[openssl.org #1574] Session Ticket in OpenSSL 0.9.9 and EAP-FAST - Openssl

This is a discussion on [openssl.org #1574] Session Ticket in OpenSSL 0.9.9 and EAP-FAST - Openssl ; Update the OpenSSL patch for EAP-FAST support to work with the current OpenSSL snapshot. The ssl/s3_srvr.c change from 03-Sep-2008 (rev 1.163) seemed to have reverted some earlier changes and because of this, the extra call to ssl3_digest_cached_records() that was added ...

+ Reply to Thread
Results 1 to 5 of 5

Thread: [openssl.org #1574] Session Ticket in OpenSSL 0.9.9 and EAP-FAST

  1. [openssl.org #1574] Session Ticket in OpenSSL 0.9.9 and EAP-FAST

    Update the OpenSSL patch for EAP-FAST support to work with the current
    OpenSSL snapshot. The ssl/s3_srvr.c change from 03-Sep-2008 (rev 1.163)
    seemed to have reverted some earlier changes and because of this, the
    extra call to ssl3_digest_cached_records() that was added in the
    previous EAP-FAST patch update must be removed from the patch. This
    version was tested with openssl-SNAP-20080928.tar.gz.

    --
    Jouni Malinen PGP id EFC895FA


    This patch adds support for TLS SessionTicket extension (RFC 5077) for
    the parts used by EAP-FAST (RFC 4851).

    This is based on the patch from Alexey Kobozev
    (sent to openssl-dev mailing list on Tue, 07 Jun 2005 15:40:58 +0300).



    Index: openssl-SNAP-20080928/ssl/s3_clnt.c
    ================================================== =================
    --- openssl-SNAP-20080928.orig/ssl/s3_clnt.c
    +++ openssl-SNAP-20080928/ssl/s3_clnt.c
    @@ -788,6 +788,20 @@ int ssl3_get_server_hello(SSL *s)
    goto f_err;
    }

    +#ifndef OPENSSL_NO_TLSEXT
    + /* check if we want to resume the session based on external pre-shared secret */
    + if (s->version >= TLS1_VERSION && s->tls_session_secret_cb)
    + {
    + SSL_CIPHER *pref_cipher=NULL;
    + s->session->master_key_length=sizeof(s->session->master_key);
    + if (s->tls_session_secret_cb(s, s->session->master_key, &s->session->master_key_length,
    + NULL, &pref_cipher, s->tls_session_secret_cb_arg))
    + {
    + s->session->cipher=pref_cipher ? pref_cipher : ssl_get_cipher_by_char(s,p+j);
    + }
    + }
    +#endif /* OPENSSL_NO_TLSEXT */
    +
    if (j != 0 && j == s->session->session_id_length
    && memcmp(p,s->session->session_id,j) == 0)
    {
    @@ -2927,11 +2941,8 @@ static int ssl3_check_finished(SSL *s)
    {
    int ok;
    long n;
    - /* If we have no ticket or session ID is non-zero length (a match of
    - * a non-zero session length would never reach here) it cannot be a
    - * resumed session.
    - */
    - if (!s->session->tlsext_tick || s->session->session_id_length)
    + /* If we have no ticket it cannot be a resumed session. */
    + if (!s->session->tlsext_tick)
    return 1;
    /* this function is called when we really expect a Certificate
    * message, so permit appropriate message length */
    Index: openssl-SNAP-20080928/ssl/s3_srvr.c
    ================================================== =================
    --- openssl-SNAP-20080928.orig/ssl/s3_srvr.c
    +++ openssl-SNAP-20080928/ssl/s3_srvr.c
    @@ -1010,6 +1010,59 @@ int ssl3_get_client_hello(SSL *s)
    SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_CLIENTHEL LO_TLSEXT);
    goto err;
    }
    +
    + /* Check if we want to use external pre-shared secret for this
    + * handshake for not reused session only. We need to generate
    + * server_random before calling tls_session_secret_cb in order to allow
    + * SessionTicket processing to use it in key derivation. */
    + {
    + unsigned long Time;
    + unsigned char *pos;
    + Time=(unsigned long)time(NULL); /* Time */
    + pos=s->s3->server_random;
    + l2n(Time,pos);
    + if (RAND_pseudo_bytes(pos,SSL3_RANDOM_SIZE-4) <= 0)
    + {
    + al=SSL_AD_INTERNAL_ERROR;
    + goto f_err;
    + }
    + }
    +
    + if (!s->hit && s->version >= TLS1_VERSION && s->tls_session_secret_cb)
    + {
    + SSL_CIPHER *pref_cipher=NULL;
    +
    + s->session->master_key_length=sizeof(s->session->master_key);
    + if(s->tls_session_secret_cb(s, s->session->master_key, &s->session->master_key_length,
    + ciphers, &pref_cipher, s->tls_session_secret_cb_arg))
    + {
    + s->hit=1;
    + s->session->ciphers=ciphers;
    + s->session->verify_result=X509_V_OK;
    +
    + ciphers=NULL;
    +
    + /* check if some cipher was preferred by call back */
    + pref_cipher=pref_cipher ? pref_cipher : ssl3_choose_cipher(s, s->session->ciphers, SSL_get_ciphers(s));
    + if (pref_cipher == NULL)
    + {
    + al=SSL_AD_HANDSHAKE_FAILURE;
    + SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_NO_SHARED _CIPHER);
    + goto f_err;
    + }
    +
    + s->session->cipher=pref_cipher;
    +
    + if (s->cipher_list)
    + sk_SSL_CIPHER_free(s->cipher_list);
    +
    + if (s->cipher_list_by_id)
    + sk_SSL_CIPHER_free(s->cipher_list_by_id);
    +
    + s->cipher_list = sk_SSL_CIPHER_dup(s->session->ciphers);
    + s->cipher_list_by_id = sk_SSL_CIPHER_dup(s->session->ciphers);
    + }
    + }
    #endif

    /* Worst case, we will use the NULL compression, but if we have other
    @@ -1134,16 +1187,22 @@ int ssl3_send_server_hello(SSL *s)
    unsigned char *buf;
    unsigned char *p,*d;
    int i,sl;
    - unsigned long l,Time;
    + unsigned long l;
    +#ifdef OPENSSL_NO_TLSEXT
    + unsigned long Time;
    +#endif

    if (s->state == SSL3_ST_SW_SRVR_HELLO_A)
    {
    buf=(unsigned char *)s->init_buf->data;
    +#ifdef OPENSSL_NO_TLSEXT
    p=s->s3->server_random;
    + /* Generate server_random if it was not needed previously */
    Time=(unsigned long)time(NULL); /* Time */
    l2n(Time,p);
    if (RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-4) <= 0)
    return -1;
    +#endif
    /* Do the message type and length last */
    d=p= &(buf[4]);

    Index: openssl-SNAP-20080928/ssl/ssl_err.c
    ================================================== =================
    --- openssl-SNAP-20080928.orig/ssl/ssl_err.c
    +++ openssl-SNAP-20080928/ssl/ssl_err.c
    @@ -263,6 +263,7 @@ static ERR_STRING_DATA SSL_str_functs[]=
    {ERR_FUNC(SSL_F_TLS1_PRF), "tls1_prf"},
    {ERR_FUNC(SSL_F_TLS1_SETUP_KEY_BLOCK), "TLS1_SETUP_KEY_BLOCK"},
    {ERR_FUNC(SSL_F_WRITE_PENDING), "WRITE_PENDING"},
    +{ERR_FUNC(SSL_F_SSL_SET_HELLO_EXTENSION), "SSL_set_hello_extension"},
    {0,NULL}
    };

    Index: openssl-SNAP-20080928/ssl/ssl.h
    ================================================== =================
    --- openssl-SNAP-20080928.orig/ssl/ssl.h
    +++ openssl-SNAP-20080928/ssl/ssl.h
    @@ -355,6 +355,7 @@ extern "C" {
    * 'struct ssl_st *' function parameters used to prototype callbacks
    * in SSL_CTX. */
    typedef struct ssl_st *ssl_crock_st;
    +typedef struct tls_extension_st TLS_EXTENSION;

    /* used to hold info on the particular ciphers used */
    typedef struct ssl_cipher_st
    @@ -378,6 +379,8 @@ typedef struct ssl_cipher_st

    DECLARE_STACK_OF(SSL_CIPHER)

    +typedef int (*tls_session_secret_cb_fn)(SSL *s, void *secret, int *secret_len, STACK_OF(SSL_CIPHER) *peer_ciphers, SSL_CIPHER **cipher, void *arg);
    +
    /* Used to hold functions for SSLv2 or SSLv3/TLSv1 functions */
    typedef struct ssl_method_st
    {
    @@ -1145,6 +1148,13 @@ struct ssl_st
    void *tlsext_opaque_prf_input;
    size_t tlsext_opaque_prf_input_len;

    + /* TLS extensions */
    + TLS_EXTENSION *tls_extension;
    +
    + /* TLS pre-shared secret session resumption */
    + tls_session_secret_cb_fn tls_session_secret_cb;
    + void *tls_session_secret_cb_arg;
    +
    SSL_CTX * initial_ctx; /* initial ctx, used to store sessions */
    #define session_ctx initial_ctx
    #else
    @@ -1746,6 +1756,12 @@ void *SSL_COMP_get_compression_methods(v
    int SSL_COMP_add_compression_method(int id,void *cm);
    #endif

    +/* TLS extensions functions */
    +int SSL_set_hello_extension(SSL *s, int ext_type, void *ext_data, int ext_len);
    +
    +/* Pre-shared secret session resumption functions */
    +int SSL_set_session_secret_cb(SSL *s, tls_session_secret_cb_fn tls_session_secret_cb, void *arg);
    +
    /* BEGIN ERROR CODES */
    /* The following lines are auto generated by the script mkerr.pl. Any changes
    * made after this point may be overwritten when the script is next run.
    @@ -1948,6 +1964,7 @@ void ERR_load_SSL_strings(void);
    #define SSL_F_TLS1_PRF 284
    #define SSL_F_TLS1_SETUP_KEY_BLOCK 211
    #define SSL_F_WRITE_PENDING 212
    +#define SSL_F_SSL_SET_HELLO_EXTENSION 213

    /* Reason codes. */
    #define SSL_R_APP_DATA_IN_HANDSHAKE 100
    Index: openssl-SNAP-20080928/ssl/ssl_sess.c
    ================================================== =================
    --- openssl-SNAP-20080928.orig/ssl/ssl_sess.c
    +++ openssl-SNAP-20080928/ssl/ssl_sess.c
    @@ -834,6 +834,52 @@ long SSL_CTX_get_timeout(const SSL_CTX *
    return(s->session_timeout);
    }

    +#ifndef OPENSSL_NO_TLSEXT
    +int SSL_set_session_secret_cb(SSL *s, int (*tls_session_secret_cb)(SSL *s, void *secret, int *secret_len,
    + STACK_OF(SSL_CIPHER) *peer_ciphers, SSL_CIPHER **cipher, void *arg), void *arg)
    +{
    + if (s == NULL) return(0);
    + s->tls_session_secret_cb = tls_session_secret_cb;
    + s->tls_session_secret_cb_arg = arg;
    + return(1);
    +}
    +
    +int SSL_set_hello_extension(SSL *s, int ext_type, void *ext_data, int ext_len)
    +{
    + if(s->version >= TLS1_VERSION)
    + {
    + if(s->tls_extension)
    + {
    + OPENSSL_free(s->tls_extension);
    + s->tls_extension = NULL;
    + }
    +
    + s->tls_extension = OPENSSL_malloc(sizeof(TLS_EXTENSION) + ext_len);
    + if(!s->tls_extension)
    + {
    + SSLerr(SSL_F_SSL_SET_HELLO_EXTENSION, ERR_R_MALLOC_FAILURE);
    + return 0;
    + }
    +
    + s->tls_extension->type = ext_type;
    +
    + if(ext_data)
    + {
    + s->tls_extension->length = ext_len;
    + s->tls_extension->data = s->tls_extension + 1;
    + memcpy(s->tls_extension->data, ext_data, ext_len);
    + } else {
    + s->tls_extension->length = 0;
    + s->tls_extension->data = NULL;
    + }
    +
    + return 1;
    + }
    +
    + return 0;
    +}
    +#endif /* OPENSSL_NO_TLSEXT */
    +
    typedef struct timeout_param_st
    {
    SSL_CTX *ctx;
    Index: openssl-SNAP-20080928/ssl/t1_lib.c
    ================================================== =================
    --- openssl-SNAP-20080928.orig/ssl/t1_lib.c
    +++ openssl-SNAP-20080928/ssl/t1_lib.c
    @@ -154,6 +154,12 @@ int tls1_new(SSL *s)

    void tls1_free(SSL *s)
    {
    +#ifndef OPENSSL_NO_TLSEXT
    + if(s->tls_extension)
    + {
    + OPENSSL_free(s->tls_extension);
    + }
    +#endif
    ssl3_free(s);
    }

    @@ -357,8 +363,24 @@ unsigned char *ssl_add_clienthello_tlsex
    int ticklen;
    if (s->session && s->session->tlsext_tick)
    ticklen = s->session->tlsext_ticklen;
    + else if (s->session && s->tls_extension &&
    + s->tls_extension->type == TLSEXT_TYPE_session_ticket &&
    + s->tls_extension->data)
    + {
    + ticklen = s->tls_extension->length;
    + s->session->tlsext_tick = OPENSSL_malloc(ticklen);
    + if (!s->session->tlsext_tick)
    + return NULL;
    + memcpy(s->session->tlsext_tick, s->tls_extension->data,
    + ticklen);
    + s->session->tlsext_ticklen = ticklen;
    + }
    else
    ticklen = 0;
    + if (ticklen == 0 && s->tls_extension &&
    + s->tls_extension->type == TLSEXT_TYPE_session_ticket &&
    + s->tls_extension->data == NULL)
    + goto skip_ext;
    /* Check for enough room 2 for extension type, 2 for len
    * rest for ticket
    */
    @@ -371,6 +393,7 @@ unsigned char *ssl_add_clienthello_tlsex
    ret += ticklen;
    }
    }
    + skip_ext:

    #ifdef TLSEXT_TYPE_opaque_prf_input
    if (s->s3->client_opaque_prf_input != NULL)
    @@ -1435,6 +1458,15 @@ int tls1_process_ticket(SSL *s, unsigned
    s->tlsext_ticket_expected = 1;
    return 0; /* Cache miss */
    }
    + if (s->tls_session_secret_cb)
    + {
    + /* Indicate cache miss here and instead of
    + * generating the session from ticket now,
    + * trigger abbreviated handshake based on
    + * external mechanism to calculate the master
    + * secret later. */
    + return 0;
    + }
    return tls_decrypt_ticket(s, p, size, session_id, len,
    ret);
    }
    Index: openssl-SNAP-20080928/ssl/tls1.h
    ================================================== =================
    --- openssl-SNAP-20080928.orig/ssl/tls1.h
    +++ openssl-SNAP-20080928/ssl/tls1.h
    @@ -512,6 +512,14 @@ SSL_CTX_callback_ctrl(ssl,SSL_CTRL_SET_T
    #define TLS_MD_MASTER_SECRET_CONST "\x6d\x61\x73\x74\x65\x72\x20\x73\x65\x63\x72\x65\x 74" /*master secret*/
    #endif

    +/* TLS extension struct */
    +struct tls_extension_st
    +{
    + unsigned short type;
    + unsigned short length;
    + void *data;
    +};
    +
    #ifdef __cplusplus
    }
    #endif
    Index: openssl-SNAP-20080928/util/ssleay.num
    ================================================== =================
    --- openssl-SNAP-20080928.orig/util/ssleay.num
    +++ openssl-SNAP-20080928/util/ssleay.num
    @@ -254,3 +254,5 @@ PEM_read_bio_SSL_SESSION
    SSL_CTX_set_psk_server_callback 303 EXIST::FUNCTION:PSK
    SSL_get_psk_identity 304 EXIST::FUNCTION:PSK
    PEM_write_SSL_SESSION 305 EXIST:!WIN16:FUNCTION:
    +SSL_set_hello_extension 306 EXIST::FUNCTION:TLSEXT
    +SSL_set_session_secret_cb 307 EXIST::FUNCTION:TLSEXT


  2. [openssl.org #1574] Session Ticket in OpenSSL 0.9.9 and EAP-FAST

    > [j@w1.fi - Sun Sep 28 16:41:18 2008]:
    >
    > Update the OpenSSL patch for EAP-FAST support to work with the current
    > OpenSSL snapshot. The ssl/s3_srvr.c change from 03-Sep-2008 (rev 1.163)
    > seemed to have reverted some earlier changes and because of this, the
    > extra call to ssl3_digest_cached_records() that was added in the
    > previous EAP-FAST patch update must be removed from the patch. This
    > version was tested with openssl-SNAP-20080928.tar.gz.
    >
    >
    >


    I've had an initial look at this patch. Is there some reason you need to
    be able to generate generic extensions rather than just being able to
    override the session ticket extension?

    Steve.
    __________________________________________________ ____________________
    OpenSSL Project http://www.openssl.org
    Development Mailing List openssl-dev@openssl.org
    Automated List Manager majordomo@openssl.org


  3. Re: [openssl.org #1574] Session Ticket in OpenSSL 0.9.9 and EAP-FAST

    On Wed, Oct 22, 2008 at 01:19:53PM +0200, Stephen Henson via RT wrote:

    > I've had an initial look at this patch. Is there some reason you need to
    > be able to generate generic extensions rather than just being able to
    > override the session ticket extension?


    Not really. This just remains from the initial patch that was done
    before the session ticket support was added to OpenSSL. In practice,
    SSL_set_hello_extension() is only used to replace the SessionTicket
    extension (ext_type=35) and any mechanism that allows this to be done
    would be fine.

    --
    Jouni Malinen PGP id EFC895FA


    __________________________________________________ ____________________
    OpenSSL Project http://www.openssl.org
    Development Mailing List openssl-dev@openssl.org
    Automated List Manager majordomo@openssl.org


  4. Re: [openssl.org #1574] Session Ticket in OpenSSL 0.9.9 andEAP-FAST

    On Wed, Oct 22, 2008 at 01:19:53PM +0200, Stephen Henson via RT wrote:

    > I've had an initial look at this patch. Is there some reason you need to
    > be able to generate generic extensions rather than just being able to
    > override the session ticket extension?


    Not really. This just remains from the initial patch that was done
    before the session ticket support was added to OpenSSL. In practice,
    SSL_set_hello_extension() is only used to replace the SessionTicket
    extension (ext_type=35) and any mechanism that allows this to be done
    would be fine.

    --
    Jouni Malinen PGP id EFC895FA
    __________________________________________________ ____________________
    OpenSSL Project http://www.openssl.org
    Development Mailing List openssl-dev@openssl.org
    Automated List Manager majordomo@openssl.org


  5. [openssl.org #1574] Session Ticket in OpenSSL 0.9.9 and EAP-FAST

    > [j@w1.fi - Wed Oct 22 13:56:16 2008]:
    >
    > On Wed, Oct 22, 2008 at 01:19:53PM +0200, Stephen Henson via RT wrote:
    >
    > > I've had an initial look at this patch. Is there some reason you need to
    > > be able to generate generic extensions rather than just being able to
    > > override the session ticket extension?

    >
    > Not really. This just remains from the initial patch that was done
    > before the session ticket support was added to OpenSSL. In practice,
    > SSL_set_hello_extension() is only used to replace the SessionTicket
    > extension (ext_type=35) and any mechanism that allows this to be done
    > would be fine.
    >
    >


    OK, we'd need the generic extension part of the patch modified to only
    override the session ticket extension.

    A companion callback to supply the details of the ticket extension would
    be appropriate instead of using the debugging interface.

    The indentation in that patch is also inconsistent with the rest of OpenSSL.



    __________________________________________________ ____________________
    OpenSSL Project http://www.openssl.org
    Development Mailing List openssl-dev@openssl.org
    Automated List Manager majordomo@openssl.org


+ Reply to Thread