1Patch-Source: https://w1.fi/cgit/hostap/commit/?id=566ce69a8d0e64093309cbde80235aa522fbf84e2From 566ce69a8d0e64093309cbde80235aa522fbf84e Mon Sep 17 00:00:00 20013From: Jouni Malinen <quic_jouni@quicinc.com>4Date: Thu, 5 May 2022 00:07:44 +03005Subject: EAP peer: Workaround for servers that do not support safe TLS6 renegotiation78The TLS protocol design for renegotiation was identified to have a9significant security flaw in 2009 and an extension to secure this design10was published in 2010 (RFC 5746). However, some old RADIUS11authentication servers without support for this are still used commonly.1213This is obviously not good from the security view point, but since there14are cases where the user of a network service has no realistic means for15getting the authentication server upgraded, TLS handshake may still need16to be allowed to be able to use the network.1718OpenSSL 3.0 disabled the client side workaround by default and this19resulted in issues connection to some networks with insecure20authentication servers. With OpenSSL 3.0, the client is now enforcing21security by refusing to authenticate with such servers. The pre-3.022behavior of ignoring this issue and leaving security to the server can23now be enabled with a new phase1 parameter allow_unsafe_renegotiation=1.24This should be used only when having to connect to a network that has an25insecure authentication server that cannot be upgraded.2627The old (pre-2010) TLS renegotiation mechanism might open security28vulnerabilities if the authentication server were to allow TLS29renegotiation to be initiated. While this is unlikely to cause real30issues with EAP-TLS, there might be cases where use of PEAP or TTLS with31an authentication server that does not support RFC 5746 might result in32a security vulnerability.3334Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>35---36 src/crypto/tls.h | 1 +37 src/crypto/tls_openssl.c | 5 +++++38 src/eap_peer/eap_tls_common.c | 4 ++++39 wpa_supplicant/wpa_supplicant.conf | 5 +++++40 4 files changed, 15 insertions(+)4142diff --git a/src/crypto/tls.h b/src/crypto/tls.h43index ccaac94c9..7ea32ee4a 10064444--- a/src/crypto/tls.h45+++ b/src/crypto/tls.h46@@ -112,6 +112,7 @@ struct tls_config {47 #define TLS_CONN_ENABLE_TLSv1_1 BIT(15)48 #define TLS_CONN_ENABLE_TLSv1_2 BIT(16)49 #define TLS_CONN_TEAP_ANON_DH BIT(17)50+#define TLS_CONN_ALLOW_UNSAFE_RENEGOTIATION BIT(18)5152 /**53 * struct tls_connection_params - Parameters for TLS connection54diff --git a/src/crypto/tls_openssl.c b/src/crypto/tls_openssl.c55index 388c6b0f4..0d23f44ad 10064456--- a/src/crypto/tls_openssl.c57+++ b/src/crypto/tls_openssl.c58@@ -3081,6 +3081,11 @@ static int tls_set_conn_flags(struct tls_connection *conn, unsigned int flags,59 SSL_clear_options(ssl, SSL_OP_NO_TICKET);60 #endif /* SSL_OP_NO_TICKET */6162+#ifdef SSL_OP_LEGACY_SERVER_CONNECT63+ if (flags & TLS_CONN_ALLOW_UNSAFE_RENEGOTIATION)64+ SSL_set_options(ssl, SSL_OP_LEGACY_SERVER_CONNECT);65+#endif /* SSL_OP_LEGACY_SERVER_CONNECT */66+67 #ifdef SSL_OP_NO_TLSv168 if (flags & TLS_CONN_DISABLE_TLSv1_0)69 SSL_set_options(ssl, SSL_OP_NO_TLSv1);70diff --git a/src/eap_peer/eap_tls_common.c b/src/eap_peer/eap_tls_common.c71index 06c9b211e..6193b4bdb 10064472--- a/src/eap_peer/eap_tls_common.c73+++ b/src/eap_peer/eap_tls_common.c74@@ -102,6 +102,10 @@ static void eap_tls_params_flags(struct tls_connection_params *params,75 params->flags |= TLS_CONN_SUITEB_NO_ECDH;76 if (os_strstr(txt, "tls_suiteb_no_ecdh=0"))77 params->flags &= ~TLS_CONN_SUITEB_NO_ECDH;78+ if (os_strstr(txt, "allow_unsafe_renegotiation=1"))79+ params->flags |= TLS_CONN_ALLOW_UNSAFE_RENEGOTIATION;80+ if (os_strstr(txt, "allow_unsafe_renegotiation=0"))81+ params->flags &= ~TLS_CONN_ALLOW_UNSAFE_RENEGOTIATION;82 }838485diff --git a/wpa_supplicant/wpa_supplicant.conf b/wpa_supplicant/wpa_supplicant.conf86index a1dc769c9..b5304a77e 10064487--- a/wpa_supplicant/wpa_supplicant.conf88+++ b/wpa_supplicant/wpa_supplicant.conf89@@ -1370,6 +1370,11 @@ fast_reauth=190 # tls_suiteb=0 - do not apply Suite B 192-bit constraints on TLS (default)91 # tls_suiteb=1 - apply Suite B 192-bit constraints on TLS; this is used in92 # particular when using Suite B with RSA keys of >= 3K (3072) bits93+# allow_unsafe_renegotiation=1 - allow connection with a TLS server that does94+# not support safe renegotiation (RFC 5746); please note that this95+# workaround should be only when having to authenticate with an old96+# authentication server that cannot be updated to use secure TLS97+# implementation.98 #99 # Following certificate/private key fields are used in inner Phase2100 # authentication when using EAP-TTLS or EAP-PEAP.101--102cgit v1.2.3-18-g5258103