libeap/patches/openssl-0.9.8zf-tls-extensions.patch

   1 This patch adds support for TLS SessionTicket extension (RFC 5077) for
   2 the parts used by EAP-FAST (RFC 4851).
   3
   4 This is based on the patch from Alexey Kobozev <akobozev@cisco.com>
   5 (sent to openssl-dev mailing list on Tue, 07 Jun 2005 15:40:58 +0300).
   6
   7 OpenSSL 0.9.8zf does not enable TLS extension support by default, so it
   8 will need to be enabled by adding enable-tlsext to config script
   9 command line.
  10
  11
  12 diff -upr openssl-0.9.8zf.orig/ssl/s3_clnt.c openssl-0.9.8zf/ssl/s3_clnt.c
  13 --- openssl-0.9.8zf.orig/ssl/s3_clnt.c  2015-03-19 15:46:46.000000000 +0200
  14 +++ openssl-0.9.8zf/ssl/s3_clnt.c       2015-03-24 16:19:14.043911769 +0200
  15 @@ -760,6 +760,23 @@ int ssl3_get_server_hello(SSL *s)
  16          goto f_err;
  17      }
  18
  19 +#ifndef OPENSSL_NO_TLSEXT
  20 +    /* check if we want to resume the session based on external pre-shared secret */
  21 +    if (s->version >= TLS1_VERSION && s->tls_session_secret_cb) {
  22 +        SSL_CIPHER *pref_cipher = NULL;
  23 +
  24 +        s->session->master_key_length = sizeof(s->session->master_key);
  25 +        if (s->tls_session_secret_cb(s, s->session->master_key,
  26 +                                    &s->session->master_key_length,
  27 +                                    NULL, &pref_cipher,
  28 +                                    s->tls_session_secret_cb_arg)) {
  29 +            s->session->cipher = pref_cipher ?
  30 +                   pref_cipher : ssl_get_cipher_by_char(s, p + j);
  31 +           s->s3->flags |= SSL3_FLAGS_CCS_OK;
  32 +       }
  33 +    }
  34 +#endif /* OPENSSL_NO_TLSEXT */
  35 +
  36      if (j != 0 && j == s->session->session_id_length
  37          && memcmp(p, s->session->session_id, j) == 0) {
  38          if (s->sid_ctx_length != s->session->sid_ctx_length
  39 @@ -2684,12 +2701,8 @@ int ssl3_check_finished(SSL *s)
  40  {
  41      int ok;
  42      long n;
  43 -    /*
  44 -     * If we have no ticket or session ID is non-zero length (a match of a
  45 -     * non-zero session length would never reach here) it cannot be a resumed
  46 -     * session.
  47 -     */
  48 -    if (!s->session->tlsext_tick || s->session->session_id_length)
  49 +    /* If we have no ticket it cannot be a resumed session. */
  50 +    if (!s->session->tlsext_tick)
  51          return 1;
  52      /*
  53       * this function is called when we really expect a Certificate message,
  54 diff -upr openssl-0.9.8zf.orig/ssl/s3_srvr.c openssl-0.9.8zf/ssl/s3_srvr.c
  55 --- openssl-0.9.8zf.orig/ssl/s3_srvr.c  2015-03-19 15:46:46.000000000 +0200
  56 +++ openssl-0.9.8zf/ssl/s3_srvr.c       2015-03-24 16:23:34.567909681 +0200
  57 @@ -999,6 +999,59 @@ int ssl3_get_client_hello(SSL *s)
  58          SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, SSL_R_CLIENTHELLO_TLSEXT);
  59          goto err;
  60      }
  61 +
  62 +    /* Check if we want to use external pre-shared secret for this
  63 +     * handshake for not reused session only. We need to generate
  64 +     * server_random before calling tls_session_secret_cb in order to allow
  65 +     * SessionTicket processing to use it in key derivation. */
  66 +    {
  67 +        unsigned long Time;
  68 +       unsigned char *pos;
  69 +       Time = (unsigned long)time(NULL);                       /* Time */
  70 +       pos = s->s3->server_random;
  71 +       l2n(Time, pos);
  72 +       if (RAND_pseudo_bytes(pos, SSL3_RANDOM_SIZE - 4) <= 0) {
  73 +               al = SSL_AD_INTERNAL_ERROR;
  74 +               goto f_err;
  75 +       }
  76 +    }
  77 +
  78 +    if (!s->hit && s->version >= TLS1_VERSION && s->tls_session_secret_cb) {
  79 +       SSL_CIPHER *pref_cipher = NULL;
  80 +
  81 +       s->session->master_key_length = sizeof(s->session->master_key);
  82 +       if (s->tls_session_secret_cb(s, s->session->master_key,
  83 +                                    &s->session->master_key_length,
  84 +                                    ciphers, &pref_cipher,
  85 +                                    s->tls_session_secret_cb_arg)) {
  86 +           s->hit = 1;
  87 +           s->session->ciphers = ciphers;
  88 +           s->session->verify_result = X509_V_OK;
  89 +
  90 +           ciphers = NULL;
  91 +
  92 +           /* check if some cipher was preferred by call back */
  93 +           pref_cipher = pref_cipher ? pref_cipher :
  94 +                   ssl3_choose_cipher(s, s->session->ciphers,
  95 +                                      SSL_get_ciphers(s));
  96 +           if (pref_cipher == NULL) {
  97 +               al = SSL_AD_HANDSHAKE_FAILURE;
  98 +               SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, SSL_R_NO_SHARED_CIPHER);
  99 +               goto f_err;
 100 +           }
 101 +
 102 +           s->session->cipher = pref_cipher;
 103 +
 104 +           if (s->cipher_list)
 105 +               sk_SSL_CIPHER_free(s->cipher_list);
 106 +
 107 +           if (s->cipher_list_by_id)
 108 +               sk_SSL_CIPHER_free(s->cipher_list_by_id);
 109 +
 110 +           s->cipher_list = sk_SSL_CIPHER_dup(s->session->ciphers);
 111 +           s->cipher_list_by_id = sk_SSL_CIPHER_dup(s->session->ciphers);
 112 +       }
 113 +    }
 114  #endif
 115      /*
 116       * Worst case, we will use the NULL compression, but if we have other
 117 @@ -1143,15 +1196,21 @@ int ssl3_send_server_hello(SSL *s)
 118      unsigned char *buf;
 119      unsigned char *p, *d;
 120      int i, sl;
 121 -    unsigned long l, Time;
 122 +    unsigned long l;
 123 +#ifdef OPENSSL_NO_TLSEXT
 124 +    unsigned long Time;
 125 +#endif
 126
 127      if (s->state == SSL3_ST_SW_SRVR_HELLO_A) {
 128          buf = (unsigned char *)s->init_buf->data;
 129 +#ifdef OPENSSL_NO_TLSEXT
 130          p = s->s3->server_random;
 131 +        /* Generate server_random if it was not needed previously */
 132          Time = (unsigned long)time(NULL); /* Time */
 133          l2n(Time, p);
 134          if (RAND_pseudo_bytes(p, SSL3_RANDOM_SIZE - 4) <= 0)
 135              return -1;
 136 +#endif
 137          /* Do the message type and length last */
 138          d = p = &(buf[4]);
 139
 140 diff -upr openssl-0.9.8zf.orig/ssl/ssl_err.c openssl-0.9.8zf/ssl/ssl_err.c
 141 --- openssl-0.9.8zf.orig/ssl/ssl_err.c  2015-03-19 15:46:46.000000000 +0200
 142 +++ openssl-0.9.8zf/ssl/ssl_err.c       2015-03-24 16:35:58.627903717 +0200
 143 @@ -316,6 +316,7 @@ static ERR_STRING_DATA SSL_str_functs[]
 144      {ERR_FUNC(SSL_F_TLS1_ENC), "TLS1_ENC"},
 145      {ERR_FUNC(SSL_F_TLS1_SETUP_KEY_BLOCK), "TLS1_SETUP_KEY_BLOCK"},
 146      {ERR_FUNC(SSL_F_WRITE_PENDING), "WRITE_PENDING"},
 147 +    {ERR_FUNC(SSL_F_SSL_SET_SESSION_TICKET_EXT), "SSL_set_session_ticket_ext"},
 148      {0, NULL}
 149  };
 150
 151 diff -upr openssl-0.9.8zf.orig/ssl/ssl.h openssl-0.9.8zf/ssl/ssl.h
 152 --- openssl-0.9.8zf.orig/ssl/ssl.h      2015-03-19 15:46:46.000000000 +0200
 153 +++ openssl-0.9.8zf/ssl/ssl.h   2015-03-24 16:25:44.339908641 +0200
 154 @@ -349,6 +349,7 @@ extern "C" {
 155   * function parameters used to prototype callbacks in SSL_CTX.
 156   */
 157  typedef struct ssl_st *ssl_crock_st;
 158 +typedef struct tls_session_ticket_ext_st TLS_SESSION_TICKET_EXT;
 159
 160  /* used to hold info on the particular ciphers used */
 161  typedef struct ssl_cipher_st {
 162 @@ -366,6 +367,12 @@ typedef struct ssl_cipher_st {
 163
 164  DECLARE_STACK_OF(SSL_CIPHER)
 165
 166 +typedef int (*tls_session_ticket_ext_cb_fn)(SSL *s, const unsigned char *data,
 167 +                                           int len, void *arg);
 168 +typedef int (*tls_session_secret_cb_fn)(SSL *s, void *secret, int *secret_len,
 169 +                                       STACK_OF(SSL_CIPHER) *peer_ciphers,
 170 +                                       SSL_CIPHER **cipher, void *arg);
 171 +
 172  /* Used to hold functions for SSLv2 or SSLv3/TLSv1 functions */
 173  typedef struct ssl_method_st {
 174      int version;
 175 @@ -1116,6 +1123,18 @@ struct ssl_st {
 176      int tlsext_ocsp_resplen;
 177      /* RFC4507 session ticket expected to be received or sent */
 178      int tlsext_ticket_expected;
 179 +
 180 +    /* TLS Session Ticket extension override */
 181 +    TLS_SESSION_TICKET_EXT *tlsext_session_ticket;
 182 +
 183 +    /* TLS Session Ticket extension callback */
 184 +    tls_session_ticket_ext_cb_fn tls_session_ticket_ext_cb;
 185 +    void *tls_session_ticket_ext_cb_arg;
 186 +
 187 +    /* TLS pre-shared secret session resumption */
 188 +    tls_session_secret_cb_fn tls_session_secret_cb;
 189 +    void *tls_session_secret_cb_arg;
 190 +
 191      SSL_CTX *initial_ctx;       /* initial ctx, used to store sessions */
 192  #  define session_ctx initial_ctx
 193  # else
 194 @@ -1772,6 +1791,17 @@ void *SSL_COMP_get_compression_methods(v
 195  int SSL_COMP_add_compression_method(int id, void *cm);
 196  # endif
 197
 198 +/* TLS extensions functions */
 199 +int SSL_set_session_ticket_ext(SSL *s, void *ext_data, int ext_len);
 200 +
 201 +int SSL_set_session_ticket_ext_cb(SSL *s, tls_session_ticket_ext_cb_fn cb,
 202 +                                 void *arg);
 203 +
 204 +/* Pre-shared secret session resumption functions */
 205 +int SSL_set_session_secret_cb(SSL *s,
 206 +                             tls_session_secret_cb_fn tls_session_secret_cb,
 207 +                             void *arg);
 208 +
 209  /* BEGIN ERROR CODES */
 210  /*
 211   * The following lines are auto generated by the script mkerr.pl. Any changes
 212 @@ -1977,6 +2007,7 @@ void ERR_load_SSL_strings(void);
 213  # define SSL_F_TLS1_ENC                                   210
 214  # define SSL_F_TLS1_SETUP_KEY_BLOCK                       211
 215  # define SSL_F_WRITE_PENDING                              212
 216 +#define SSL_F_SSL_SET_SESSION_TICKET_EXT                  213
 217
 218  /* Reason codes. */
 219  # define SSL_R_APP_DATA_IN_HANDSHAKE                      100
 220 diff -upr openssl-0.9.8zf.orig/ssl/ssl_sess.c openssl-0.9.8zf/ssl/ssl_sess.c
 221 --- openssl-0.9.8zf.orig/ssl/ssl_sess.c 2015-03-19 15:46:46.000000000 +0200
 222 +++ openssl-0.9.8zf/ssl/ssl_sess.c      2015-03-24 16:28:04.819907515 +0200
 223 @@ -716,6 +716,61 @@ long SSL_CTX_get_timeout(const SSL_CTX *
 224      return (s->session_timeout);
 225  }
 226
 227 +#ifndef OPENSSL_NO_TLSEXT
 228 +int SSL_set_session_secret_cb(
 229 +       SSL *s,
 230 +       int (*tls_session_secret_cb)(SSL *s, void *secret, int *secret_len,
 231 +                                    STACK_OF(SSL_CIPHER) *peer_ciphers,
 232 +                                    SSL_CIPHER **cipher, void *arg), void *arg)
 233 +{
 234 +    if (s == NULL)
 235 +           return 0;
 236 +    s->tls_session_secret_cb = tls_session_secret_cb;
 237 +    s->tls_session_secret_cb_arg = arg;
 238 +    return 1;
 239 +}
 240 +
 241 +int SSL_set_session_ticket_ext_cb(SSL *s, tls_session_ticket_ext_cb_fn cb,
 242 +                                 void *arg)
 243 +{
 244 +    if (s == NULL)
 245 +           return 0;
 246 +    s->tls_session_ticket_ext_cb = cb;
 247 +    s->tls_session_ticket_ext_cb_arg = arg;
 248 +    return 1;
 249 +}
 250 +
 251 +int SSL_set_session_ticket_ext(SSL *s, void *ext_data, int ext_len)
 252 +{
 253 +    if (s->version >= TLS1_VERSION) {
 254 +       if (s->tlsext_session_ticket) {
 255 +           OPENSSL_free(s->tlsext_session_ticket);
 256 +           s->tlsext_session_ticket = NULL;
 257 +       }
 258 +
 259 +       s->tlsext_session_ticket = OPENSSL_malloc(
 260 +               sizeof(TLS_SESSION_TICKET_EXT) + ext_len);
 261 +       if (!s->tlsext_session_ticket) {
 262 +           SSLerr(SSL_F_SSL_SET_SESSION_TICKET_EXT, ERR_R_MALLOC_FAILURE);
 263 +           return 0;
 264 +       }
 265 +
 266 +       if (ext_data) {
 267 +           s->tlsext_session_ticket->length = ext_len;
 268 +           s->tlsext_session_ticket->data = s->tlsext_session_ticket + 1;
 269 +           memcpy(s->tlsext_session_ticket->data, ext_data, ext_len);
 270 +       } else {
 271 +               s->tlsext_session_ticket->length = 0;
 272 +               s->tlsext_session_ticket->data = NULL;
 273 +       }
 274 +
 275 +       return 1;
 276 +    }
 277 +
 278 +    return 0;
 279 +}
 280 +#endif /* OPENSSL_NO_TLSEXT */
 281 +
 282  typedef struct timeout_param_st {
 283      SSL_CTX *ctx;
 284      long time;
 285 diff -upr openssl-0.9.8zf.orig/ssl/t1_lib.c openssl-0.9.8zf/ssl/t1_lib.c
 286 --- openssl-0.9.8zf.orig/ssl/t1_lib.c   2015-03-19 15:46:46.000000000 +0200
 287 +++ openssl-0.9.8zf/ssl/t1_lib.c        2015-03-24 16:32:46.923905254 +0200
 288 @@ -108,6 +108,11 @@ int tls1_new(SSL *s)
 289
 290  void tls1_free(SSL *s)
 291  {
 292 +#ifndef OPENSSL_NO_TLSEXT
 293 +    if (s->tlsext_session_ticket) {
 294 +       OPENSSL_free(s->tlsext_session_ticket);
 295 +    }
 296 +#endif
 297      ssl3_free(s);
 298  }
 299
 300 @@ -206,8 +211,20 @@ unsigned char *ssl_add_clienthello_tlsex
 301          int ticklen;
 302          if (!s->new_session && s->session && s->session->tlsext_tick)
 303              ticklen = s->session->tlsext_ticklen;
 304 -        else
 305 +       else if (s->session && s->tlsext_session_ticket &&
 306 +                s->tlsext_session_ticket->data) {
 307 +           ticklen = s->tlsext_session_ticket->length;
 308 +           s->session->tlsext_tick = OPENSSL_malloc(ticklen);
 309 +           if (!s->session->tlsext_tick)
 310 +               return NULL;
 311 +           memcpy(s->session->tlsext_tick, s->tlsext_session_ticket->data,
 312 +                  ticklen);
 313 +           s->session->tlsext_ticklen = ticklen;
 314 +       } else
 315              ticklen = 0;
 316 +       if (ticklen == 0 && s->tlsext_session_ticket &&
 317 +           s->tlsext_session_ticket->data == NULL)
 318 +           goto skip_ext;
 319          /*
 320           * Check for enough room 2 for extension type, 2 for len rest for
 321           * ticket
 322 @@ -221,6 +238,7 @@ unsigned char *ssl_add_clienthello_tlsex
 323              ret += ticklen;
 324          }
 325      }
 326 +skip_ext:
 327
 328      if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
 329          s->version != DTLS1_VERSION) {
 330 @@ -560,6 +578,14 @@ int ssl_parse_clienthello_tlsext(SSL *s,
 331              if (!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
 332                  return 0;
 333              renegotiate_seen = 1;
 334 +       } else if (type == TLSEXT_TYPE_session_ticket) {
 335 +           if (s->tls_session_ticket_ext_cb &&
 336 +               !s->tls_session_ticket_ext_cb(s, data, size,
 337 +                                             s->tls_session_ticket_ext_cb_arg))
 338 +           {
 339 +               *al = TLS1_AD_INTERNAL_ERROR;
 340 +               return 0;
 341 +           }
 342          } else if (type == TLSEXT_TYPE_status_request &&
 343                     s->version != DTLS1_VERSION && s->ctx->tlsext_status_cb) {
 344
 345 @@ -710,6 +736,13 @@ int ssl_parse_serverhello_tlsext(SSL *s,
 346              }
 347              tlsext_servername = 1;
 348          } else if (type == TLSEXT_TYPE_session_ticket) {
 349 +           if (s->tls_session_ticket_ext_cb &&
 350 +               !s->tls_session_ticket_ext_cb(
 351 +                       s, data, size,
 352 +                       s->tls_session_ticket_ext_cb_arg)) {
 353 +               *al = TLS1_AD_INTERNAL_ERROR;
 354 +               return 0;
 355 +           }
 356              if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
 357                  || (size > 0)) {
 358                  *al = TLS1_AD_UNSUPPORTED_EXTENSION;
 359 @@ -993,6 +1026,14 @@ int tls1_process_ticket(SSL *s, unsigned
 360                  s->tlsext_ticket_expected = 1;
 361                  return 0;       /* Cache miss */
 362              }
 363 +           if (s->tls_session_secret_cb) {
 364 +               /* Indicate cache miss here and instead of
 365 +                * generating the session from ticket now,
 366 +                * trigger abbreviated handshake based on
 367 +                * external mechanism to calculate the master
 368 +                * secret later. */
 369 +               return 0;
 370 +           }
 371              return tls_decrypt_ticket(s, p, size, session_id, len, ret);
 372          }
 373          p += size;
 374 diff -upr openssl-0.9.8zf.orig/ssl/tls1.h openssl-0.9.8zf/ssl/tls1.h
 375 --- openssl-0.9.8zf.orig/ssl/tls1.h     2015-03-19 15:46:46.000000000 +0200
 376 +++ openssl-0.9.8zf/ssl/tls1.h  2015-03-24 16:33:31.855904894 +0200
 377 @@ -460,6 +460,12 @@ SSL_CTX_callback_ctrl(ssl,SSL_CTRL_SET_T
 378  #  define TLS_MD_MASTER_SECRET_CONST    "\x6d\x61\x73\x74\x65\x72\x20\x73\x65\x63\x72\x65\x74"
 379  # endif
 380
 381 +/* TLS extension struct */
 382 +struct tls_session_ticket_ext_st {
 383 +    unsigned short length;
 384 +    void *data;
 385 +};
 386 +
 387  #ifdef  __cplusplus
 388  }
 389  #endif
 390 diff -upr openssl-0.9.8zf.orig/util/ssleay.num openssl-0.9.8zf/util/ssleay.num
 391 --- openssl-0.9.8zf.orig/util/ssleay.num        2015-03-19 15:47:15.000000000 +0200
 392 +++ openssl-0.9.8zf/util/ssleay.num     2015-03-24 16:33:51.127904739 +0200
 393 @@ -242,3 +242,5 @@ SSL_set_SSL_CTX
 394  SSL_get_servername                      291    EXIST::FUNCTION:TLSEXT
 395  SSL_get_servername_type                 292    EXIST::FUNCTION:TLSEXT
 396  SSL_CTX_set_client_cert_engine          293    EXIST::FUNCTION:ENGINE
 397 +SSL_set_session_ticket_ext             306     EXIST::FUNCTION:TLSEXT
 398 +SSL_set_session_secret_cb              307     EXIST::FUNCTION:TLSEXT