allow FAST to over-ride cipher_list

diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap
index 6c8f6b4bea8636218780f2a74a82002a78e42480..726b727d3ed8b1b85d79345677b8fa7d60a25b55 100644 (file)
--- a/raddb/mods-available/eap
+++ b/raddb/mods-available/eap
@@ -1034,11 +1034,22 @@ eap {
                # "DEFAULT" as "DEFAULT" contains "!aNULL" so instead it is
                # recommended "ALL:!EXPORT:!eNULL:!SSLv2" is used
                #
-#              tls = tls-common
+               tls = tls-common
+
+               #
+               #  If 'cipher_list' is set here, it will over-ride the
+               #  'cipher_list' configuration from the 'tls-common'
+               #  configuration.  The EAP-FAST module has it's own
+               #  over-ride for 'cipher_list' because the
+               #  specifications mandata a different set of ciphers
+               #  than are used by the other EAP methods.
+               #
+               cipher_list = "ALL:!EXPORT:!eNULL:!SSLv2"
+
 
                # PAC lifetime in seconds (default: seven days)
                #
-#              pac_lifetime = 604800
+               pac_lifetime = 604800
 
                # Authority ID of the server
                #

diff --git a/src/modules/rlm_eap/types/rlm_eap_fast/rlm_eap_fast.c b/src/modules/rlm_eap/types/rlm_eap_fast/rlm_eap_fast.c
index 09d28046b993a00e34fce6867e6b99ca5aeac5c5..030f0d06b324209f1237065758236fb4146c2882 100644 (file)
--- a/src/modules/rlm_eap/types/rlm_eap_fast/rlm_eap_fast.c
+++ b/src/modules/rlm_eap/types/rlm_eap_fast/rlm_eap_fast.c
@@ -42,6 +42,7 @@ typedef struct rlm_eap_fast_t {
        int                     default_provisioning_method;
 
        char const              *virtual_server;                        //!< Virtual server to use for processing
+       char const              *cipher_list;                           //!< cipher list specific to EAP-FAST
                                                                        //!< inner EAP method.
        bool                    req_client_cert;                        //!< Whether we require a client cert
                                                                        //!< in the outer tunnel.
@@ -61,6 +62,7 @@ static CONF_PARSER submodule_config[] = {
        { FR_CONF_OFFSET("default_provisioning_eap_type", FR_TYPE_STRING, rlm_eap_fast_t, default_provisioning_method_name), .dflt = "mschapv2" },
 
        { FR_CONF_OFFSET("virtual_server", FR_TYPE_STRING | FR_TYPE_REQUIRED | FR_TYPE_NOT_EMPTY, rlm_eap_fast_t, virtual_server) },
+       { FR_CONF_OFFSET("cipher_list", FR_TYPE_STRING, rlm_eap_fast_t, cipher_list) },
 
        { FR_CONF_OFFSET("require_client_cert", FR_TYPE_BOOL, rlm_eap_fast_t, req_client_cert), .dflt = "no" },
 
@@ -498,6 +500,15 @@ static rlm_rcode_t mod_session_init(void *type_arg, eap_session_t *eap_session)
 
        tls_session = eap_tls_session->tls_session;
 
+       if (inst->cipher_list) {
+               RDEBUG("Over-riding main cipher list with '%s'", inst->cipher_list);
+
+               if (!SSL_set_cipher_list(tls_session->ssl, inst->cipher_list)) {
+                       REDEBUG("Failed over-riding cipher list to '%s'.  EAP-FAST will likely not work",
+                               inst->cipher_list);
+               }
+       }
+
        /*
         *      Push TLV of authority_identity into tls_record
         *      call eap_tls_compose() with args