically if not set with dh_file

Browse source 
This is the recommended way of using DH in OpenSSL TLS handshake.

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2022-04-16 11:38:44 +03:00
parent bcd299b326
commit ebb3055e13
2 changed files with 16 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
hostapd/hostapd.conf
View file

@ -1254,12 +1254,11 @@ eap_server=0
# dh_file: File path to DH/DSA parameters file (in PEM format) # dh_file: File path to DH/DSA parameters file (in PEM format)
# This is an optional configuration file for setting parameters for an # This is an optional configuration file for setting parameters for an
# ephemeral DH key exchange. In most cases, the default RSA authentication does # ephemeral DH key exchange. If the file is in DSA parameters format, it will
# not use this configuration. However, it is possible setup RSA to use # be automatically converted into DH params. If the used TLS library supports
# ephemeral DH key exchange. In addition, ciphers with DSA keys always use # automatic DH parameter selection, that functionality will be used if this
# ephemeral DH keys. This can be used to achieve forward secrecy. If the file # parameter is not set. DH parameters are required if anonymous EAP-FAST is
# is in DSA parameters format, it will be automatically converted into DH # used.
# params. This parameter is required if anonymous EAP-FAST is used.
# You can generate DH parameters file with OpenSSL, e.g., # You can generate DH parameters file with OpenSSL, e.g.,
# "openssl dhparam -out /etc/hostapd.dh.pem 2048" # "openssl dhparam -out /etc/hostapd.dh.pem 2048"
#dh_file=/etc/hostapd.dh.pem #dh_file=/etc/hostapd.dh.pem

16
src/crypto/tls_openssl.c
View file

@ -4001,10 +4001,12 @@ static int tls_global_dh(struct tls_data *data, const char *dh_file)
EVP_PKEY *pkey = NULL, *tmpkey = NULL; EVP_PKEY *pkey = NULL, *tmpkey = NULL;
bool dsa = false; bool dsa = false;
if (!dh_file)
return 0;
if (!ssl_ctx) if (!ssl_ctx)
return -1; return -1;
if (!dh_file) {
SSL_CTX_set_dh_auto(ssl_ctx, 1);
return 0;
}
bio = BIO_new_file(dh_file, "r"); bio = BIO_new_file(dh_file, "r");
if (!bio) { if (!bio) {
@ -4066,10 +4068,14 @@ static int tls_global_dh(struct tls_data *data, const char *dh_file)
DH *dh; DH *dh;
BIO *bio; BIO *bio;
if (dh_file == NULL) if (!ssl_ctx)
return 0;
if (ssl_ctx == NULL)
return -1; return -1;
if (!dh_file) {
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
SSL_CTX_set_dh_auto(ssl_ctx, 1);
#endif
return 0;
}
bio = BIO_new_file(dh_file, "r"); bio = BIO_new_file(dh_file, "r");
if (bio == NULL) { if (bio == NULL) {