Re: [openssl-dev] OpenSSL HEAD breaks OpenConnect VPN client
On Mon, 2015-02-16 at 20:23 +, Matt Caswell wrote: I've updated https://wiki.openssl.org/index.php/1.1_API_Changes#Things_that_Broke_in_OpenConnect I can either update my code to create the ASN.1 for itself and use d2i_SSL_SESSION() relying on the patch above, or I can implement the 'alternative' new function if that's preferred. Ok. Thanks. I'll take a look at this and see what can be done. Thanks. FWIW I've updated the above wiki section again, having fixed it in OpenConnect to use d2i_SSL_SESSION(). Of course, it won't work until d2i_SSL_SESSION() is fixed using the patch I sent before... but then again, DTLS1_BAD_VER in HEAD and 1.0.2 is utterly hosed anyway, so I'm not going to lose much sleep over that for now. -- David WoodhouseOpen Source Technology Centre david.woodho...@intel.com Intel Corporation smime.p7s Description: S/MIME cryptographic signature ___ openssl-dev mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
Re: [openssl-dev] OpenSSL HEAD breaks OpenConnect VPN client
On Mon, 2015-02-16 at 13:25 +, Matt Caswell wrote:
That sounds like a bug. I can't think of a reason why this should
exclude DTLS.
This fixes it to work with DTLS1_BAD_VER too:
diff --git a/ssl/ssl_asn1.c b/ssl/ssl_asn1.c
index 3eaee1d..6e20a1f 100644
--- a/ssl/ssl_asn1.c
+++ b/ssl/ssl_asn1.c
@@ -396,7 +396,8 @@ SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, const
unsigned char **pp,
os.data = NULL;
os.length = 0;
M_ASN1_D2I_get_x(ASN1_OCTET_STRING, osp, d2i_ASN1_OCTET_STRING);
-if ((ssl_version 8) = SSL3_VERSION_MAJOR) {
+if ((ssl_version 8) = SSL3_VERSION_MAJOR ||
+ ssl_version == DTLS1_BAD_VER) {
if (os.length != 2) {
c.error = SSL_R_CIPHER_CODE_WRONG_LENGTH;
c.line = __LINE__;
So I'm going to need to fix *something* in OpenSSL HEAD to make this
work again. Should I do the minimal fix to make d2i_SSL_SESSION() work
for DTLS1_BAD_VER, or introduce a new API for setting the fields we need
to fake a session resume?
What fields do you need access to? It would be good if you could
document them on the wiki page here:
https://wiki.openssl.org/index.php/1.1_API_Changes
I've updated
https://wiki.openssl.org/index.php/1.1_API_Changes#Things_that_Broke_in_OpenConnect
I can either update my code to create the ASN.1 for itself and use
d2i_SSL_SESSION() relying on the patch above, or I can implement the
'alternative' new function if that's preferred.
--
David WoodhouseOpen Source Technology Centre
david.woodho...@intel.com Intel Corporation
smime.p7s
Description: S/MIME cryptographic signature
___
openssl-dev mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
Re: [openssl-dev] OpenSSL HEAD breaks OpenConnect VPN client
On 16/02/15 17:33, David Woodhouse wrote:
On Mon, 2015-02-16 at 13:25 +, Matt Caswell wrote:
That sounds like a bug. I can't think of a reason why this should
exclude DTLS.
This fixes it to work with DTLS1_BAD_VER too:
diff --git a/ssl/ssl_asn1.c b/ssl/ssl_asn1.c
index 3eaee1d..6e20a1f 100644
--- a/ssl/ssl_asn1.c
+++ b/ssl/ssl_asn1.c
@@ -396,7 +396,8 @@ SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, const
unsigned char **pp,
os.data = NULL;
os.length = 0;
M_ASN1_D2I_get_x(ASN1_OCTET_STRING, osp, d2i_ASN1_OCTET_STRING);
-if ((ssl_version 8) = SSL3_VERSION_MAJOR) {
+if ((ssl_version 8) = SSL3_VERSION_MAJOR ||
+ ssl_version == DTLS1_BAD_VER) {
if (os.length != 2) {
c.error = SSL_R_CIPHER_CODE_WRONG_LENGTH;
c.line = __LINE__;
So I'm going to need to fix *something* in OpenSSL HEAD to make this
work again. Should I do the minimal fix to make d2i_SSL_SESSION() work
for DTLS1_BAD_VER, or introduce a new API for setting the fields we need
to fake a session resume?
What fields do you need access to? It would be good if you could
document them on the wiki page here:
https://wiki.openssl.org/index.php/1.1_API_Changes
I've updated
https://wiki.openssl.org/index.php/1.1_API_Changes#Things_that_Broke_in_OpenConnect
I can either update my code to create the ASN.1 for itself and use
d2i_SSL_SESSION() relying on the patch above, or I can implement the
'alternative' new function if that's preferred.
Ok. Thanks. I'll take a look at this and see what can be done.
Matt
___
openssl-dev mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
[openssl-dev] OpenSSL HEAD breaks OpenConnect VPN client
The Cisco AnyConnect VPN protocol establishes a connection over HTTPS and negotiates parameters (cipher, master secret session ID) for a DTLS connection which is then resumed. The OpenConnect VPN client handles this by using SSL_SESSION_new(), manually setting the appropriate fields in the structure, and then using SSL_set_session(). This code can be seen at http://git.infradead.org/users/dwmw2/openconnect.git/blob/fa5cea08:/dtls.c#l147 Commit b6ba401497 in OpenSSL broke this, because the SSL_SESSION became opaque — with no alternative method that I can see to do what's needed. I played with manually creating the ASN.1 representation of a session and feeding it to d2i_SSL_SESSION() but that fails because ssl_version is 0x100 (DTLS1_BAD_VER) and d2i_SSL_SESSION() only works if the SSL version major is = SSL3_VERSION_MAJOR. So I'm going to need to fix *something* in OpenSSL HEAD to make this work again. Should I do the minimal fix to make d2i_SSL_SESSION() work for DTLS1_BAD_VER, or introduce a new API for setting the fields we need to fake a session resume? -- David WoodhouseOpen Source Technology Centre david.woodho...@intel.com Intel Corporation smime.p7s Description: S/MIME cryptographic signature ___ openssl-dev mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
Re: [openssl-dev] OpenSSL HEAD breaks OpenConnect VPN client
On 16/02/15 12:45, David Woodhouse wrote: The Cisco AnyConnect VPN protocol establishes a connection over HTTPS and negotiates parameters (cipher, master secret session ID) for a DTLS connection which is then resumed. The OpenConnect VPN client handles this by using SSL_SESSION_new(), manually setting the appropriate fields in the structure, and then using SSL_set_session(). This code can be seen at http://git.infradead.org/users/dwmw2/openconnect.git/blob/fa5cea08:/dtls.c#l147 Commit b6ba401497 in OpenSSL broke this, because the SSL_SESSION became opaque — with no alternative method that I can see to do what's needed. I played with manually creating the ASN.1 representation of a session and feeding it to d2i_SSL_SESSION() but that fails because ssl_version is 0x100 (DTLS1_BAD_VER) and d2i_SSL_SESSION() only works if the SSL version major is = SSL3_VERSION_MAJOR. That sounds like a bug. I can't think of a reason why this should exclude DTLS. So I'm going to need to fix *something* in OpenSSL HEAD to make this work again. Should I do the minimal fix to make d2i_SSL_SESSION() work for DTLS1_BAD_VER, or introduce a new API for setting the fields we need to fake a session resume? What fields do you need access to? It would be good if you could document them on the wiki page here: https://wiki.openssl.org/index.php/1.1_API_Changes Send an email to wiki-ad...@opensslfoundation.com with your preferred username and I can set you up with access. Matt ___ openssl-dev mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
Re: [openssl-dev] OpenSSL HEAD breaks OpenConnect VPN client
I played with manually creating the ASN.1 representation of a session and feeding it to d2i_SSL_SESSION() but that fails because ssl_version is 0x100 (DTLS1_BAD_VER) and d2i_SSL_SESSION() only works if the SSL version major is = SSL3_VERSION_MAJOR. That sounds like a bug. I can't think of a reason why this should exclude DTLS. Note it accepts DTLS, just not Cisco's DTLS1_BAD_VER abomination. So I'm going to need to fix *something* in OpenSSL HEAD to make this work again. Should I do the minimal fix to make d2i_SSL_SESSION() work for DTLS1_BAD_VER, or introduce a new API for setting the fields we need to fake a session resume? What fields do you need access to? Basically just SSL version, cipher, master secret and session ID. Enough to fake resuming a session that never really existed. -- dwmw2 ___ openssl-dev mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
Re: [openssl-dev] OpenSSL HEAD breaks OpenConnect VPN client
On Mon, Feb 16, 2015 at 02:16:15PM -, David Woodhouse wrote: What fields do you need access to? Basically just SSL version, cipher, master secret and session ID. Enough to fake resuming a session that never really existed. Does the constructed DTLS session re-use the parameters of the original TLS session from HTTPS? If so, it might suffice to run i2d_SSL_SESSION on the TLS session, later thaw it with d2i_SSL_SESSION and then change just enough to turn that into a DTLS session (is just changing s-version enough?). Constructing everything by hand seems like too much work, and likely too much for the API to expose. -- Viktor. ___ openssl-dev mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
Re: [openssl-dev] OpenSSL HEAD breaks OpenConnect VPN client
On Mon, Feb 16, 2015 at 02:16:15PM -, David Woodhouse wrote: What fields do you need access to? Basically just SSL version, cipher, master secret and session ID. Enough to fake resuming a session that never really existed. Does the constructed DTLS session re-use the parameters of the original TLS session from HTTPS? If so, it might suffice to run i2d_SSL_SESSION on the TLS session, later thaw it with d2i_SSL_SESSION and then change just enough to turn that into a DTLS session (is just changing s-version enough?). No. The parameters for the DTLS session are entirely separate. I could relatively easily construct the corresponding ASN.1 if I fix the fact that d2i_SSL_SESSION() breaks on the ssl_version I need. If that's considered to be a reasonable (ab)use of the API. -- dwmw2 ___ openssl-dev mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
