[From nobody Thu Jun 25 05:54:45 2020 Received: from sonic307-3.consmr.mail.bf2.yahoo.com ([74.6.134.42]) by bombadil.infradead.org with esmtps (Exim 4.90_1 #2 (Red Hat Linux)) id 1fj89E-00081p-Ry for openwrt-devel@lists.openwrt.org; Fri, 27 Jul 2018 19:11:34 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1532718681; bh=KG6HmGQMDPeV68huHqXIl/nCJG6kjYCKoKi+117G3LA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=FBjszam/Y+mS7d8G1oSG3ccvIA6/pBuTintIpqu8M4b0Ctv6bLRSdqIRjAHKCXHLSxzlN9/hzXdT6AN2JevrPwwa3VktJjLP+49rR5nGCh7U0VVZjxtZXXuQaBXZf+sDzLr+FvDlyGQL4wdGpvgg50MYsWrzAcygXqUOXO/lD5Qjlnl46H5xSYE8WN/OpnZ1faIyevnUH2lKYUs8YMWsuajPsQE9rpt0egm7v61qR1Jf3qYldk78EVDXJ44Ed6dOJ/AWrZOdT5Brrt6QHmxQ9QsCBaCqWG1w9in5DEEEOEW1i0Q5247KwuAJb8hkauYQW59Ky6JVM/kjiQWcpeRR9g== X-YMail-OSG: TB3yPhAVM1lwXGFiQIZMfHz6v_TDs0Paq9lMcZdfu.UfwdT12ognGhBekKDOuZr PczbypMYulWEiVC7jm.jcjC6vaPkr4y0ycp9f7rDNN3f6tSn4c3EaWUrq6Ua7YX3m.X6oVwyTwHc 0DAi9lX_oDAYs.VxZP_tRvG5BO2DxVp1a9wsi76IrqC0bBFodZAmqcTG7DvMTP8oYU3VK0F44r.w Lz217_tG3eYec3cAXPEv.INz8mxl1fQHXdztJRenVceLdsHc8yesEpu9zpORWZ2dWZeARfm1Jbzr TFHfRpnfFqYq43LwNVb_0Wjh._wiGNr0VyPJSCKk7IeDSDNZpkoZ.yT.GoH3Q57ECHdzDwh4TGJJ kFIt6NVOhFlPUD.PhAemudXRWzbEEH4rpLpBZRC.zRetHOX8n5j7yaPS9h2pqP6bqXkUI81nJVtP YAfxDND5iuC51Nedxb1_HpjsKcaVV_7pHiV_6XDLDa9_80PpBbmLuD8sDJXpu56iWFfjtWy2M1xF jM2Ql82AAt8XpL4NJQq60y16yEVa2ByUC3YYEbvai.Xqc9s4dTjyX8qVMzsfQBSp19Eyg4VD261G DpZMFvE4czgm1ulouWjmZqRsPmkv1p0oMraOQGG4rfBB7ndBk3f.hfnYLrw59mpKo.3zl8EQaJKa 7L12.HDIVAzghIooNwCMkD0EVqamPFaNont_onapa_h1NmLfJBmLRfvwY_M6swqZZPJOEf3vz1fQ u4sUhZwd5FuoP.59hGvMZyfzPWHYPs3KEwdVGOSMJrmgF6HdoP2epY5N7.wsZ5no2u0sn4l1NWOV _5esNKy9ScjE9q3o2ftzZHiZKX6ABwxsrIphm7_e.0PmFgULBaLCLkplAc5KtOuYVL6YitWBDaNj 6s2bxSlMpZuV1GB7iTv5sAW5ApLyTeTbQJF6H.KAEbHqmtmXM66Wnl6LUw4d2cgX6oG17T1_fE8M fdGjdOFqLu42XhsswsxVPZ0Oi32mhbb9LHS01tx1uiRTMf25dXnliYvS2ntCfcnCdahFc9AxAU.o A49pSbi40fxsq Received: from sonic.gate.mail.ne1.yahoo.com by sonic307.consmr.mail.bf2.yahoo.com with HTTP; Fri, 27 Jul 2018 19:11:21 +0000 Received: from 18.175.75.177.infopasa.com.br (EHLO gateway.troianet.com.br) ([177.75.175.18]) by smtp423.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 544a94327268fd5815776de5221668b9; Fri, 27 Jul 2018 19:11:19 +0000 (UTC) From: Eneas U de Queiroz <cote2004-github@yahoo.com> To: openwrt-devel@lists.openwrt.org Cc: Eneas U de Queiroz <cote2004-github@yahoo.com> Subject: [PATCH 1/1] openssl, wolfssl: match mbedTLS ciphersuite list Date: Fri, 27 Jul 2018 16:10:20 -0300 Message-Id: <20180727191020.18634-2-cote2004-github@yahoo.com> X-Mailer: git-send-email 2.16.4 In-Reply-To: <20180727191020.18634-1-cote2004-github@yahoo.com> References: <20180727191020.18634-1-cote2004-github@yahoo.com> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20180727_121132_987967_8575CD2B X-CRM114-Status: UNSURE ( 6.36 ) X-CRM114-Notice: Please train this message. X-Spam-Score: -0.1 (/) X-Spam-Report: SpamAssassin version 3.4.1 on bombadil.infradead.org summary: Content analysis details: (-0.1 points) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [74.6.134.42 listed in list.dnswl.org] 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (cote2004-github[at]yahoo.com) -0.0 SPF_PASS SPF: sender matches SPF record 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature Use the same ciphersuite list as mbedTLS. wolfssl was not honoring setting the minimum protocol with SSL_CTX_set_options, so we must use TLSv1_2_server_method. Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com> --- ustream-openssl.c | 60 +++++++++++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 54 insertions(+), 6 deletions(-) diff --git a/ustream-openssl.c b/ustream-openssl.c index c6839ea..7c72ce1 100644 --- a/ustream-openssl.c +++ b/ustream-openssl.c @@ -22,6 +22,53 @@ #include "ustream-ssl.h" #include "ustream-internal.h" + +/* Ciphersuite preference: + * - key exchange: prefer ECDHE, then DHE(client only), then RSA + * - prefer AEAD ciphers: + * chacha20-poly1305, the fastest in software, 256-bits + * aes128-gcm, 128-bits + * aes256-gcm, 256-bits + * - CBC ciphers + * aes128, aes256, 3DES(client only) + */ + +#define ecdhe_ciphers \ + "ECDHE-ECDSA-CHACHA20-POLY1305:" \ + "ECDHE-ECDSA-AES128-GCM-SHA256:" \ + "ECDHE-ECDSA-AES256-GCM-SHA384:" \ + "ECDHE-ECDSA-AES128-SHA:" \ + "ECDHE-ECDSA-AES256-SHA:" \ + "ECDHE-RSA-CHACHA20-POLY1305:" \ + "ECDHE-RSA-AES128-GCM-SHA256:" \ + "ECDHE-RSA-AES256-GCM-SHA384:" \ + "ECDHE-RSA-AES128-SHA:" \ + "ECDHE-RSA-AES256-SHA" + +#define dhe_ciphers \ + "DHE-RSA-CHACHA20-POLY1305:" \ + "DHE-RSA-AES128-GCM-SHA256:" \ + "DHE-RSA-AES256-GCM-SHA384:" \ + "DHE-RSA-AES128-SHA:" \ + "DHE-RSA-AES256-SHA:" \ + "DHE-DES-CBC3-SHA" + +#define non_pfs_aes \ + "AES128-GCM-SHA256:" \ + "AES256-GCM-SHA384:" \ + "AES128-SHA:" \ + "AES256-SHA" + +#define server_cipher_list \ + ecdhe_ciphers ":" \ + non_pfs_aes + +#define client_cipher_list \ + ecdhe_ciphers ":" \ + dhe_ciphers ":" \ + non_pfs_aes ":" \ + "DES-CBC3-SHA" + __hidden struct ustream_ssl_ctx * __ustream_ssl_context_new(bool server) { @@ -36,7 +83,7 @@ __ustream_ssl_context_new(bool server) SSL_library_init(); _init = true; } -# define TLS_server_method SSLv23_server_method +# define TLS_server_method TLSv1_2_server_method # define TLS_client_method SSLv23_client_method #endif @@ -50,17 +97,18 @@ __ustream_ssl_context_new(bool server) return NULL; SSL_CTX_set_verify(c, SSL_VERIFY_NONE, NULL); - SSL_CTX_set_options (c, SSL_OP_NO_COMPRESSION); /* avoid CRIME attack */ -#if !defined(OPENSSL_NO_ECDH) && !defined(CYASSL_OPENSSL_H_) && OPENSSL_VERSION_NUMBER < 0x10100000L + SSL_CTX_set_options(c, SSL_OP_NO_COMPRESSION | SSL_OP_SINGLE_ECDH_USE | + SSL_OP_CIPHER_SERVER_PREFERENCE); +#if defined(SSL_CTX_set_ecdh_auto) && OPENSSL_VERSION_NUMBER < 0x10100000L SSL_CTX_set_ecdh_auto(c, 1); #endif if (server) { #if OPENSSL_VERSION_NUMBER >= 0x10100000L SSL_CTX_set_min_proto_version(c, TLS1_2_VERSION); -#else - SSL_CTX_set_options (c, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1); #endif - SSL_CTX_set_cipher_list(c, "DEFAULT:!RC4:@STRENGTH"); + SSL_CTX_set_cipher_list(c, server_cipher_list); + } else { + SSL_CTX_set_cipher_list(c, client_cipher_list); } SSL_CTX_set_quiet_shutdown(c, 1); -- 2.16.4 ]