OpenSSL: Add build option to select default ciphers

Add a build option to select different default ciphers for OpenSSL
instead of the hardcoded default "DEFAULT:!EXP:!LOW".

This new option is useful on distributions where the security level
should be consistent for all applications, as in Fedora [1]. In such
cases the new configuration option would be set to "" or
"PROFILE=SYSTEM" to select the global crypto policy by default.

[1] https://fedoraproject.org/wiki/Changes/CryptoPolicy

Signed-off-by: Beniamino Galvani <bgalvani@redhat.com>

diff --git a/hostapd/Android.mk b/hostapd/Android.mk
index c8e986e08b2cc615a3923e2b9e2645f9d165fd42..721fcbbcf42d53730e72fa6f7573d8ba4331694c 100644 (file)
--- a/hostapd/Android.mk
+++ b/hostapd/Android.mk
@@ -630,6 +630,10 @@ NEED_SHA256=y
 NEED_TLS_PRF_SHA256=y
 LIBS += -lcrypto
 LIBS_h += -lcrypto
+ifndef CONFIG_TLS_DEFAULT_CIPHERS
+CONFIG_TLS_DEFAULT_CIPHERS = "DEFAULT:!EXP:!LOW"
+endif
+L_CFLAGS += -DTLS_DEFAULT_CIPHERS=\"$(CONFIG_TLS_DEFAULT_CIPHERS)\"
 endif
 
 ifeq ($(CONFIG_TLS), gnutls)

diff --git a/hostapd/Makefile b/hostapd/Makefile
index 91e1fda30caab3ccb8c4c0fb0e14adde3e31eeb3..fb926fba5b0c7c8b5f130f796914f549461720cf 100644 (file)
--- a/hostapd/Makefile
+++ b/hostapd/Makefile
@@ -668,6 +668,10 @@ ifdef CONFIG_TLS_ADD_DL
 LIBS += -ldl
 LIBS_h += -ldl
 endif
+ifndef CONFIG_TLS_DEFAULT_CIPHERS
+CONFIG_TLS_DEFAULT_CIPHERS = "DEFAULT:!EXP:!LOW"
+endif
+CFLAGS += -DTLS_DEFAULT_CIPHERS=\"$(CONFIG_TLS_DEFAULT_CIPHERS)\"
 endif
 
 ifeq ($(CONFIG_TLS), gnutls)

diff --git a/hostapd/defconfig b/hostapd/defconfig
index 521d877eb4006a11dbfeaaf3d5190b60723d29e0..26be9f8d4e9e5893d98c03976e5c980a0accb9d5 100644 (file)
--- a/hostapd/defconfig
+++ b/hostapd/defconfig
@@ -278,6 +278,10 @@ CONFIG_IPV6=y
 # can be enabled to enable use of stronger crypto algorithms.
 #CONFIG_TLSV12=y
 
+# Select which ciphers to use by default with OpenSSL if the user does not
+# specify them.
+#CONFIG_TLS_DEFAULT_CIPHERS="DEFAULT:!EXP:!LOW"
+
 # If CONFIG_TLS=internal is used, additional library and include paths are
 # needed for LibTomMath. Alternatively, an integrated, minimal version of
 # LibTomMath can be used. See beginning of libtommath.c for details on benefits

diff --git a/hostapd/hostapd.conf b/hostapd/hostapd.conf
index 51c47e698b38dea7779fa6a7ad9a91130f7ff7b4..7ad320648b33ab906ecc88865530dc963b911c32 100644 (file)
--- a/hostapd/hostapd.conf
+++ b/hostapd/hostapd.conf
@@ -931,7 +931,8 @@ eap_server=0
 # OpenSSL cipher string
 #
 # This is an OpenSSL specific configuration option for configuring the default
-# ciphers. If not set, "DEFAULT:!EXP:!LOW" is used as the default.
+# ciphers. If not set, the value configured at build time ("DEFAULT:!EXP:!LOW"
+# by default) is used.
 # See https://www.openssl.org/docs/apps/ciphers.html for OpenSSL documentation
 # on cipher suite configuration. This is applicable only if hostapd is built to
 # use OpenSSL.

diff --git a/src/crypto/tls_openssl.c b/src/crypto/tls_openssl.c
index 07c61193a19a4eb86cb69d3c1567bd379b627f8c..fd94eaf4642238cef2e381661e596b7472bd9e4f 100644 (file)
--- a/src/crypto/tls_openssl.c
+++ b/src/crypto/tls_openssl.c
@@ -1025,7 +1025,7 @@ void * tls_init(const struct tls_config *conf)
        if (conf && conf->openssl_ciphers)
                ciphers = conf->openssl_ciphers;
        else
-               ciphers = "DEFAULT:!EXP:!LOW";
+               ciphers = TLS_DEFAULT_CIPHERS;
        if (SSL_CTX_set_cipher_list(ssl, ciphers) != 1) {
                wpa_printf(MSG_ERROR,
                           "OpenSSL: Failed to set cipher string '%s'",

diff --git a/wpa_supplicant/Android.mk b/wpa_supplicant/Android.mk
index a52bb66d1181fcb599580ee7a60b17d8e9eb36c8..e77d096230c97aa0ab267edf4fb8f3acb2e93570 100644 (file)
--- a/wpa_supplicant/Android.mk
+++ b/wpa_supplicant/Android.mk
@@ -1032,6 +1032,10 @@ ifdef CONFIG_TLS_ADD_DL
 LIBS += -ldl
 LIBS_p += -ldl
 endif
+ifndef CONFIG_TLS_DEFAULT_CIPHERS
+CONFIG_TLS_DEFAULT_CIPHERS = "DEFAULT:!EXP:!LOW"
+endif
+L_CFLAGS += -DTLS_DEFAULT_CIPHERS=\"$(CONFIG_TLS_DEFAULT_CIPHERS)\"
 endif
 
 ifeq ($(CONFIG_TLS), gnutls)

diff --git a/wpa_supplicant/Makefile b/wpa_supplicant/Makefile
index 6787a8d51365360520db744206be22c4de828151..948385b4c9f6994679c21117247a48348d85a1d0 100644 (file)
--- a/wpa_supplicant/Makefile
+++ b/wpa_supplicant/Makefile
@@ -1075,6 +1075,10 @@ ifdef CONFIG_TLS_ADD_DL
 LIBS += -ldl
 LIBS_p += -ldl
 endif
+ifndef CONFIG_TLS_DEFAULT_CIPHERS
+CONFIG_TLS_DEFAULT_CIPHERS = "DEFAULT:!EXP:!LOW"
+endif
+CFLAGS += -DTLS_DEFAULT_CIPHERS=\"$(CONFIG_TLS_DEFAULT_CIPHERS)\"
 endif
 
 ifeq ($(CONFIG_TLS), gnutls)

diff --git a/wpa_supplicant/android.config b/wpa_supplicant/android.config
index 08134ada3f5aede5ec72d0f1a282f7343fe5a921..06a0b85cfc4a8e2a7d190af7f463fa2bcbb4b646 100644 (file)
--- a/wpa_supplicant/android.config
+++ b/wpa_supplicant/android.config
@@ -304,6 +304,10 @@ CONFIG_IEEE80211W=y
 # will be used)
 #CONFIG_TLSV12=y
 
+# Select which ciphers to use by default with OpenSSL if the user does not
+# specify them.
+#CONFIG_TLS_DEFAULT_CIPHERS="DEFAULT:!EXP:!LOW"
+
 # If CONFIG_TLS=internal is used, additional library and include paths are
 # needed for LibTomMath. Alternatively, an integrated, minimal version of
 # LibTomMath can be used. See beginning of libtommath.c for details on benefits

diff --git a/wpa_supplicant/defconfig b/wpa_supplicant/defconfig
index 307f82d8546aeb7c591107b1f1541edb13258eea..1797ad359954d167c63d442b6bf0755ff1b9541f 100644 (file)
--- a/wpa_supplicant/defconfig
+++ b/wpa_supplicant/defconfig
@@ -317,6 +317,10 @@ CONFIG_PEERKEY=y
 # will be used)
 #CONFIG_TLSV12=y
 
+# Select which ciphers to use by default with OpenSSL if the user does not
+# specify them.
+#CONFIG_TLS_DEFAULT_CIPHERS="DEFAULT:!EXP:!LOW"
+
 # If CONFIG_TLS=internal is used, additional library and include paths are
 # needed for LibTomMath. Alternatively, an integrated, minimal version of
 # LibTomMath can be used. See beginning of libtommath.c for details on benefits

diff --git a/wpa_supplicant/wpa_supplicant.conf b/wpa_supplicant/wpa_supplicant.conf
index f69c74eed5013d3dcf5698202d490f708b9544f2..68d0827c5e8a481c1a1cdbabccc004b6fa95e6ca 100644 (file)
--- a/wpa_supplicant/wpa_supplicant.conf
+++ b/wpa_supplicant/wpa_supplicant.conf
@@ -183,13 +183,13 @@ fast_reauth=1
 # OpenSSL cipher string
 #
 # This is an OpenSSL specific configuration option for configuring the default
-# ciphers. If not set, "DEFAULT:!EXP:!LOW" is used as the default.
+# ciphers. If not set, the value configured at build time ("DEFAULT:!EXP:!LOW"
+# by default) is used.
 # See https://www.openssl.org/docs/apps/ciphers.html for OpenSSL documentation
 # on cipher suite configuration. This is applicable only if wpa_supplicant is
 # built to use OpenSSL.
 #openssl_ciphers=DEFAULT:!EXP:!LOW
 
-
 # Dynamic EAP methods
 # If EAP methods were built dynamically as shared object files, they need to be
 # loaded here before being used in the network blocks. By default, EAP methods