From: Alan T. DeKok <aland@freeradius.org>
Date: Sun, 24 Sep 2017 13:00:00 +0000 (-0400)
Subject: allow FAST to over-ride cipher_list
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2593a70ebb05256eec33a8eb32d37a4ea21e27af;p=thirdparty%2Ffreeradius-server.git

allow FAST to over-ride cipher_list
---

diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap
index 6c8f6b4bea8..726b727d3ed 100644
--- a/raddb/mods-available/eap
+++ b/raddb/mods-available/eap
@@ -1034,11 +1034,22 @@ eap {
 		# "DEFAULT" as "DEFAULT" contains "!aNULL" so instead it is
 		# recommended "ALL:!EXPORT:!eNULL:!SSLv2" is used
 		#
-#		tls = tls-common
+		tls = tls-common
+
+		#
+		#  If 'cipher_list' is set here, it will over-ride the
+		#  'cipher_list' configuration from the 'tls-common'
+		#  configuration.  The EAP-FAST module has it's own
+		#  over-ride for 'cipher_list' because the
+		#  specifications mandata a different set of ciphers
+		#  than are used by the other EAP methods.
+		#
+		cipher_list = "ALL:!EXPORT:!eNULL:!SSLv2"
+
 
 		# PAC lifetime in seconds (default: seven days)
 		#
-#		pac_lifetime = 604800
+		pac_lifetime = 604800
 
 		# Authority ID of the server
 		#
diff --git a/src/modules/rlm_eap/types/rlm_eap_fast/rlm_eap_fast.c b/src/modules/rlm_eap/types/rlm_eap_fast/rlm_eap_fast.c
index 09d28046b99..030f0d06b32 100644
--- a/src/modules/rlm_eap/types/rlm_eap_fast/rlm_eap_fast.c
+++ b/src/modules/rlm_eap/types/rlm_eap_fast/rlm_eap_fast.c
@@ -42,6 +42,7 @@ typedef struct rlm_eap_fast_t {
 	int			default_provisioning_method;
 
 	char const		*virtual_server;			//!< Virtual server to use for processing
+	char const		*cipher_list;				//!< cipher list specific to EAP-FAST
 									//!< inner EAP method.
 	bool			req_client_cert;			//!< Whether we require a client cert
 									//!< in the outer tunnel.
@@ -61,6 +62,7 @@ static CONF_PARSER submodule_config[] = {
 	{ FR_CONF_OFFSET("default_provisioning_eap_type", FR_TYPE_STRING, rlm_eap_fast_t, default_provisioning_method_name), .dflt = "mschapv2" },
 
 	{ FR_CONF_OFFSET("virtual_server", FR_TYPE_STRING | FR_TYPE_REQUIRED | FR_TYPE_NOT_EMPTY, rlm_eap_fast_t, virtual_server) },
+	{ FR_CONF_OFFSET("cipher_list", FR_TYPE_STRING, rlm_eap_fast_t, cipher_list) },
 
 	{ FR_CONF_OFFSET("require_client_cert", FR_TYPE_BOOL, rlm_eap_fast_t, req_client_cert), .dflt = "no" },
 
@@ -498,6 +500,15 @@ static rlm_rcode_t mod_session_init(void *type_arg, eap_session_t *eap_session)
 
 	tls_session = eap_tls_session->tls_session;
 
+	if (inst->cipher_list) {
+		RDEBUG("Over-riding main cipher list with '%s'", inst->cipher_list);
+
+		if (!SSL_set_cipher_list(tls_session->ssl, inst->cipher_list)) {
+			REDEBUG("Failed over-riding cipher list to '%s'.  EAP-FAST will likely not work",
+				inst->cipher_list);
+		}
+	}
+
 	/*
 	 *	Push TLV of authority_identity into tls_record
 	 *	call eap_tls_compose() with args