jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

OpenSSL: Allow systemwide secpolicy overrides for TLS version

Browse source 
Explicit configuration to enable TLS v1.0 and/or v1.1 did not work with
systemwide OpenSSL secpolicy=2 cases (e.g., Ubuntu 20.04). Allow such
systemwide configuration to be overridden if the older TLS versions have
been explicitly enabled in the network profile. The default behavior
follows the systemwide policy, but this allows compatibility with old
authentication servers without having to touch the systemwide policy.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
This commit is contained in:
Jouni Malinen 2020-09-08 17:55:36 +03:00 committed by Jouni Malinen
parent c85206ba40
commit 9afb68b039
1 changed files with 17 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
src/crypto/tls_openssl.c
View file

@ -2995,16 +2995,12 @@ static int tls_set_conn_flags(struct tls_connection *conn, unsigned int flags,
/* Explicit request to enable TLS versions even if needing to /* Explicit request to enable TLS versions even if needing to
* override systemwide policies. */ * override systemwide policies. */
if (flags & TLS_CONN_ENABLE_TLSv1_0) { if (flags & TLS_CONN_ENABLE_TLSv1_0)
version = TLS1_VERSION; version = TLS1_VERSION;
} else if (flags & TLS_CONN_ENABLE_TLSv1_1) { else if (flags & TLS_CONN_ENABLE_TLSv1_1)
if (!(flags & TLS_CONN_DISABLE_TLSv1_0))
version = TLS1_1_VERSION; version = TLS1_1_VERSION;
} else if (flags & TLS_CONN_ENABLE_TLSv1_2) { else if (flags & TLS_CONN_ENABLE_TLSv1_2)
if (!(flags & (TLS_CONN_DISABLE_TLSv1_0 |
TLS_CONN_DISABLE_TLSv1_1)))
version = TLS1_2_VERSION; version = TLS1_2_VERSION;
}
if (!version) { if (!version) {
wpa_printf(MSG_DEBUG, wpa_printf(MSG_DEBUG,
"OpenSSL: Invalid TLS version configuration"); "OpenSSL: Invalid TLS version configuration");
@ -3018,6 +3014,18 @@ static int tls_set_conn_flags(struct tls_connection *conn, unsigned int flags,
} }
} }
#endif /* >= 1.1.0 */ #endif /* >= 1.1.0 */
#if OPENSSL_VERSION_NUMBER >= 0x10100000L && \
!defined(LIBRESSL_VERSION_NUMBER) && \
!defined(OPENSSL_IS_BORINGSSL)
if ((flags & (TLS_CONN_ENABLE_TLSv1_0 | TLS_CONN_ENABLE_TLSv1_1)) &&
SSL_get_security_level(ssl) >= 2) {
/*
* Need to drop to security level 1 to allow TLS versions older
* than 1.2 to be used when explicitly enabled in configuration.
*/
SSL_set_security_level(conn->ssl, 1);
}
#endif
#ifdef CONFIG_SUITEB #ifdef CONFIG_SUITEB
#ifdef OPENSSL_IS_BORINGSSL #ifdef OPENSSL_IS_BORINGSSL