Restrict default TLS cipher list

In the past years, the internet has been moving forward wrt deprecating
older and less secure ciphers.  Let's follow this example in OpenVPN and
also restrict the default list of negotiable TLS ciphers in 2.3.x.

This disables the following:
 * Export ciphers (these are broken on purpose...)
 * Ciphers in the LOW and MEDIUM security cipher list of OpenSSL
   The LOW suite will be completely removed from OpenSSL in 1.1.0,
   the MEDIUM suite contains ciphers like RC4 and SEED.
 * Ciphers that are not supported by OpenVPN anyway (cleans up the list)

Note that users are able to override this default, using --tls-cipher, if
they for some reason need ciphers that are now disabled by default.

v2: add Changes.rst entry.

Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <1460917412-29741-1-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/11455
Signed-off-by: Gert Doering <gert@greenie.muc.de>

diff --git a/Changes.rst b/Changes.rst
index 813d92f5f254cfa5a5953946db783c9ed31b00b5..40fd9df6a09b8be34e112e64ddfbd8052e69b481 100644 (file)
--- a/Changes.rst
+++ b/Changes.rst
@@ -100,6 +100,21 @@ Behavioral changes
 - Do not randomize resolving of IP addresses in getaddr()
 
 
+
+Version 2.3.11
+==============
+
+Behavioral changes
+------------------
+
+- Stricter default TLS cipher list (override with ``--tls-cipher``), that now
+  also disables:
+
+  * Non-ephemeral key exchange using static (EC)DH keys
+  * DSS private keys
+
+
+
 Version 2.3.10
 =============
 

diff --git a/doc/openvpn.8 b/doc/openvpn.8
index 148a62a0763247d88dfae36f7ab502812417bc55..1cad9bed4278a9350b27bdd4b01c2a6cbb5fcd92 100644 (file)
--- a/doc/openvpn.8
+++ b/doc/openvpn.8
@@ -4555,8 +4555,9 @@ is an expert feature, which - if used correcly - can improve the security of
 your VPN connection.  But it is also easy to unwittingly use it to carefully
 align a gun with your foot, or just break your connection.  Use with care!
 
-The default for --tls-cipher is to use PolarSSL's default cipher list
-when using PolarSSL or "DEFAULT:!EXP:!PSK:!SRP:!kRSA" when using OpenSSL.
+The default for \-\-tls\-cipher is to use PolarSSL's default cipher list
+when using PolarSSL or "DEFAULT:!EXP:!LOW:!MEDIUM:!PSK:!SRP:!kRSA" when using
+OpenSSL.
 .\"*********************************************************
 .TP
 .B \-\-tls\-timeout n

diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c
index 06798904235ebd257c8c50221b53de6ed6564cdf..9e31c3c37a52efe37698244b197e9fb1c20c7d72 100644 (file)
--- a/src/openvpn/ssl.c
+++ b/src/openvpn/ssl.c
@@ -561,10 +561,7 @@ init_ssl (const struct options *options, struct tls_root_ctx *new_ctx)
   tls_ctx_check_cert_time(new_ctx);
 
   /* Allowable ciphers */
-  if (options->cipher_list)
-    {
-      tls_ctx_restrict_ciphers(new_ctx, options->cipher_list);
-    }
+  tls_ctx_restrict_ciphers(new_ctx, options->cipher_list);
 
 #ifdef ENABLE_CRYPTO_POLARSSL
   /* Personalise the random by mixing in the certificate */

diff --git a/src/openvpn/ssl_openssl.c b/src/openvpn/ssl_openssl.c
index e67f60ed3cb5ea8283246d3623530623d5539f1c..1dfbb23e20f915507e1f0e742257f71892e853ea 100644 (file)
--- a/src/openvpn/ssl_openssl.c
+++ b/src/openvpn/ssl_openssl.c
@@ -267,6 +267,20 @@ tls_ctx_set_options (struct tls_root_ctx *ctx, unsigned int ssl_flags)
 void
 tls_ctx_restrict_ciphers(struct tls_root_ctx *ctx, const char *ciphers)
 {
+  if (ciphers == NULL)
+    {
+      /* Use sane default TLS cipher list */
+      if(!SSL_CTX_set_cipher_list(ctx->ctx,
+         /* Use openssl's default list as a basis */
+         "DEFAULT"
+         /* Disable export ciphers and openssl's 'low' and 'medium' ciphers */
+         ":!EXP:!LOW:!MEDIUM"
+         /* Disable unsupported TLS modes */
+         ":!PSK:!SRP:!kRSA"))
+       crypto_msg (M_FATAL, "Failed to set default TLS cipher list.");
+      return;
+    }
+
   size_t begin_of_cipher, end_of_cipher;
 
   const char *current_cipher;
@@ -1383,8 +1397,7 @@ show_available_tls_ciphers (const char *cipher_list)
   if (!ssl)
     crypto_msg (M_FATAL, "Cannot create SSL object");
 
-  if (cipher_list)
-    tls_ctx_restrict_ciphers(&tls_ctx, cipher_list);
+  tls_ctx_restrict_ciphers(&tls_ctx, cipher_list);
 
   printf ("Available TLS Ciphers,\n");
   printf ("listed in order of preference:\n\n");