I was pleased to note that support for SessionTicket (RFC 4507) was
added into the OpenSSL 0.9.9 tree couple of weeks ago. This
implementation seems to include session ticket use as specified in RFC
4507 which alone is not enough for supporting EAP-FAST (RFC 4851) since
EAP-FAST takes care of SessionTicket generation and processing in the
EAP method (i.e., NewSessionTicket handshake message is not used and
decoding of the session ticket is done outside the TLS implementation).
Based on the changes in OpenSSL, I tried to update the patch I maintain
to allow EAP-FAST to be implemented with OpenSSL. This allowed parts of
the changes to be removed since the code in the main OpenSSL repository
can now be used instead.
I was now able to remove the new callback that was used to notify about
the reception of TLS hello extension. This was replaced with the new
SSL_set_tlsext_debug_{callback,arg}) and it is used to allow the
EAP-FAST server implementation to receive and process the SessionTicket
extension from ClientHello.
Similarly, I was able to do small changes to allow the addition of
SessionTicket extension to ClientHello to share the code used in
OpenSSL at the peer side of EAP-FAST. Though, this is still using a new
function (SSL_set_hello_extension) since the current OpenSSL code did
not seem to have a mechanism for overriding the session ticket.
Lastly, the callback for updating session secret
(SSL_set_session_secret_cb) is still needed to allow the EAP-FAST
implementation to set the session secret during the TLS handshake since
this is also done differently from RFC 4507. This callback is also
requiring bit more changes in server side processing to allow the server
random to be made available early enough.
I've attached my current patch to allow EAP-FAST to be implemented with
OpenSSL (0.9.9 snapshots). The EAP-FAST server and peer implementations
are available as part of the hostapd/wpa_supplicant Git tree from
http://w1.fi/ if anyone is interested in more details how the added
functions in OpenSSL are used.
I'm sure the changes could be cleaned up a bit, but at least the patch
should show what kind of additional functionality is needed. I would
welcome any comments on the patch and on how it (or similar
functionality) could be integrated into OpenSSL. Is someone else looking
into changing the current OpenSSL SessionTicket implementation to be
used with EAP-FAST?
--
Jouni Malinen PGP id EFC895FA
This patch adds support for TLS SessionTicket extension (RFC 4507) for
the parts used by EAP-FAST (RFC 4851).
This is based on the patch from Alexey Kobozev <[EMAIL PROTECTED]>
(sent to openssl-dev mailing list on Tue, 07 Jun 2005 15:40:58 +0300).
diff -upr openssl-SNAP-20070821.orig/ssl/s3_clnt.c
openssl-SNAP-20070821/ssl/s3_clnt.c
--- openssl-SNAP-20070821.orig/ssl/s3_clnt.c 2007-08-11 17:02:20.000000000
-0700
+++ openssl-SNAP-20070821/ssl/s3_clnt.c 2007-08-22 20:15:55.000000000 -0700
@@ -690,7 +690,7 @@ int ssl3_get_server_hello(SSL *s)
STACK_OF(SSL_CIPHER) *sk;
SSL_CIPHER *c;
unsigned char *p,*d;
- int i,al,ok;
+ int i,al,ok,pre_shared;
unsigned int j;
long n;
#ifndef OPENSSL_NO_COMP
@@ -757,7 +757,26 @@ int ssl3_get_server_hello(SSL *s)
goto f_err;
}
- if (j != 0 && j == s->session->session_id_length
+ /* check if we want to resume the session based on external pre-shared
secret */
+ pre_shared = 0;
+#ifndef OPENSSL_NO_TLSEXT
+ if (s->version >= TLS1_VERSION && s->tls_session_secret_cb)
+ {
+ SSL_CIPHER *pref_cipher=NULL;
+ s->session->master_key_length=sizeof(s->session->master_key);
+ if (s->tls_session_secret_cb(s, s->session->master_key,
&s->session->master_key_length,
+ NULL, &pref_cipher, s->tls_session_secret_cb_arg))
+ {
+ s->hit=1;
+ s->session->cipher=pref_cipher ? pref_cipher :
ssl_get_cipher_by_char(s,p+j);
+ s->session->session_id_length = j;
+ memcpy(s->session->session_id, p, j);
+ pre_shared = 1;
+ }
+ }
+#endif /* OPENSSL_NO_TLSEXT */
+
+ if ((pre_shared || j != 0) && j == s->session->session_id_length
&& memcmp(p,s->session->session_id,j) == 0)
{
if(s->sid_ctx_length != s->session->sid_ctx_length
diff -upr openssl-SNAP-20070821.orig/ssl/s3_srvr.c
openssl-SNAP-20070821/ssl/s3_srvr.c
--- openssl-SNAP-20070821.orig/ssl/s3_srvr.c 2007-08-20 06:01:59.000000000
-0700
+++ openssl-SNAP-20070821/ssl/s3_srvr.c 2007-08-21 18:45:07.000000000 -0700
@@ -963,6 +963,59 @@ int ssl3_get_client_hello(SSL *s)
SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_CLIENTHELLO_TLSEXT);
goto err;
}
+
+ /* Check if we want to use external pre-shared secret for this
+ * handshake for not reused session only. We need to generate
+ * server_random before calling tls_session_secret_cb in order to allow
+ * SessionTicket processing to use it in key derivation. */
+ {
+ unsigned long Time;
+ unsigned char *pos;
+ Time=(unsigned long)time(NULL); /* Time */
+ pos=s->s3->server_random;
+ l2n(Time,pos);
+ if (RAND_pseudo_bytes(pos,SSL3_RANDOM_SIZE-4) <= 0)
+ {
+ al=SSL_AD_INTERNAL_ERROR;
+ goto f_err;
+ }
+ }
+
+ if (!s->hit && s->version >= TLS1_VERSION && s->tls_session_secret_cb)
+ {
+ SSL_CIPHER *pref_cipher=NULL;
+
+ s->session->master_key_length=sizeof(s->session->master_key);
+ if(s->tls_session_secret_cb(s, s->session->master_key,
&s->session->master_key_length,
+ ciphers, &pref_cipher, s->tls_session_secret_cb_arg))
+ {
+ s->hit=1;
+ s->session->ciphers=ciphers;
+ s->session->verify_result=X509_V_OK;
+
+ ciphers=NULL;
+
+ /* check if some cipher was preferred by call back */
+ pref_cipher=pref_cipher ? pref_cipher :
ssl3_choose_cipher(s, s->session->ciphers, SSL_get_ciphers(s));
+ if (pref_cipher == NULL)
+ {
+ al=SSL_AD_HANDSHAKE_FAILURE;
+
SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_NO_SHARED_CIPHER);
+ goto f_err;
+ }
+
+ s->session->cipher=pref_cipher;
+
+ if (s->cipher_list)
+ sk_SSL_CIPHER_free(s->cipher_list);
+
+ if (s->cipher_list_by_id)
+ sk_SSL_CIPHER_free(s->cipher_list_by_id);
+
+ s->cipher_list = sk_SSL_CIPHER_dup(s->session->ciphers);
+ s->cipher_list_by_id =
sk_SSL_CIPHER_dup(s->session->ciphers);
+ }
+ }
#endif
/* Worst case, we will use the NULL compression, but if we have other
@@ -1085,16 +1138,22 @@ int ssl3_send_server_hello(SSL *s)
unsigned char *buf;
unsigned char *p,*d;
int i,sl;
- unsigned long l,Time;
+ unsigned long l;
+#ifdef OPENSSL_NO_TLSEXT
+ unsigned long Time;
+#endif
if (s->state == SSL3_ST_SW_SRVR_HELLO_A)
{
buf=(unsigned char *)s->init_buf->data;
+#ifdef OPENSSL_NO_TLSEXT
p=s->s3->server_random;
+ /* Generate server_random if it was not needed previously */
Time=(unsigned long)time(NULL); /* Time */
l2n(Time,p);
if (RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-4) <= 0)
return -1;
+#endif
/* Do the message type and length last */
d=p= &(buf[4]);
diff -upr openssl-SNAP-20070821.orig/ssl/ssl.h openssl-SNAP-20070821/ssl/ssl.h
--- openssl-SNAP-20070821.orig/ssl/ssl.h 2007-08-11 17:02:21.000000000
-0700
+++ openssl-SNAP-20070821/ssl/ssl.h 2007-08-21 20:05:14.000000000 -0700
@@ -349,6 +349,7 @@ extern "C" {
* 'struct ssl_st *' function parameters used to prototype callbacks
* in SSL_CTX. */
typedef struct ssl_st *ssl_crock_st;
+typedef struct tls_extension_st TLS_EXTENSION;
/* used to hold info on the particular ciphers used */
typedef struct ssl_cipher_st
@@ -375,6 +376,8 @@ DECLARE_STACK_OF(SSL_CIPHER)
typedef struct ssl_st SSL;
typedef struct ssl_ctx_st SSL_CTX;
+typedef int (*tls_session_secret_cb_fn)(SSL *s, void *secret, int *secret_len,
STACK_OF(SSL_CIPHER) *peer_ciphers, SSL_CIPHER **cipher, void *arg);
+
/* Used to hold functions for SSLv2 or SSLv3/TLSv1 functions */
typedef struct ssl_method_st
{
@@ -1086,6 +1089,14 @@ struct ssl_st
size_t tlsext_ellipticcurvelist_length;
unsigned char *tlsext_ellipticcurvelist; /* our list */
#endif /* OPENSSL_NO_EC */
+
+ /* TLS extensions */
+ TLS_EXTENSION *tls_extension;
+
+ /* TLS pre-shared secret session resumption */
+ tls_session_secret_cb_fn tls_session_secret_cb;
+ void *tls_session_secret_cb_arg;
+
SSL_CTX * initial_ctx; /* initial ctx, used to store sessions */
#define session_ctx initial_ctx
#else
@@ -1672,6 +1683,12 @@ void *SSL_COMP_get_compression_methods(v
int SSL_COMP_add_compression_method(int id,void *cm);
#endif
+/* TLS extensions functions */
+int SSL_set_hello_extension(SSL *s, int ext_type, void *ext_data, int ext_len);
+
+/* Pre-shared secret session resumption functions */
+int SSL_set_session_secret_cb(SSL *s, tls_session_secret_cb_fn
tls_session_secret_cb, void *arg);
+
/* BEGIN ERROR CODES */
/* The following lines are auto generated by the script mkerr.pl. Any changes
* made after this point may be overwritten when the script is next run.
@@ -1866,6 +1883,7 @@ void ERR_load_SSL_strings(void);
#define SSL_F_TLS1_PREPARE_SERVERHELLO_TLSEXT 276
#define SSL_F_TLS1_SETUP_KEY_BLOCK 211
#define SSL_F_WRITE_PENDING 212
+#define SSL_F_SSL_SET_HELLO_EXTENSION 213
/* Reason codes. */
#define SSL_R_APP_DATA_IN_HANDSHAKE 100
diff -upr openssl-SNAP-20070821.orig/ssl/ssl_err.c
openssl-SNAP-20070821/ssl/ssl_err.c
--- openssl-SNAP-20070821.orig/ssl/ssl_err.c 2007-08-11 17:02:22.000000000
-0700
+++ openssl-SNAP-20070821/ssl/ssl_err.c 2007-08-21 18:45:07.000000000 -0700
@@ -255,6 +255,7 @@ static ERR_STRING_DATA SSL_str_functs[]=
{ERR_FUNC(SSL_F_TLS1_PREPARE_SERVERHELLO_TLSEXT),
"TLS1_PREPARE_SERVERHELLO_TLSEXT"},
{ERR_FUNC(SSL_F_TLS1_SETUP_KEY_BLOCK), "TLS1_SETUP_KEY_BLOCK"},
{ERR_FUNC(SSL_F_WRITE_PENDING), "WRITE_PENDING"},
+{ERR_FUNC(SSL_F_SSL_SET_HELLO_EXTENSION), "SSL_set_hello_extension"},
{0,NULL}
};
diff -upr openssl-SNAP-20070821.orig/ssl/ssl_sess.c
openssl-SNAP-20070821/ssl/ssl_sess.c
--- openssl-SNAP-20070821.orig/ssl/ssl_sess.c 2007-08-11 17:02:23.000000000
-0700
+++ openssl-SNAP-20070821/ssl/ssl_sess.c 2007-08-22 20:12:42.000000000
-0700
@@ -829,6 +829,52 @@ long SSL_CTX_get_timeout(const SSL_CTX *
return(s->session_timeout);
}
+#ifndef OPENSSL_NO_TLSEXT
+int SSL_set_session_secret_cb(SSL *s, int (*tls_session_secret_cb)(SSL *s,
void *secret, int *secret_len,
+ STACK_OF(SSL_CIPHER) *peer_ciphers, SSL_CIPHER **cipher, void *arg),
void *arg)
+{
+ if (s == NULL) return(0);
+ s->tls_session_secret_cb = tls_session_secret_cb;
+ s->tls_session_secret_cb_arg = arg;
+ return(1);
+}
+
+int SSL_set_hello_extension(SSL *s, int ext_type, void *ext_data, int ext_len)
+{
+ if(s->version >= TLS1_VERSION)
+ {
+ if(s->tls_extension)
+ {
+ OPENSSL_free(s->tls_extension);
+ s->tls_extension = NULL;
+ }
+
+ s->tls_extension = OPENSSL_malloc(sizeof(TLS_EXTENSION) +
ext_len);
+ if(!s->tls_extension)
+ {
+ SSLerr(SSL_F_SSL_SET_HELLO_EXTENSION,
ERR_R_MALLOC_FAILURE);
+ return 0;
+ }
+
+ s->tls_extension->type = ext_type;
+
+ if(ext_data)
+ {
+ s->tls_extension->length = ext_len;
+ s->tls_extension->data = s->tls_extension + 1;
+ memcpy(s->tls_extension->data, ext_data, ext_len);
+ } else {
+ s->tls_extension->length = 0;
+ s->tls_extension->data = NULL;
+ }
+
+ return 1;
+ }
+
+ return 0;
+}
+#endif /* OPENSSL_NO_TLSEXT */
+
typedef struct timeout_param_st
{
SSL_CTX *ctx;
diff -upr openssl-SNAP-20070821.orig/ssl/t1_lib.c
openssl-SNAP-20070821/ssl/t1_lib.c
--- openssl-SNAP-20070821.orig/ssl/t1_lib.c 2007-08-20 06:02:00.000000000
-0700
+++ openssl-SNAP-20070821/ssl/t1_lib.c 2007-08-22 20:26:56.000000000 -0700
@@ -153,6 +153,10 @@ int tls1_new(SSL *s)
void tls1_free(SSL *s)
{
+ if(s->tls_extension)
+ {
+ OPENSSL_free(s->tls_extension);
+ }
ssl3_free(s);
}
@@ -354,8 +358,24 @@ unsigned char *ssl_add_clienthello_tlsex
int ticklen;
if (s->session && s->session->tlsext_tick)
ticklen = s->session->tlsext_ticklen;
+ else if (s->session && s->tls_extension &&
+ s->tls_extension->type == TLSEXT_TYPE_session_ticket &&
+ s->tls_extension->data)
+ {
+ ticklen = s->tls_extension->length;
+ s->session->tlsext_tick = OPENSSL_malloc(ticklen);
+ if (!s->session->tlsext_tick)
+ return NULL;
+ memcpy(s->session->tlsext_tick, s->tls_extension->data,
+ ticklen);
+ s->session->tlsext_ticklen = ticklen;
+ }
else
ticklen = 0;
+ if (ticklen == 0 &&
+ s->tls_extension->type == TLSEXT_TYPE_session_ticket &&
+ s->tls_extension->data == NULL)
+ goto skip_ext;
/* Check for enough room 2 for extension type, 2 for len
* rest for ticket
*/
@@ -369,6 +389,7 @@ unsigned char *ssl_add_clienthello_tlsex
ret += ticklen;
}
}
+ skip_ext:
if ((extdatalen = ret-p-2)== 0)
return p;
@@ -963,6 +984,8 @@ int tls1_process_ticket(SSL *s, unsigned
s->tlsext_ticket_expected = 1;
return 0; /* Cache miss */
}
+ if (s->tls_session_secret_cb)
+ return 0;
return tls_decrypt_ticket(s, p, size, session_id, len,
ret);
}
diff -upr openssl-SNAP-20070821.orig/ssl/tls1.h openssl-SNAP-20070821/ssl/tls1.h
--- openssl-SNAP-20070821.orig/ssl/tls1.h 2007-08-11 17:02:24.000000000
-0700
+++ openssl-SNAP-20070821/ssl/tls1.h 2007-08-21 18:45:07.000000000 -0700
@@ -463,6 +463,14 @@ SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TLSEXT_SER
#define TLS_MD_MASTER_SECRET_CONST
"\x6d\x61\x73\x74\x65\x72\x20\x73\x65\x63\x72\x65\x74" /*master secret*/
#endif
+/* TLS extension struct */
+struct tls_extension_st
+{
+ unsigned short type;
+ unsigned short length;
+ void *data;
+};
+
#ifdef __cplusplus
}
#endif
diff -upr openssl-SNAP-20070821.orig/util/ssleay.num
openssl-SNAP-20070821/util/ssleay.num
--- openssl-SNAP-20070821.orig/util/ssleay.num 2007-08-12 17:02:12.000000000
-0700
+++ openssl-SNAP-20070821/util/ssleay.num 2007-08-21 20:07:24.000000000
-0700
@@ -253,3 +253,5 @@ PEM_read_bio_SSL_SESSION
SSL_CTX_set_psk_server_callback 302 EXIST::FUNCTION:PSK
SSL_get_psk_identity 303 EXIST::FUNCTION:PSK
PEM_write_SSL_SESSION 304 EXIST:!WIN16:FUNCTION:
+SSL_set_hello_extension 305 EXIST::FUNCTION:TLSEXT
+SSL_set_session_secret_cb 306 EXIST::FUNCTION:TLSEXT
