It's been just over two years from the time an OpenSSL patch for adding support for EAP-FAST was posted on this list. This patch was against the stable branch (0.9.8) which by default does not support TLS extensions. It took some time, but I finally had a chance to port the patch to 0.9.9-dev and also test the server side implementation with an EAP-FAST server.
The current version of the patch seems to work fine with OpenSSL 0.9.9-dev snapshot 20070610 for EAP-FAST authentication with wpa_supplicant (EAP peer) and hostapd (EAP server). I moved some of the code from the old (0.9.8) version of the patch to new locations to match with the TLS extension code added in 0.9.9-dev. In addition, I fixed (or well, at least worked around) and issue with server side functionality by generating server_random prior to calling SessionTicket callback on the server side (the callback function needs this to be able to derive master secret). The generic looking ClientHello functions are now more specific to just SessionTicket extension. However, I did not yet rename the API functions or definitions since the current versions are used in wpa_supplicant and hostapd. Anyway, these could be renamed if the patch would otherwise be suitable for inclusion into OpenSSL. An example implementation using this implementation is available from http://w1.fi/ (wpa_supplicant and hostapd, the current development snapshot is needed for EAP-FAST server support). It would be nice to get this functionality included into OpenSSL so that and external patch would not be needed for this. Would someone have time to review the proposed patch? Any comments would be welcome. This patch adds support for TLS SessionTicket extension (RFC 4507) for the parts used by EAP-FAST (RFC 4851). This is based on the patch from Alexey Kobozev <[EMAIL PROTECTED]> (sent to openssl-dev mailing list on Tue, 07 Jun 2005 15:40:58 +0300). diff -uprN openssl-SNAP-20070610.orig/ssl/Makefile openssl-SNAP-20070610/ssl/Makefile --- openssl-SNAP-20070610.orig/ssl/Makefile 2006-04-08 07:01:27.000000000 -0700 +++ openssl-SNAP-20070610/ssl/Makefile 2007-06-11 12:35:33.000000000 -0700 @@ -24,7 +24,7 @@ LIBSRC= \ s2_meth.c s2_srvr.c s2_clnt.c s2_lib.c s2_enc.c s2_pkt.c \ s3_meth.c s3_srvr.c s3_clnt.c s3_lib.c s3_enc.c s3_pkt.c s3_both.c \ s23_meth.c s23_srvr.c s23_clnt.c s23_lib.c s23_pkt.c \ - t1_meth.c t1_srvr.c t1_clnt.c t1_lib.c t1_enc.c \ + t1_meth.c t1_srvr.c t1_clnt.c t1_lib.c t1_enc.c t1_ext.c \ d1_meth.c d1_srvr.c d1_clnt.c d1_lib.c d1_pkt.c \ d1_both.c d1_enc.c \ ssl_lib.c ssl_err2.c ssl_cert.c ssl_sess.c \ @@ -35,7 +35,7 @@ LIBOBJ= \ s2_meth.o s2_srvr.o s2_clnt.o s2_lib.o s2_enc.o s2_pkt.o \ s3_meth.o s3_srvr.o s3_clnt.o s3_lib.o s3_enc.o s3_pkt.o s3_both.o \ s23_meth.o s23_srvr.o s23_clnt.o s23_lib.o s23_pkt.o \ - t1_meth.o t1_srvr.o t1_clnt.o t1_lib.o t1_enc.o \ + t1_meth.o t1_srvr.o t1_clnt.o t1_lib.o t1_enc.o t1_ext.o \ d1_meth.o d1_srvr.o d1_clnt.o d1_lib.o d1_pkt.o \ d1_both.o d1_enc.o \ ssl_lib.o ssl_err2.o ssl_cert.o ssl_sess.o \ @@ -929,3 +929,4 @@ t1_srvr.o: ../include/openssl/ssl23.h .. t1_srvr.o: ../include/openssl/stack.h ../include/openssl/symhacks.h t1_srvr.o: ../include/openssl/tls1.h ../include/openssl/x509.h t1_srvr.o: ../include/openssl/x509_vfy.h ssl_locl.h t1_srvr.c +t1_ext.o: t1_ext.c ssl_locl.h diff -uprN openssl-SNAP-20070610.orig/ssl/s3_clnt.c openssl-SNAP-20070610/ssl/s3_clnt.c --- openssl-SNAP-20070610.orig/ssl/s3_clnt.c 2007-04-23 19:02:03.000000000 -0700 +++ openssl-SNAP-20070610/ssl/s3_clnt.c 2007-06-11 12:35:33.000000000 -0700 @@ -660,7 +660,7 @@ int ssl3_get_server_hello(SSL *s) STACK_OF(SSL_CIPHER) *sk; SSL_CIPHER *c; unsigned char *p,*d; - int i,al,ok; + int i,al,ok,pre_shared; unsigned int j; long n; #ifndef OPENSSL_NO_COMP @@ -727,7 +727,26 @@ int ssl3_get_server_hello(SSL *s) goto f_err; } - if (j != 0 && j == s->session->session_id_length + /* check if we want to resume the session based on external pre-shared secret */ + pre_shared = 0; +#ifndef OPENSSL_NO_TLSEXT + if (s->version >= TLS1_VERSION && s->tls_session_secret_cb) + { + SSL_CIPHER *pref_cipher=NULL; + s->session->master_key_length=sizeof(s->session->master_key); + if (s->tls_session_secret_cb(s, s->session->master_key, &s->session->master_key_length, + NULL, &pref_cipher, s->tls_session_secret_cb_arg)) + { + s->hit=1; + s->session->cipher=pref_cipher ? pref_cipher : ssl_get_cipher_by_char(s,p+j); + s->session->session_id_length = j; + memcpy(s->session->session_id, p, j); + pre_shared = 1; + } + } +#endif /* OPENSSL_NO_TLSEXT */ + + if ((pre_shared || j != 0) && j == s->session->session_id_length && memcmp(p,s->session->session_id,j) == 0) { if(s->sid_ctx_length != s->session->sid_ctx_length diff -uprN openssl-SNAP-20070610.orig/ssl/s3_srvr.c openssl-SNAP-20070610/ssl/s3_srvr.c --- openssl-SNAP-20070610.orig/ssl/s3_srvr.c 2007-04-23 19:02:03.000000000 -0700 +++ openssl-SNAP-20070610/ssl/s3_srvr.c 2007-06-11 12:35:33.000000000 -0700 @@ -947,6 +947,59 @@ int ssl3_get_client_hello(SSL *s) SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_CLIENTHELLO_TLSEXT); goto err; } + + /* Check if we want to use external pre-shared secret for this + * handshake for not reused session only. We need to generate + * server_random before calling tls_session_secret_cb in order to allow + * SessionTicket processing to use it in key derivation. */ + { + unsigned long Time; + unsigned char *pos; + Time=(unsigned long)time(NULL); /* Time */ + pos=s->s3->server_random; + l2n(Time,pos); + if (RAND_pseudo_bytes(pos,SSL3_RANDOM_SIZE-4) <= 0) + { + al=SSL_AD_INTERNAL_ERROR; + goto f_err; + } + } + + if (!s->hit && s->version >= TLS1_VERSION && s->tls_session_secret_cb) + { + SSL_CIPHER *pref_cipher=NULL; + + s->session->master_key_length=sizeof(s->session->master_key); + if(s->tls_session_secret_cb(s, s->session->master_key, &s->session->master_key_length, + ciphers, &pref_cipher, s->tls_session_secret_cb_arg)) + { + s->hit=1; + s->session->ciphers=ciphers; + s->session->verify_result=X509_V_OK; + + ciphers=NULL; + + /* check if some cipher was preferred by call back */ + pref_cipher=pref_cipher ? pref_cipher : ssl3_choose_cipher(s, s->session->ciphers, SSL_get_ciphers(s)); + if (pref_cipher == NULL) + { + al=SSL_AD_HANDSHAKE_FAILURE; + SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_NO_SHARED_CIPHER); + goto f_err; + } + + s->session->cipher=pref_cipher; + + if (s->cipher_list) + sk_SSL_CIPHER_free(s->cipher_list); + + if (s->cipher_list_by_id) + sk_SSL_CIPHER_free(s->cipher_list_by_id); + + s->cipher_list = sk_SSL_CIPHER_dup(s->session->ciphers); + s->cipher_list_by_id = sk_SSL_CIPHER_dup(s->session->ciphers); + } + } #endif /* Worst case, we will use the NULL compression, but if we have other @@ -1069,16 +1122,22 @@ int ssl3_send_server_hello(SSL *s) unsigned char *buf; unsigned char *p,*d; int i,sl; - unsigned long l,Time; + unsigned long l; +#ifdef OPENSSL_NO_TLSEXT + unsigned long Time; +#endif if (s->state == SSL3_ST_SW_SRVR_HELLO_A) { buf=(unsigned char *)s->init_buf->data; +#ifdef OPENSSL_NO_TLSEXT p=s->s3->server_random; + /* Generate server_random if it was not needed previously */ Time=(unsigned long)time(NULL); /* Time */ l2n(Time,p); if (RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-4) <= 0) return -1; +#endif /* Do the message type and length last */ d=p= &(buf[4]); diff -uprN openssl-SNAP-20070610.orig/ssl/ssl.h openssl-SNAP-20070610/ssl/ssl.h --- openssl-SNAP-20070610.orig/ssl/ssl.h 2007-06-07 07:02:54.000000000 -0700 +++ openssl-SNAP-20070610/ssl/ssl.h 2007-06-11 12:35:33.000000000 -0700 @@ -349,6 +349,7 @@ extern "C" { * 'struct ssl_st *' function parameters used to prototype callbacks * in SSL_CTX. */ typedef struct ssl_st *ssl_crock_st; +typedef struct tls_extension_st TLS_EXTENSION; /* used to hold info on the particular ciphers used */ typedef struct ssl_cipher_st @@ -375,6 +376,8 @@ DECLARE_STACK_OF(SSL_CIPHER) typedef struct ssl_st SSL; typedef struct ssl_ctx_st SSL_CTX; +typedef int (*tls_session_secret_cb_fn)(SSL *s, void *secret, int *secret_len, STACK_OF(SSL_CIPHER) *peer_ciphers, SSL_CIPHER **cipher, void *arg); + /* Used to hold functions for SSLv2 or SSLv3/TLSv1 functions */ typedef struct ssl_method_st { @@ -1069,6 +1072,16 @@ struct ssl_st size_t tlsext_ellipticcurvelist_length; unsigned char *tlsext_ellipticcurvelist; /* our list */ #endif /* OPENSSL_NO_EC */ + + /* TLS extensions */ + TLS_EXTENSION *tls_extension; + int (*tls_extension_cb)(SSL *s, TLS_EXTENSION *tls_ext, void *arg); + void *tls_extension_cb_arg; + + /* TLS pre-shared secret session resumption */ + tls_session_secret_cb_fn tls_session_secret_cb; + void *tls_session_secret_cb_arg; + SSL_CTX * initial_ctx; /* initial ctx, used to store sessions */ #define session_ctx initial_ctx #else @@ -1653,6 +1666,13 @@ void *SSL_COMP_get_compression_methods(v int SSL_COMP_add_compression_method(int id,void *cm); #endif +/* TLS extensions functions */ +int SSL_set_hello_extension(SSL *s, int ext_type, void *ext_data, int ext_len); +int SSL_set_hello_extension_cb(SSL *s, int (*cb)(SSL *, TLS_EXTENSION *, void *), void *arg); + +/* Pre-shared secret session resumption functions */ +int SSL_set_session_secret_cb(SSL *s, tls_session_secret_cb_fn tls_session_secret_cb, void *arg); + /* BEGIN ERROR CODES */ /* The following lines are auto generated by the script mkerr.pl. Any changes * made after this point may be overwritten when the script is next run. @@ -1845,6 +1865,7 @@ void ERR_load_SSL_strings(void); #define SSL_F_TLS1_PREPARE_SERVERHELLO_TLSEXT 276 #define SSL_F_TLS1_SETUP_KEY_BLOCK 211 #define SSL_F_WRITE_PENDING 212 +#define SSL_F_SSL_SET_HELLO_EXTENSION 213 /* Reason codes. */ #define SSL_R_APP_DATA_IN_HANDSHAKE 100 diff -uprN openssl-SNAP-20070610.orig/ssl/ssl_err.c openssl-SNAP-20070610/ssl/ssl_err.c --- openssl-SNAP-20070610.orig/ssl/ssl_err.c 2007-04-23 19:02:04.000000000 -0700 +++ openssl-SNAP-20070610/ssl/ssl_err.c 2007-06-11 12:35:33.000000000 -0700 @@ -253,6 +253,7 @@ static ERR_STRING_DATA SSL_str_functs[]= {ERR_FUNC(SSL_F_TLS1_PREPARE_SERVERHELLO_TLSEXT), "TLS1_PREPARE_SERVERHELLO_TLSEXT"}, {ERR_FUNC(SSL_F_TLS1_SETUP_KEY_BLOCK), "TLS1_SETUP_KEY_BLOCK"}, {ERR_FUNC(SSL_F_WRITE_PENDING), "WRITE_PENDING"}, +{ERR_FUNC(SSL_F_SSL_SET_HELLO_EXTENSION), "SSL_set_hello_extension"}, {0,NULL} }; diff -uprN openssl-SNAP-20070610.orig/ssl/ssl_sess.c openssl-SNAP-20070610/ssl/ssl_sess.c --- openssl-SNAP-20070610.orig/ssl/ssl_sess.c 2007-06-07 07:02:54.000000000 -0700 +++ openssl-SNAP-20070610/ssl/ssl_sess.c 2007-06-11 12:35:33.000000000 -0700 @@ -801,6 +801,17 @@ long SSL_CTX_get_timeout(const SSL_CTX * return(s->session_timeout); } +#ifndef OPENSSL_NO_TLSEXT +int SSL_set_session_secret_cb(SSL *s, int (*tls_session_secret_cb)(SSL *s, void *secret, int *secret_len, + STACK_OF(SSL_CIPHER) *peer_ciphers, SSL_CIPHER **cipher, void *arg), void *arg) +{ + if (s == NULL) return(0); + s->tls_session_secret_cb = tls_session_secret_cb; + s->tls_session_secret_cb_arg = arg; + return(1); +} +#endif /* OPENSSL_NO_TLSEXT */ + typedef struct timeout_param_st { SSL_CTX *ctx; diff -uprN openssl-SNAP-20070610.orig/ssl/t1_ext.c openssl-SNAP-20070610/ssl/t1_ext.c --- openssl-SNAP-20070610.orig/ssl/t1_ext.c 1969-12-31 16:00:00.000000000 -0800 +++ openssl-SNAP-20070610/ssl/t1_ext.c 2007-06-11 12:35:58.000000000 -0700 @@ -0,0 +1,51 @@ + +#include <stdio.h> +#include "ssl_locl.h" + +#ifndef OPENSSL_NO_TLSEXT + +int SSL_set_hello_extension(SSL *s, int ext_type, void *ext_data, int ext_len) +{ + if(s->version >= TLS1_VERSION) + { + if(s->tls_extension) + { + OPENSSL_free(s->tls_extension); + s->tls_extension = NULL; + } + + if(ext_data) + { + s->tls_extension = OPENSSL_malloc(sizeof(TLS_EXTENSION) + ext_len); + if(!s->tls_extension) + { + SSLerr(SSL_F_SSL_SET_HELLO_EXTENSION, ERR_R_MALLOC_FAILURE); + return 0; + } + + s->tls_extension->type = ext_type; + s->tls_extension->length = ext_len; + s->tls_extension->data = s->tls_extension + 1; + memcpy(s->tls_extension->data, ext_data, ext_len); + } + + return 1; + } + + return 0; +} + +int SSL_set_hello_extension_cb(SSL *s, int (*cb)(SSL *, TLS_EXTENSION *, void *), void *arg) +{ + if(s->version >= TLS1_VERSION) + { + s->tls_extension_cb = cb; + s->tls_extension_cb_arg = arg; + + return 1; + } + + return 0; +} + +#endif /* OPENSSL_NO_TLSEXT */ diff -uprN openssl-SNAP-20070610.orig/ssl/t1_lib.c openssl-SNAP-20070610/ssl/t1_lib.c --- openssl-SNAP-20070610.orig/ssl/t1_lib.c 2007-04-23 19:02:04.000000000 -0700 +++ openssl-SNAP-20070610/ssl/t1_lib.c 2007-06-11 12:35:33.000000000 -0700 @@ -145,6 +145,10 @@ int tls1_new(SSL *s) void tls1_free(SSL *s) { + if(s->tls_extension) + { + OPENSSL_free(s->tls_extension); + } ssl3_free(s); } @@ -196,6 +200,24 @@ unsigned char *ssl_add_clienthello_tlsex ret+=size_str; } + + if (s->version >= TLS1_VERSION && s->tls_extension) + { + /* Add TLS SessionTicket to the ClientHello message */ + long lenmax; + + if ((lenmax = limit - p - 4) < 0 + || s->tls_extension->length > (unsigned long)lenmax) + return NULL; + + /* extension type and length */ + s2n(s->tls_extension->type, ret); + s2n(s->tls_extension->length, ret); + + memcpy(ret, s->tls_extension->data, s->tls_extension->length); + ret+=s->tls_extension->length; + } + #ifndef OPENSSL_NO_EC if (s->tlsext_ecpointformatlist != NULL) { @@ -415,6 +437,23 @@ int ssl_parse_clienthello_tlsext(SSL *s, } + else if (type == TLSEXT_TYPE_session_ticket && + s->tls_extension_cb) + { + TLS_EXTENSION tls_ext; + tls_ext.type = type; + tls_ext.length = size; + tls_ext.data = data; + + /* returns an alert code or 0 */ + *al = s->tls_extension_cb(s, &tls_ext, s->tls_extension_cb_arg); + if (*al != 0) + { + SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,SSL_R_PEER_ERROR); + return 0; + } + } + #ifndef OPENSSL_NO_EC else if (type == TLSEXT_TYPE_ec_point_formats) { diff -uprN openssl-SNAP-20070610.orig/ssl/tls1.h openssl-SNAP-20070610/ssl/tls1.h --- openssl-SNAP-20070610.orig/ssl/tls1.h 2007-06-04 11:01:49.000000000 -0700 +++ openssl-SNAP-20070610/ssl/tls1.h 2007-06-11 12:35:33.000000000 -0700 @@ -192,6 +192,8 @@ extern "C" { #define TLSEXT_TYPE_status_request 5 #define TLSEXT_TYPE_elliptic_curves 10 #define TLSEXT_TYPE_ec_point_formats 11 +/* ExtensionType value from RFC 4507 */ +#define TLSEXT_TYPE_session_ticket 35 /* NameType value from RFC 3546 */ #define TLSEXT_NAMETYPE_host_name 0 @@ -456,6 +458,14 @@ SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TLSEXT_SER #define TLS_MD_MASTER_SECRET_CONST "\x6d\x61\x73\x74\x65\x72\x20\x73\x65\x63\x72\x65\x74" /*master secret*/ #endif +/* TLS extension struct */ +struct tls_extension_st +{ + unsigned short type; + unsigned short length; + void *data; +}; + #ifdef __cplusplus } #endif diff -uprN openssl-SNAP-20070610.orig/util/ssleay.num openssl-SNAP-20070610/util/ssleay.num --- openssl-SNAP-20070610.orig/util/ssleay.num 2006-11-30 06:01:18.000000000 -0800 +++ openssl-SNAP-20070610/util/ssleay.num 2007-06-11 12:35:33.000000000 -0700 @@ -249,3 +249,6 @@ SSL_get_servername SSL_get_servername_type 298 EXIST::FUNCTION:TLSEXT SSL_CTX_set_psk_server_callback 299 EXIST::FUNCTION:PSK SSL_get_psk_identity 300 EXIST::FUNCTION:PSK +SSL_set_hello_extension 301 EXIST::FUNCTION:TLSEXT +SSL_set_hello_extension_cb 302 EXIST::FUNCTION:TLSEXT +SSL_set_session_secret_cb 303 EXIST::FUNCTION:TLSEXT -- Jouni Malinen PGP id EFC895FA ______________________________________________________________________ OpenSSL Project http://www.openssl.org Development Mailing List openssl-dev@openssl.org Automated List Manager [EMAIL PROTECTED]
