aboutsummaryrefslogtreecommitdiffstats
path: root/src
diff options
context:
space:
mode:
authorBeniamino Galvani <bgalvani@redhat.com>2017-07-09 09:06:50 (GMT)
committerJouni Malinen <j@w1.fi>2017-07-17 08:55:22 (GMT)
commit2b9891bd6e125d3e28f26afde32e153db658b7cc (patch)
tree11b63f7e7d7b3ec19828a56c753e94c538231728 /src
parent65833d71a5f3b8240db397efa7200e894a3eab1f (diff)
downloadhostap-2b9891bd6e125d3e28f26afde32e153db658b7cc.zip
hostap-2b9891bd6e125d3e28f26afde32e153db658b7cc.tar.gz
hostap-2b9891bd6e125d3e28f26afde32e153db658b7cc.tar.bz2
OpenSSL: Add build option to select default ciphers
Add a build option to select different default ciphers for OpenSSL instead of the hardcoded default "DEFAULT:!EXP:!LOW". This new option is useful on distributions where the security level should be consistent for all applications, as in Fedora [1]. In such cases the new configuration option would be set to "" or "PROFILE=SYSTEM" to select the global crypto policy by default. [1] https://fedoraproject.org/wiki/Changes/CryptoPolicy Signed-off-by: Beniamino Galvani <bgalvani@redhat.com>
Diffstat (limited to 'src')
-rw-r--r--src/crypto/tls_openssl.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/src/crypto/tls_openssl.c b/src/crypto/tls_openssl.c
index 07c6119..fd94eaf 100644
--- a/src/crypto/tls_openssl.c
+++ b/src/crypto/tls_openssl.c
@@ -1025,7 +1025,7 @@ void * tls_init(const struct tls_config *conf)
if (conf && conf->openssl_ciphers)
ciphers = conf->openssl_ciphers;
else
- ciphers = "DEFAULT:!EXP:!LOW";
+ ciphers = TLS_DEFAULT_CIPHERS;
if (SSL_CTX_set_cipher_list(ssl, ciphers) != 1) {
wpa_printf(MSG_ERROR,
"OpenSSL: Failed to set cipher string '%s'",