DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

Updated OpenSSL 0.9.8i patch to use new session ticket override API

Browse source 
The patch for 0.9.9 was merged into the upstream OpenSSL 0.9.9 tree and
is not needed for EAP-FAST support with that OpenSSL version. The patch
for 0.9.8i is now using the same API that was included in 0.9.9.
This commit is contained in:
Jouni Malinen 2008-11-23 21:18:26 +02:00
parent 191a8ad794
commit 31a4c88580
2 changed files with 167 additions and 103 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

266
patches/openssl-0.9.8i-tls-extensions.patch
View file

@ -9,31 +9,33 @@ will need to be enabled by adding enable-tlsext to config script
command line. command line.
diff -upr openssl-0.9.8i.orig/ssl/s3_clnt.c openssl-0.9.8i/ssl/s3_clnt.c Index: openssl-0.9.8i/ssl/s3_clnt.c
===================================================================
--- openssl-0.9.8i.orig/ssl/s3_clnt.c 2008-06-16 19:56:41.000000000 +0300 --- openssl-0.9.8i.orig/ssl/s3_clnt.c 2008-06-16 19:56:41.000000000 +0300
+++ openssl-0.9.8i/ssl/s3_clnt.c 2008-09-28 16:50:18.000000000 +0300 +++ openssl-0.9.8i/ssl/s3_clnt.c 2008-11-23 20:39:40.000000000 +0200
@@ -759,6 +759,20 @@ int ssl3_get_server_hello(SSL *s) @@ -759,6 +759,21 @@
goto f_err; goto f_err;
} }
+#ifndef OPENSSL_NO_TLSEXT +#ifndef OPENSSL_NO_TLSEXT
+ /* check if we want to resume the session based on external pre-shared secret */ + /* check if we want to resume the session based on external pre-shared secret */
+ if (s->version >= TLS1_VERSION && s->tls_session_secret_cb) + if (s->version >= TLS1_VERSION && s->tls_session_secret_cb)
+ { + {
+ SSL_CIPHER *pref_cipher=NULL; + SSL_CIPHER *pref_cipher=NULL;
+ s->session->master_key_length=sizeof(s->session->master_key); + s->session->master_key_length=sizeof(s->session->master_key);
+ if (s->tls_session_secret_cb(s, s->session->master_key, &s->session->master_key_length, + if (s->tls_session_secret_cb(s, s->session->master_key, &s->session->master_key_length,
+ NULL, &pref_cipher, s->tls_session_secret_cb_arg)) + NULL, &pref_cipher, s->tls_session_secret_cb_arg))
+ { + {
+ s->session->cipher=pref_cipher ? pref_cipher : ssl_get_cipher_by_char(s,p+j); + s->session->cipher=pref_cipher ?
+ pref_cipher : ssl_get_cipher_by_char(s,p+j);
+ }
+ } + }
+ }
+#endif /* OPENSSL_NO_TLSEXT */ +#endif /* OPENSSL_NO_TLSEXT */
+ +
if (j != 0 && j == s->session->session_id_length if (j != 0 && j == s->session->session_id_length
&& memcmp(p,s->session->session_id,j) == 0) && memcmp(p,s->session->session_id,j) == 0)
{ {
@@ -2701,11 +2715,8 @@ static int ssl3_check_finished(SSL *s) @@ -2701,11 +2716,8 @@
{ {
int ok; int ok;
long n; long n;
@ -47,10 +49,11 @@ diff -upr openssl-0.9.8i.orig/ssl/s3_clnt.c openssl-0.9.8i/ssl/s3_clnt.c
return 1; return 1;
/* this function is called when we really expect a Certificate /* this function is called when we really expect a Certificate
* message, so permit appropriate message length */ * message, so permit appropriate message length */
diff -upr openssl-0.9.8i.orig/ssl/s3_srvr.c openssl-0.9.8i/ssl/s3_srvr.c Index: openssl-0.9.8i/ssl/s3_srvr.c
===================================================================
--- openssl-0.9.8i.orig/ssl/s3_srvr.c 2008-09-14 21:16:09.000000000 +0300 --- openssl-0.9.8i.orig/ssl/s3_srvr.c 2008-09-14 21:16:09.000000000 +0300
+++ openssl-0.9.8i/ssl/s3_srvr.c 2008-09-28 16:50:18.000000000 +0300 +++ openssl-0.9.8i/ssl/s3_srvr.c 2008-11-23 20:37:40.000000000 +0200
@@ -959,6 +959,59 @@ int ssl3_get_client_hello(SSL *s) @@ -959,6 +959,59 @@
SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_CLIENTHELLO_TLSEXT); SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_CLIENTHELLO_TLSEXT);
goto err; goto err;
} }
@ -66,20 +69,20 @@ diff -upr openssl-0.9.8i.orig/ssl/s3_srvr.c openssl-0.9.8i/ssl/s3_srvr.c
+ pos=s->s3->server_random; + pos=s->s3->server_random;
+ l2n(Time,pos); + l2n(Time,pos);
+ if (RAND_pseudo_bytes(pos,SSL3_RANDOM_SIZE-4) <= 0) + if (RAND_pseudo_bytes(pos,SSL3_RANDOM_SIZE-4) <= 0)
+ { + {
+ al=SSL_AD_INTERNAL_ERROR; + al=SSL_AD_INTERNAL_ERROR;
+ goto f_err; + goto f_err;
+ } + }
+ } + }
+ +
+ if (!s->hit && s->version >= TLS1_VERSION && s->tls_session_secret_cb) + if (!s->hit && s->version >= TLS1_VERSION && s->tls_session_secret_cb)
+ { + {
+ SSL_CIPHER *pref_cipher=NULL; + SSL_CIPHER *pref_cipher=NULL;
+ +
+ s->session->master_key_length=sizeof(s->session->master_key); + s->session->master_key_length=sizeof(s->session->master_key);
+ if(s->tls_session_secret_cb(s, s->session->master_key, &s->session->master_key_length, + if(s->tls_session_secret_cb(s, s->session->master_key, &s->session->master_key_length,
+ ciphers, &pref_cipher, s->tls_session_secret_cb_arg)) + ciphers, &pref_cipher, s->tls_session_secret_cb_arg))
+ { + {
+ s->hit=1; + s->hit=1;
+ s->session->ciphers=ciphers; + s->session->ciphers=ciphers;
+ s->session->verify_result=X509_V_OK; + s->session->verify_result=X509_V_OK;
@ -105,12 +108,12 @@ diff -upr openssl-0.9.8i.orig/ssl/s3_srvr.c openssl-0.9.8i/ssl/s3_srvr.c
+ +
+ s->cipher_list = sk_SSL_CIPHER_dup(s->session->ciphers); + s->cipher_list = sk_SSL_CIPHER_dup(s->session->ciphers);
+ s->cipher_list_by_id = sk_SSL_CIPHER_dup(s->session->ciphers); + s->cipher_list_by_id = sk_SSL_CIPHER_dup(s->session->ciphers);
+ }
+ } + }
+ }
#endif #endif
/* Worst case, we will use the NULL compression, but if we have other /* Worst case, we will use the NULL compression, but if we have other
* options, we will now look for them. We have i-1 compression * options, we will now look for them. We have i-1 compression
@@ -1097,16 +1150,22 @@ int ssl3_send_server_hello(SSL *s) @@ -1097,16 +1150,22 @@
unsigned char *buf; unsigned char *buf;
unsigned char *p,*d; unsigned char *p,*d;
int i,sl; int i,sl;
@ -134,44 +137,51 @@ diff -upr openssl-0.9.8i.orig/ssl/s3_srvr.c openssl-0.9.8i/ssl/s3_srvr.c
/* Do the message type and length last */ /* Do the message type and length last */
d=p= &(buf[4]); d=p= &(buf[4]);
diff -upr openssl-0.9.8i.orig/ssl/ssl_err.c openssl-0.9.8i/ssl/ssl_err.c Index: openssl-0.9.8i/ssl/ssl_err.c
===================================================================
--- openssl-0.9.8i.orig/ssl/ssl_err.c 2008-08-13 22:44:44.000000000 +0300 --- openssl-0.9.8i.orig/ssl/ssl_err.c 2008-08-13 22:44:44.000000000 +0300
+++ openssl-0.9.8i/ssl/ssl_err.c 2008-09-28 16:50:18.000000000 +0300 +++ openssl-0.9.8i/ssl/ssl_err.c 2008-11-23 20:33:43.000000000 +0200
@@ -253,6 +253,7 @@ static ERR_STRING_DATA SSL_str_functs[]= @@ -253,6 +253,7 @@
{ERR_FUNC(SSL_F_TLS1_ENC), "TLS1_ENC"}, {ERR_FUNC(SSL_F_TLS1_ENC), "TLS1_ENC"},
{ERR_FUNC(SSL_F_TLS1_SETUP_KEY_BLOCK), "TLS1_SETUP_KEY_BLOCK"}, {ERR_FUNC(SSL_F_TLS1_SETUP_KEY_BLOCK), "TLS1_SETUP_KEY_BLOCK"},
{ERR_FUNC(SSL_F_WRITE_PENDING), "WRITE_PENDING"}, {ERR_FUNC(SSL_F_WRITE_PENDING), "WRITE_PENDING"},
+{ERR_FUNC(SSL_F_SSL_SET_HELLO_EXTENSION), "SSL_set_hello_extension"}, +{ERR_FUNC(SSL_F_SSL_SET_SESSION_TICKET_EXT), "SSL_set_session_ticket_ext"},
{0,NULL} {0,NULL}
}; };
diff -upr openssl-0.9.8i.orig/ssl/ssl.h openssl-0.9.8i/ssl/ssl.h Index: openssl-0.9.8i/ssl/ssl.h
===================================================================
--- openssl-0.9.8i.orig/ssl/ssl.h 2008-08-13 22:44:44.000000000 +0300 --- openssl-0.9.8i.orig/ssl/ssl.h 2008-08-13 22:44:44.000000000 +0300
+++ openssl-0.9.8i/ssl/ssl.h 2008-09-28 16:50:18.000000000 +0300 +++ openssl-0.9.8i/ssl/ssl.h 2008-11-23 20:35:41.000000000 +0200
@@ -344,6 +344,7 @@ extern "C" { @@ -344,6 +344,7 @@
* 'struct ssl_st *' function parameters used to prototype callbacks * 'struct ssl_st *' function parameters used to prototype callbacks
* in SSL_CTX. */ * in SSL_CTX. */
typedef struct ssl_st *ssl_crock_st; typedef struct ssl_st *ssl_crock_st;
+typedef struct tls_extension_st TLS_EXTENSION; +typedef struct tls_session_ticket_ext_st TLS_SESSION_TICKET_EXT;
/* used to hold info on the particular ciphers used */ /* used to hold info on the particular ciphers used */
typedef struct ssl_cipher_st typedef struct ssl_cipher_st
@@ -362,6 +363,8 @@ typedef struct ssl_cipher_st @@ -362,6 +363,9 @@
DECLARE_STACK_OF(SSL_CIPHER) DECLARE_STACK_OF(SSL_CIPHER)
+typedef int (*tls_session_ticket_ext_cb_fn)(SSL *s, const unsigned char *data, int len, void *arg);
+typedef int (*tls_session_secret_cb_fn)(SSL *s, void *secret, int *secret_len, STACK_OF(SSL_CIPHER) *peer_ciphers, SSL_CIPHER **cipher, void *arg); +typedef int (*tls_session_secret_cb_fn)(SSL *s, void *secret, int *secret_len, STACK_OF(SSL_CIPHER) *peer_ciphers, SSL_CIPHER **cipher, void *arg);
+ +
/* Used to hold functions for SSLv2 or SSLv3/TLSv1 functions */ /* Used to hold functions for SSLv2 or SSLv3/TLSv1 functions */
typedef struct ssl_method_st typedef struct ssl_method_st
{ {
@@ -1034,6 +1037,14 @@ struct ssl_st @@ -1034,6 +1038,18 @@
/* RFC4507 session ticket expected to be received or sent */ /* RFC4507 session ticket expected to be received or sent */
int tlsext_ticket_expected; int tlsext_ticket_expected;
+ +
+ /* TLS extensions */ + /* TLS Session Ticket extension override */
+ TLS_EXTENSION *tls_extension; + TLS_SESSION_TICKET_EXT *tlsext_session_ticket;
+
+ /* TLS Session Ticket extension callback */
+ tls_session_ticket_ext_cb_fn tls_session_ticket_ext_cb;
+ void *tls_session_ticket_ext_cb_arg;
+ +
+ /* TLS pre-shared secret session resumption */ + /* TLS pre-shared secret session resumption */
+ tls_session_secret_cb_fn tls_session_secret_cb; + tls_session_secret_cb_fn tls_session_secret_cb;
@ -180,12 +190,15 @@ diff -upr openssl-0.9.8i.orig/ssl/ssl.h openssl-0.9.8i/ssl/ssl.h
SSL_CTX * initial_ctx; /* initial ctx, used to store sessions */ SSL_CTX * initial_ctx; /* initial ctx, used to store sessions */
#define session_ctx initial_ctx #define session_ctx initial_ctx
#else #else
@@ -1632,6 +1643,12 @@ void *SSL_COMP_get_compression_methods(v @@ -1632,6 +1648,15 @@
int SSL_COMP_add_compression_method(int id,void *cm); int SSL_COMP_add_compression_method(int id,void *cm);
#endif #endif
+/* TLS extensions functions */ +/* TLS extensions functions */
+int SSL_set_hello_extension(SSL *s, int ext_type, void *ext_data, int ext_len); +int SSL_set_session_ticket_ext(SSL *s, void *ext_data, int ext_len);
+
+int SSL_set_session_ticket_ext_cb(SSL *s, tls_session_ticket_ext_cb_fn cb,
+ void *arg);
+ +
+/* Pre-shared secret session resumption functions */ +/* Pre-shared secret session resumption functions */
+int SSL_set_session_secret_cb(SSL *s, tls_session_secret_cb_fn tls_session_secret_cb, void *arg); +int SSL_set_session_secret_cb(SSL *s, tls_session_secret_cb_fn tls_session_secret_cb, void *arg);
@ -193,112 +206,122 @@ diff -upr openssl-0.9.8i.orig/ssl/ssl.h openssl-0.9.8i/ssl/ssl.h
/* BEGIN ERROR CODES */ /* BEGIN ERROR CODES */
/* The following lines are auto generated by the script mkerr.pl. Any changes /* The following lines are auto generated by the script mkerr.pl. Any changes
* made after this point may be overwritten when the script is next run. * made after this point may be overwritten when the script is next run.
@@ -1824,6 +1841,7 @@ void ERR_load_SSL_strings(void); @@ -1824,6 +1849,7 @@
#define SSL_F_TLS1_ENC 210 #define SSL_F_TLS1_ENC 210
#define SSL_F_TLS1_SETUP_KEY_BLOCK 211 #define SSL_F_TLS1_SETUP_KEY_BLOCK 211
#define SSL_F_WRITE_PENDING 212 #define SSL_F_WRITE_PENDING 212
+#define SSL_F_SSL_SET_HELLO_EXTENSION 213 +#define SSL_F_SSL_SET_SESSION_TICKET_EXT 213
/* Reason codes. */ /* Reason codes. */
#define SSL_R_APP_DATA_IN_HANDSHAKE 100 #define SSL_R_APP_DATA_IN_HANDSHAKE 100
diff -upr openssl-0.9.8i.orig/ssl/ssl_sess.c openssl-0.9.8i/ssl/ssl_sess.c Index: openssl-0.9.8i/ssl/ssl_sess.c
===================================================================
--- openssl-0.9.8i.orig/ssl/ssl_sess.c 2008-06-04 21:35:27.000000000 +0300 --- openssl-0.9.8i.orig/ssl/ssl_sess.c 2008-06-04 21:35:27.000000000 +0300
+++ openssl-0.9.8i/ssl/ssl_sess.c 2008-09-28 16:50:18.000000000 +0300 +++ openssl-0.9.8i/ssl/ssl_sess.c 2008-11-23 20:32:24.000000000 +0200
@@ -707,6 +707,52 @@ long SSL_CTX_get_timeout(const SSL_CTX * @@ -707,6 +707,61 @@
return(s->session_timeout); return(s->session_timeout);
} }
+#ifndef OPENSSL_NO_TLSEXT +#ifndef OPENSSL_NO_TLSEXT
+int SSL_set_session_secret_cb(SSL *s, int (*tls_session_secret_cb)(SSL *s, void *secret, int *secret_len, +int SSL_set_session_secret_cb(SSL *s, int (*tls_session_secret_cb)(SSL *s, void *secret, int *secret_len,
+ STACK_OF(SSL_CIPHER) *peer_ciphers, SSL_CIPHER **cipher, void *arg), void *arg) + STACK_OF(SSL_CIPHER) *peer_ciphers, SSL_CIPHER **cipher, void *arg), void *arg)
+{ + {
+ if (s == NULL) return(0); + if (s == NULL) return(0);
+ s->tls_session_secret_cb = tls_session_secret_cb; + s->tls_session_secret_cb = tls_session_secret_cb;
+ s->tls_session_secret_cb_arg = arg; + s->tls_session_secret_cb_arg = arg;
+ return(1); + return(1);
+}
+
+int SSL_set_hello_extension(SSL *s, int ext_type, void *ext_data, int ext_len)
+{
+ if(s->version >= TLS1_VERSION)
+ {
+ if(s->tls_extension)
+ {
+ OPENSSL_free(s->tls_extension);
+ s->tls_extension = NULL;
+ }
+
+ s->tls_extension = OPENSSL_malloc(sizeof(TLS_EXTENSION) + ext_len);
+ if(!s->tls_extension)
+ {
+ SSLerr(SSL_F_SSL_SET_HELLO_EXTENSION, ERR_R_MALLOC_FAILURE);
+ return 0;
+ }
+
+ s->tls_extension->type = ext_type;
+
+ if(ext_data)
+ {
+ s->tls_extension->length = ext_len;
+ s->tls_extension->data = s->tls_extension + 1;
+ memcpy(s->tls_extension->data, ext_data, ext_len);
+ } else {
+ s->tls_extension->length = 0;
+ s->tls_extension->data = NULL;
+ }
+
+ return 1;
+ } + }
+ +
+int SSL_set_session_ticket_ext_cb(SSL *s, tls_session_ticket_ext_cb_fn cb,
+ void *arg)
+ {
+ if (s == NULL) return(0);
+ s->tls_session_ticket_ext_cb = cb;
+ s->tls_session_ticket_ext_cb_arg = arg;
+ return(1);
+ }
+
+int SSL_set_session_ticket_ext(SSL *s, void *ext_data, int ext_len)
+ {
+ if (s->version >= TLS1_VERSION)
+ {
+ if (s->tlsext_session_ticket)
+ {
+ OPENSSL_free(s->tlsext_session_ticket);
+ s->tlsext_session_ticket = NULL;
+ }
+
+ s->tlsext_session_ticket = OPENSSL_malloc(sizeof(TLS_SESSION_TICKET_EXT) + ext_len);
+ if (!s->tlsext_session_ticket)
+ {
+ SSLerr(SSL_F_SSL_SET_SESSION_TICKET_EXT, ERR_R_MALLOC_FAILURE);
+ return 0;
+ }
+
+ if (ext_data)
+ {
+ s->tlsext_session_ticket->length = ext_len;
+ s->tlsext_session_ticket->data = s->tlsext_session_ticket + 1;
+ memcpy(s->tlsext_session_ticket->data, ext_data, ext_len);
+ }
+ else
+ {
+ s->tlsext_session_ticket->length = 0;
+ s->tlsext_session_ticket->data = NULL;
+ }
+
+ return 1;
+ }
+
+ return 0; + return 0;
+} + }
+#endif /* OPENSSL_NO_TLSEXT */ +#endif /* OPENSSL_NO_TLSEXT */
+ +
typedef struct timeout_param_st typedef struct timeout_param_st
{ {
SSL_CTX *ctx; SSL_CTX *ctx;
diff -upr openssl-0.9.8i.orig/ssl/t1_lib.c openssl-0.9.8i/ssl/t1_lib.c Index: openssl-0.9.8i/ssl/t1_lib.c
===================================================================
--- openssl-0.9.8i.orig/ssl/t1_lib.c 2008-09-04 01:13:04.000000000 +0300 --- openssl-0.9.8i.orig/ssl/t1_lib.c 2008-09-04 01:13:04.000000000 +0300
+++ openssl-0.9.8i/ssl/t1_lib.c 2008-09-28 16:50:18.000000000 +0300 +++ openssl-0.9.8i/ssl/t1_lib.c 2008-11-23 20:31:20.000000000 +0200
@@ -106,6 +106,12 @@ int tls1_new(SSL *s) @@ -106,6 +106,12 @@
void tls1_free(SSL *s) void tls1_free(SSL *s)
{ {
+#ifndef OPENSSL_NO_TLSEXT +#ifndef OPENSSL_NO_TLSEXT
+ if(s->tls_extension) + if (s->tlsext_session_ticket)
+ { + {
+ OPENSSL_free(s->tls_extension); + OPENSSL_free(s->tlsext_session_ticket);
+ } + }
+#endif +#endif
ssl3_free(s); ssl3_free(s);
} }
@@ -175,8 +181,24 @@ unsigned char *ssl_add_clienthello_tlsex @@ -175,8 +181,23 @@
int ticklen; int ticklen;
if (s->session && s->session->tlsext_tick) if (s->session && s->session->tlsext_tick)
ticklen = s->session->tlsext_ticklen; ticklen = s->session->tlsext_ticklen;
+ else if (s->session && s->tls_extension && + else if (s->session && s->tlsext_session_ticket &&
+ s->tls_extension->type == TLSEXT_TYPE_session_ticket && + s->tlsext_session_ticket->data)
+ s->tls_extension->data) + {
+ { + ticklen = s->tlsext_session_ticket->length;
+ ticklen = s->tls_extension->length;
+ s->session->tlsext_tick = OPENSSL_malloc(ticklen); + s->session->tlsext_tick = OPENSSL_malloc(ticklen);
+ if (!s->session->tlsext_tick) + if (!s->session->tlsext_tick)
+ return NULL; + return NULL;
+ memcpy(s->session->tlsext_tick, s->tls_extension->data, + memcpy(s->session->tlsext_tick,
+ s->tlsext_session_ticket->data,
+ ticklen); + ticklen);
+ s->session->tlsext_ticklen = ticklen; + s->session->tlsext_ticklen = ticklen;
+ } + }
else else
ticklen = 0; ticklen = 0;
+ if (ticklen == 0 && s->tls_extension && + if (ticklen == 0 && s->tlsext_session_ticket &&
+ s->tls_extension->type == TLSEXT_TYPE_session_ticket && + s->tlsext_session_ticket->data == NULL)
+ s->tls_extension->data == NULL)
+ goto skip_ext; + goto skip_ext;
/* Check for enough room 2 for extension type, 2 for len /* Check for enough room 2 for extension type, 2 for len
* rest for ticket * rest for ticket
*/ */
@@ -190,6 +212,7 @@ unsigned char *ssl_add_clienthello_tlsex @@ -190,6 +211,7 @@
ret += ticklen; ret += ticklen;
} }
} }
@ -306,39 +329,76 @@ diff -upr openssl-0.9.8i.orig/ssl/t1_lib.c openssl-0.9.8i/ssl/t1_lib.c
if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp) if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
{ {
@@ -776,6 +799,8 @@ int tls1_process_ticket(SSL *s, unsigned @@ -407,6 +429,15 @@
}
}
+ else if (type == TLSEXT_TYPE_session_ticket)
+ {
+ if (s->tls_session_ticket_ext_cb &&
+ !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
+ {
+ *al = TLS1_AD_INTERNAL_ERROR;
+ return 0;
+ }
+ }
else if (type == TLSEXT_TYPE_status_request
&& s->ctx->tlsext_status_cb)
{
@@ -553,6 +584,12 @@
}
else if (type == TLSEXT_TYPE_session_ticket)
{
+ if (s->tls_session_ticket_ext_cb &&
+ !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
+ {
+ *al = TLS1_AD_INTERNAL_ERROR;
+ return 0;
+ }
if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
|| (size > 0))
{
@@ -776,6 +813,15 @@
s->tlsext_ticket_expected = 1; s->tlsext_ticket_expected = 1;
return 0; /* Cache miss */ return 0; /* Cache miss */
} }
+ if (s->tls_session_secret_cb) + if (s->tls_session_secret_cb)
+ {
+ /* Indicate cache miss here and instead of
+ * generating the session from ticket now,
+ * trigger abbreviated handshake based on
+ * external mechanism to calculate the master
+ * secret later. */
+ return 0; + return 0;
+ }
return tls_decrypt_ticket(s, p, size, session_id, len, return tls_decrypt_ticket(s, p, size, session_id, len,
ret); ret);
} }
diff -upr openssl-0.9.8i.orig/ssl/tls1.h openssl-0.9.8i/ssl/tls1.h Index: openssl-0.9.8i/ssl/tls1.h
===================================================================
--- openssl-0.9.8i.orig/ssl/tls1.h 2008-04-30 19:11:33.000000000 +0300 --- openssl-0.9.8i.orig/ssl/tls1.h 2008-04-30 19:11:33.000000000 +0300
+++ openssl-0.9.8i/ssl/tls1.h 2008-09-28 16:50:18.000000000 +0300 +++ openssl-0.9.8i/ssl/tls1.h 2008-11-23 20:22:38.000000000 +0200
@@ -398,6 +398,14 @@ SSL_CTX_callback_ctrl(ssl,SSL_CTRL_SET_T @@ -398,6 +398,13 @@
#define TLS_MD_MASTER_SECRET_CONST "\x6d\x61\x73\x74\x65\x72\x20\x73\x65\x63\x72\x65\x74" /*master secret*/ #define TLS_MD_MASTER_SECRET_CONST "\x6d\x61\x73\x74\x65\x72\x20\x73\x65\x63\x72\x65\x74" /*master secret*/
#endif #endif
+/* TLS extension struct */ +/* TLS extension struct */
+struct tls_extension_st +struct tls_session_ticket_ext_st
+{ + {
+ unsigned short type;
+ unsigned short length; + unsigned short length;
+ void *data; + void *data;
+}; + };
+ +
#ifdef __cplusplus #ifdef __cplusplus
} }
#endif #endif
diff -upr openssl-0.9.8i.orig/util/ssleay.num openssl-0.9.8i/util/ssleay.num Index: openssl-0.9.8i/util/ssleay.num
===================================================================
--- openssl-0.9.8i.orig/util/ssleay.num 2008-06-05 13:57:21.000000000 +0300 --- openssl-0.9.8i.orig/util/ssleay.num 2008-06-05 13:57:21.000000000 +0300
+++ openssl-0.9.8i/util/ssleay.num 2008-09-28 16:50:57.000000000 +0300 +++ openssl-0.9.8i/util/ssleay.num 2008-11-23 20:22:05.000000000 +0200
@@ -242,3 +242,5 @@ SSL_set_SSL_CTX @@ -242,3 +242,5 @@
SSL_get_servername 291 EXIST::FUNCTION:TLSEXT SSL_get_servername 291 EXIST::FUNCTION:TLSEXT
SSL_get_servername_type 292 EXIST::FUNCTION:TLSEXT SSL_get_servername_type 292 EXIST::FUNCTION:TLSEXT
SSL_CTX_set_client_cert_engine 293 EXIST::FUNCTION:ENGINE SSL_CTX_set_client_cert_engine 293 EXIST::FUNCTION:ENGINE
+SSL_set_hello_extension 305 EXIST::FUNCTION:TLSEXT +SSL_set_session_ticket_ext 306 EXIST::FUNCTION:TLSEXT
+SSL_set_session_secret_cb 306 EXIST::FUNCTION:TLSEXT +SSL_set_session_secret_cb 307 EXIST::FUNCTION:TLSEXT

4
patches/openssl-0.9.9-session-ticket.patch
View file

@ -4,6 +4,10 @@ the parts used by EAP-FAST (RFC 4851).
This is based on the patch from Alexey Kobozev <akobozev@cisco.com> This is based on the patch from Alexey Kobozev <akobozev@cisco.com>
(sent to openssl-dev mailing list on Tue, 07 Jun 2005 15:40:58 +0300). (sent to openssl-dev mailing list on Tue, 07 Jun 2005 15:40:58 +0300).
NOTE: This patch (without SSL_set_hello_extension() wrapper) was
merged into the upstream OpenSSL 0.9.9 tree and as such, an external
patch for EAP-FAST support is not needed anymore.
Index: openssl-SNAP-20081111/ssl/s3_clnt.c Index: openssl-SNAP-20081111/ssl/s3_clnt.c