OpenSSL 0.9.8za added a fix for CVE-2014-0224 and the original fix broke
EAP-FAST support due to forgotten SSL3_FLAGS_CCS_OK marking for
tls_session_secret_cb. Fix for this regression was added into OpenSSL
1.x and newer. The same fix is needed in this backport patch for
0.9.8za.
Signed-off-by: Jouni Malinen <j@w1.fi>
The 0.9.9 branch was for development purposes only, so no one should be
using that in production and there is not much point in maintaining the
obsolete patch here either. Similarly, the old 0.9.8 versions are
obsolete at this point in time and taken into account the recent OpenSSL
vulnerabilities, anything older than 0.9.8za should not really be used.
Prepare an updated version of the TLS session ticket patch based on the
current OpenSSL 0.9.8za release and remove all the older TLS extension
patches.
Signed-off-by: Jouni Malinen <j@w1.fi>
The older patch for 0.9.8i does not apply cleanly, so add an updated
version that can be used with the current OpenSSL 0.9.8 release.
Signed-hostap: Jouni Malinen <j@w1.fi>
The patch for 0.9.9 was merged into the upstream OpenSSL 0.9.9 tree and
is not needed for EAP-FAST support with that OpenSSL version. The patch
for 0.9.8i is now using the same API that was included in 0.9.9.
This is the first step in replacing SSL_set_hello_extension() with a new
SSL_set_session_ticket_ext() function that can only be used to override the
session ticket extension, not any arbitrary TLS extension.
SSL_set_hello_extension() is still present as a simple wrapper in this
version to avoid changing the API and to make testing with wpa_supplicant
and hostapd easier. It can be eventually removed when the patch is going in
into OpenSSL distribution.
This reverts the addition of ssl3_digest_cached_records() call from the
previous update (3d1aa251a3) since OpenSSL
has apparently reverted some earlier changes that broke EAP-FAST.
sssleay.num had changed (new function allocated) and server code was
modified to call ssl3_digest_cached_records() in the start of abbreviated
handshake to avoid possible segmentation faults later in some cases when
reverting to full handshake. In addition, there is some whitespace cleanup
and added comment explaining TLS ticket processing.
The TLS client changes in ssl3_get_server_hello() were based on the
pre-RFC 5077 version of OpenSSL and they hardcoded s->hit to 1 in case
PAC-Opaque was used. This prevented fallback to full TLS handshake in case
the server rejected PAC-Opaque in ClientHello. The fixed version simplifies
ssl3_get_server_hello() and uses the new RFC 5077 functionality in OpenSSL
(ssl3_check_finished) to allow the state machine handle start of
abbreviated handshake based on the used ticket.
The TLS client changes in ssl3_get_server_hello() were based on the
pre-RFC 5077 version of OpenSSL and they hardcoded s->hit to 1 in case
PAC-Opaque was used. This prevented fallback to full TLS handshake in case
the server rejected PAC-Opaque in ClientHello. The fixed version simplifies
ssl3_get_server_hello() and uses the new RFC 5077 functionality in OpenSSL
(ssl3_check_finished) to allow the state machine handle start of
abbreviated handshake based on the used ticket.
