mainGnuTLS - Support: sr #108146, gnutls client tls library not...

 
 

sr #108146: gnutls client tls library not supporting session ticket renewing and aborting

Submitter:  Daniel Black <danblack>
Submitted:  Sun 30 Sep 2012 06:08:35 AM UTC
   
 
Category:  Core library Priority:  5 - Normal
Severity:  4 - Important Status:  Ready For Test
Privacy:  Public Assigned to:  nmav
Open/Closed:  Closed Operating System:  GNU/Linux
* Mandatory Fields

Add a New Comment Rich Markup
   

Mon 01 Oct 2012 01:18:19 AM UTC, comment #3: 

thanks for the quick fix. Looked fairly extensive.

Daniel Black <danblack>
Sun 30 Sep 2012 11:17:11 AM UTC, comment #2: 

Thank you for reporting that and for the test site. This is indeed a bug in gnutls. It does not handle session tickets when received during resumption, and even worse it terminates the handshake when it sees them.

I committed a fix for the 3.0.x releases at:
http://git.savannah.gnu.org/gitweb/?p=gnutls.git;a=commitdiff;h=52f373cdf26d50e05f5dd49e4ecc8b29fc742535


Nikos Mavrogiannopoulos <nmav>
Group administrator
Sun 30 Sep 2012 06:13:33 AM UTC, comment #1: 

correction: was rfc5077 3.3 paragraph 2

Daniel Black <danblack>
Sun 30 Sep 2012 06:08:35 AM UTC, original submission:  

RFC5077 3.4 paragraph two allows for renewing session tickets.

I've used the openssl SSL_CTX_set_tlsext_ticket_key_cb returning the value 2 to perform a renew of the session ticket the following implementation in nginx.
http://trac.nginx.org/nginx/ticket/120

I've setup a test site with 20 seconds expiry on session tickets and it attempts to renew the session ticket after 10 seconds.

A thin client program using is here:
https://github.com/grooverdan/rfc5077

running the following generates:

$ ./gnutls-client -r -r -r -d 15  nginxtest.openquery.com 443
[✔] Parse arguments.
[✔] Initialize GNU TLS library.
[✔] Solve nginxtest.openquery.com:443:
    │ Will connect to 173.230.149.19
[✔] Initialize TLS session.
[✔] Enable use of session tickets (RFC 5077).
[✔] Connect to nginxtest.openquery.com:443.
[✔] Start TLS renegotiation.
[✔] Check if session was reused:
    │ SSL session was not used
[✔] Get current session:
    │ Session context:
    │ Protocol : TLS1.2
    │ Cipher : AES-128-CBC
    │ Kx : RSA
    │ Compression : NULL
    │ PSK : (null)
    │ ID : D589B43480B198100389F2223D4FC3EA162E6402AD53D03A16509D6155D57FDD
[✔] Send HTTP GET.
[✔] Get HTTP answer:
    │ HTTP/1.1 200 OK
[✔] End TLS connection.
[✔] waiting 15 seconds.
[✔] Initialize TLS session.
[✔] Enable use of session tickets (RFC 5077).
[✔] Copy old session.
[✔] Connect to nginxtest.openquery.com:443.
[✘] Start TLS renegotiation:
    │ Unable to start TLS renegotiation:
    │ An unexpected TLS packet was received.

This was running with gnutls version 2.12.17

Daniel Black <danblack>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by nmav (Posted a comment)
  • -email is unavailable- added by danblack (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-02-06 nmav Open/ClosedOpen Closed
    2012-09-30 nmav StatusNone Ready For Test
        Assigned toNone nmav

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code