Subject: [TLS] OpenSSL patch for draft-mrex-tls-secure-renegotiation-03.txt

From: Martin Rex <[email-masked]>
Date: Sun, 6 Dec 2009 05:00:50 +0100 (MET)

Hi,

I have built a patch for openssl-0.9.8-stable-SNAP-20091205
that implements my draft-mrex-tls-secure-renegotiation-03.txt

That OpenSSL code already contains incomplete code for the original EKR draft,
so I just reused the last finished messages in s->s3.

It's ~180 lines changed
(~120 LoC -- counting every curly brace as a line -- OpenSSL style).
that already includes a #else /* OPENSSL_NO_TLSEXT */ so that you get secure
renegotiation based on my draft even when compiling openssl without TLSEXT code.

And it could be slightly less, because the server and client can use the same code
for the modified handshake message hash (code reuse, less code paths to test).
I was to lazy to do that now, because I would have had to add a new function,
and made that function accessible from s3_srvr.c and s3_clnt.c. 

The handling of the MCSV is slightly tricky, because of how creation of
ClientHello.cipher_suites (on client) and parsing of ClientHello.cipher_suites (on server)
is modularized in OpenSSL (I did it in ssl_cipher_list_to_bytes() and
ssl_bytes_to_cipher_list() where the "SSL *s" handle is still available,
doing it at a lower level would require to change the function parameters
of the lower level functions).

So bottom line it is that my proposal means roughly less than half of the
code compared to an incomplete TLS extension RI implementation
for a codebase that already contains TLS extensions code.

For a codebase without TLS extensions, the gap is larger.

Could it be that OpenSSL has run out of "OP" flags?

Having that ALLOW_UNSAFE_LEGACY_RENEGOTIATION flag in the SSL_OP_ALL set
which is described as "workarounds that should be rather harmless"
sounds dangerous.  SSL_OP_ALL is likely asserted by all servers. 

  #define SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION	0x00000400L

  /* Disable SSL 3.0/TLS 1.0 CBC vulnerability workaround that was added
   * in OpenSSL 0.9.6d.  Usually (depending on the application protocol)
   * the workaround is not needed.  Unfortunately some broken SSL/TLS
   * implementations cannot handle it at all, which is why we include
   * it in SSL_OP_ALL. */

  /* SSL_OP_ALL: various bug workarounds that should be rather harmless.
   *             This used to be 0x000FFFFFL before 0.9.7. */
  #define SSL_OP_ALL					0x00000FFFL

-Martin