helpGnuTLS - Support: sr #108146, gnutls client tls library not...

 
 

sr #108146: gnutls client tls library not supporting session ticket renewing and aborting

Submitted by:  Daniel Black <danblack>
Submitted on:  Sun 30 Sep 2012 06:08:35 AM UTC  
 
Category: Core libraryPriority: 5 - Normal
Severity: 4 - ImportantStatus: Ready For Test
Privacy: PublicAssigned to: Nikos Mavrogiannopoulos <nmav>
Open/Closed: ClosedOperating System: GNU/Linux

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 01 Oct 2012 01:18:19 AM UTC, comment #3:

thanks for the quick fix. Looked fairly extensive.

Daniel Black <danblack>
Sun 30 Sep 2012 11:17:11 AM UTC, comment #2:

Thank you for reporting that and for the test site. This is indeed a bug in gnutls. It does not handle session tickets when received during resumption, and even worse it terminates the handshake when it sees them.

I committed a fix for the 3.0.x releases at:
http://git.savannah.gnu.org/gitweb/?p=gnutls.git;a=commitdiff;h=52f373cdf26d50e05f5dd49e4ecc8b29fc742535

Nikos Mavrogiannopoulos <nmav>
Project AdministratorIn charge of this item.
Sun 30 Sep 2012 06:13:33 AM UTC, comment #1:

correction: was rfc5077 3.3 paragraph 2

Daniel Black <danblack>
Sun 30 Sep 2012 06:08:35 AM UTC, original submission:

RFC5077 3.4 paragraph two allows for renewing session tickets.

I've used the openssl SSL_CTX_set_tlsext_ticket_key_cb returning the value 2 to perform a renew of the session ticket the following implementation in nginx.
http://trac.nginx.org/nginx/ticket/120

I've setup a test site with 20 seconds expiry on session tickets and it attempts to renew the session ticket after 10 seconds.

A thin client program using is here:
https://github.com/grooverdan/rfc5077

running the following generates:

$ ./gnutls-client -r -r -r -d 15 nginxtest.openquery.com 443
[✔] Parse arguments.
[✔] Initialize GNU TLS library.
[✔] Solve nginxtest.openquery.com:443:
│ Will connect to 173.230.149.19
[✔] Initialize TLS session.
[✔] Enable use of session tickets (RFC 5077).
[✔] Connect to nginxtest.openquery.com:443.
[✔] Start TLS renegotiation.
[✔] Check if session was reused:
│ SSL session was not used
[✔] Get current session:
│ Session context:
│ Protocol : TLS1.2
│ Cipher : AES-128-CBC
│ Kx : RSA
│ Compression : NULL
│ PSK : (null)
│ ID : D589B43480B198100389F2223D4FC3EA162E6402AD53D03A16509D6155D57FDD
[✔] Send HTTP GET.
[✔] Get HTTP answer:
│ HTTP/1.1 200 OK
[✔] End TLS connection.
[✔] waiting 15 seconds.
[✔] Initialize TLS session.
[✔] Enable use of session tickets (RFC 5077).
[✔] Copy old session.
[✔] Connect to nginxtest.openquery.com:443.
[✘] Start TLS renegotiation:
│ Unable to start TLS renegotiation:
│ An unexpected TLS packet was received.

This was running with gnutls version 2.12.17

Daniel Black <danblack>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by nmav (Posted a comment)
  • -unavailable- added by danblack (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 3 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 06 Feb 2014 09:56:15 AM UTCnmavOpen/ClosedOpen=>Closed
    Sun 30 Sep 2012 11:17:11 AM UTCnmavStatusNone=>Ready For Test
      Assigned toNone=>nmav

    Back to the top


    Powered by Savane 3.1-cleanup