Adding SSL_set_session_creation_enabled for SSLSocket.setEnableSessionCreation(false) support
SSL_set_session_creation_enabled implementation
Add session_creation_enabled to ssl_st (aka SSL)
Add SSL_set_session_creation_enabled(SSL*, int) declaration
Add SSL_R_SESSION_MAY_NOT_BE_CREATED error reason
include/openssl/ssl.h
ssl/ssl.h
Before creating session, check if session_creation_enabled.
If not, error out, sending alert when possible in SSL3+ cases.
ssl/d1_clnt.c
ssl/s23_clnt.c
ssl/s3_clnt.c
ssl/s3_srvr.c
Add error message for SSL_R_SESSION_MAY_NOT_BE_CREATED
ssl/ssl_err.c
Initialize session_creation_enabled to 1 in SSL_new
ssl/ssl_lib.c
Definition of SSL_set_session_creation_enabled. Add lower level
check for session_creation_enabled in ssl_get_new_session in case
it is not caught by higher levels.
ssl/ssl_sess.c
Patch details
Added jsse.patch to list and add list of patched files.
Fix whitespace to be tabs for consistency.
openssl.config
Add description of jsse.patch
patches/README
The patch itself, containing the above described changes
patches/jsse.patch
Testing
Updated with note to run javax.net.ssl tests now that they are working reliably.
README.android
Change-Id: I21763ffbb29278b1c2d88d947eb780f38f637b2d
diff --git a/README.android b/README.android
index 04b6753..f6b92c3 100644
--- a/README.android
+++ b/README.android
@@ -51,6 +51,7 @@
(cd android.testssl/ && ./testssl.sh)
adb shell run-core-tests tests.xnet.AllTests
+ adb shell run-core-tests javax.net.ssl.AllTests
adb shell run-core-tests org.apache.harmony.math.tests.java.math.AllTests
adb shell run-core-tests tests.api.java.math.BigIntegerTest
adb shell am start https://online.citibank.com # confirm result in browser
diff --git a/include/openssl/ssl.h b/include/openssl/ssl.h
index a05c90f..e48f42e 100644
--- a/include/openssl/ssl.h
+++ b/include/openssl/ssl.h
@@ -1090,6 +1090,9 @@
/* This can also be in the session once a session is established */
SSL_SESSION *session;
+ /* This can be disabled to prevent the use of uncached sessions */
+ int session_creation_enabled;
+
/* Default generate session ID callback. */
GEN_SESSION_CB generate_session_id;
@@ -1568,6 +1571,7 @@
void SSL_SESSION_free(SSL_SESSION *ses);
int i2d_SSL_SESSION(SSL_SESSION *in,unsigned char **pp);
int SSL_set_session(SSL *to, SSL_SESSION *session);
+void SSL_set_session_creation_enabled(SSL *, int);
int SSL_CTX_add_session(SSL_CTX *s, SSL_SESSION *c);
int SSL_CTX_remove_session(SSL_CTX *,SSL_SESSION *c);
int SSL_CTX_set_generate_session_id(SSL_CTX *, GEN_SESSION_CB);
@@ -2213,6 +2217,7 @@
#define SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING 345
#define SSL_R_SERVERHELLO_TLSEXT 275
#define SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED 277
+#define SSL_R_SESSION_MAY_NOT_BE_CREATED 2000
#define SSL_R_SHORT_READ 219
#define SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE 220
#define SSL_R_SSL23_DOING_SESSION_ID_REUSE 221
diff --git a/openssl.config b/openssl.config
index 0f98001..4328101 100644
--- a/openssl.config
+++ b/openssl.config
@@ -1,6 +1,6 @@
CONFIGURE_ARGS="\
- linux-generic32 \
- no-idea no-bf no-cast no-seed no-md2 no-whrlpool \
+ linux-generic32 \
+ no-idea no-bf no-cast no-seed no-md2 no-whrlpool \
-DL_ENDIAN"
# unneeded directories
@@ -38,7 +38,7 @@
CHANGES \
CHANGES.SSLeay \
ChangeLog.0_9_7-stable_not-in-head \
- ChangeLog.0_9_7-stable_not-in-head_FIPS \
+ ChangeLog.0_9_7-stable_not-in-head_FIPS \
Configure \
FAQ \
INSTALL \
@@ -163,28 +163,40 @@
progs.patch \
small_records.patch \
handshake_cutthrough.patch \
+ jsse.patch \
"
OPENSSL_PATCHES_progs_SOURCES="\
- apps/progs.h \
+ apps/progs.h \
apps/speed.c"
OPENSSL_PATCHES_handshake_cutthrough_SOURCES="\
- apps/s_client.c \
- ssl/s3_clnt.c \
- ssl/s3_lib.c \
- ssl/ssl.h \
- ssl/ssl3.h \
- ssl/ssl_lib.c \
- ssl/ssltest.c \
+ apps/s_client.c \
+ ssl/s3_clnt.c \
+ ssl/s3_lib.c \
+ ssl/ssl.h \
+ ssl/ssl3.h \
+ ssl/ssl_lib.c \
+ ssl/ssltest.c \
test/testssl"
OPENSSL_PATCHES_small_records_SOURCES="\
- ssl/d1_pkt.c \
- ssl/s23_srvr.c \
- ssl/s3_both.c \
- ssl/s3_pkt.c \
- ssl/ssl.h \
- ssl/ssl3.h \
- ssl/ssltest.c \
+ ssl/d1_pkt.c \
+ ssl/s23_srvr.c \
+ ssl/s3_both.c \
+ ssl/s3_pkt.c \
+ ssl/ssl.h \
+ ssl/ssl3.h \
+ ssl/ssltest.c \
test/testssl"
+
+OPENSSL_PATCHES_jsse_SOURCES="\
+ ssl/ssl.h \
+ ssl/d1_clnt.c \
+ ssl/s23_clnt.c \
+ ssl/s3_clnt.c \
+ ssl/s3_srvr.c \
+ ssl/ssl_err.c \
+ ssl/ssl_lib.c \
+ ssl/ssl_sess.c \
+"
diff --git a/patches/README b/patches/README
index 856f18a..4b182dd 100644
--- a/patches/README
+++ b/patches/README
@@ -21,3 +21,9 @@
Finished message even when negotiating full-handshakes. With this patch,
clients can negotiate SSL connections in 1-RTT even when performing
full-handshakes.
+
+jsse.patch
+
+Support for JSSE implementation based on OpenSSL.
+
+
diff --git a/patches/jsse.patch b/patches/jsse.patch
new file mode 100644
index 0000000..f1c14a8
--- /dev/null
+++ b/patches/jsse.patch
@@ -0,0 +1,158 @@
+--- openssl-1.0.0.orig/ssl/ssl.h 2010-01-06 09:37:38.000000000 -0800
++++ openssl-1.0.0/ssl/ssl.h 2010-05-03 01:44:52.000000000 -0700
+@@ -1083,6 +1090,9 @@ struct ssl_st
+ /* This can also be in the session once a session is established */
+ SSL_SESSION *session;
+
++ /* This can be disabled to prevent the use of uncached sessions */
++ int session_creation_enabled;
++
+ /* Default generate session ID callback. */
+ GEN_SESSION_CB generate_session_id;
+
+@@ -1559,6 +1571,7 @@ int SSL_SESSION_print(BIO *fp,const SSL_
+ void SSL_SESSION_free(SSL_SESSION *ses);
+ int i2d_SSL_SESSION(SSL_SESSION *in,unsigned char **pp);
+ int SSL_set_session(SSL *to, SSL_SESSION *session);
++void SSL_set_session_creation_enabled(SSL *, int);
+ int SSL_CTX_add_session(SSL_CTX *s, SSL_SESSION *c);
+ int SSL_CTX_remove_session(SSL_CTX *,SSL_SESSION *c);
+ int SSL_CTX_set_generate_session_id(SSL_CTX *, GEN_SESSION_CB);
+@@ -2204,6 +2217,7 @@ void ERR_load_SSL_strings(void);
+ #define SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING 345
+ #define SSL_R_SERVERHELLO_TLSEXT 275
+ #define SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED 277
++#define SSL_R_SESSION_MAY_NOT_BE_CREATED 2000
+ #define SSL_R_SHORT_READ 219
+ #define SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE 220
+ #define SSL_R_SSL23_DOING_SESSION_ID_REUSE 221
+--- openssl-1.0.0.orig/ssl/d1_clnt.c 2010-01-26 11:46:29.000000000 -0800
++++ openssl-1.0.0/ssl/d1_clnt.c 2010-05-03 01:44:52.000000000 -0700
+@@ -613,6 +613,12 @@ int dtls1_client_hello(SSL *s)
+ #endif
+ (s->session->not_resumable))
+ {
++ if (!s->session_creation_enabled)
++ {
++ ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE);
++ SSLerr(SSL_F_DTLS1_CLIENT_HELLO,SSL_R_SESSION_MAY_NOT_BE_CREATED);
++ goto err;
++ }
+ if (!ssl_get_new_session(s,0))
+ goto err;
+ }
+--- openssl-1.0.0.orig/ssl/s23_clnt.c 2010-02-16 06:20:40.000000000 -0800
++++ openssl-1.0.0/ssl/s23_clnt.c 2010-05-03 01:44:52.000000000 -0700
+@@ -687,6 +687,13 @@ static int ssl23_get_server_hello(SSL *s
+
+ /* Since, if we are sending a ssl23 client hello, we are not
+ * reusing a session-id */
++ if (!s->session_creation_enabled)
++ {
++ if (!(s->client_version == SSL2_VERSION))
++ ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE);
++ SSLerr(SSL_F_SSL23_GET_SERVER_HELLO,SSL_R_SESSION_MAY_NOT_BE_CREATED);
++ goto err;
++ }
+ if (!ssl_get_new_session(s,0))
+ goto err;
+
+--- openssl-1.0.0.orig/ssl/s3_clnt.c 2010-02-27 16:24:24.000000000 -0800
++++ openssl-1.0.0/ssl/s3_clnt.c 2010-05-03 01:44:52.000000000 -0700
+@@ -621,6 +668,12 @@ int ssl3_client_hello(SSL *s)
+ #endif
+ (sess->not_resumable))
+ {
++ if (!s->session_creation_enabled)
++ {
++ ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE);
++ SSLerr(SSL_F_SSL3_CLIENT_HELLO,SSL_R_SESSION_MAY_NOT_BE_CREATED);
++ goto err;
++ }
+ if (!ssl_get_new_session(s,0))
+ goto err;
+ }
+@@ -829,6 +882,12 @@ int ssl3_get_server_hello(SSL *s)
+ s->hit=0;
+ if (s->session->session_id_length > 0)
+ {
++ if (!s->session_creation_enabled)
++ {
++ ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE);
++ SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_SESSION_MAY_NOT_BE_CREATED);
++ goto err;
++ }
+ if (!ssl_get_new_session(s,0))
+ {
+ al=SSL_AD_INTERNAL_ERROR;
+--- openssl-1.0.0.orig/ssl/s3_srvr.c 2010-02-27 15:04:10.000000000 -0800
++++ openssl-1.0.0/ssl/s3_srvr.c 2010-05-03 01:44:52.000000000 -0700
+@@ -869,6 +869,12 @@ int ssl3_get_client_hello(SSL *s)
+ */
+ if ((s->new_session && (s->options & SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION)))
+ {
++ if (!s->session_creation_enabled)
++ {
++ ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE);
++ SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_SESSION_MAY_NOT_BE_CREATED);
++ goto err;
++ }
+ if (!ssl_get_new_session(s,1))
+ goto err;
+ }
+@@ -883,6 +889,12 @@ int ssl3_get_client_hello(SSL *s)
+ goto err;
+ else /* i == 0 */
+ {
++ if (!s->session_creation_enabled)
++ {
++ ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE);
++ SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_SESSION_MAY_NOT_BE_CREATED);
++ goto err;
++ }
+ if (!ssl_get_new_session(s,1))
+ goto err;
+ }
+--- openssl-1.0.0.orig/ssl/ssl_err.c 2010-01-06 09:37:38.000000000 -0800
++++ openssl-1.0.0/ssl/ssl_err.c 2010-05-03 01:44:52.000000000 -0700
+@@ -462,6 +462,7 @@ static ERR_STRING_DATA SSL_str_reasons[]
+ {ERR_REASON(SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING),"scsv received when renegotiating"},
+ {ERR_REASON(SSL_R_SERVERHELLO_TLSEXT) ,"serverhello tlsext"},
+ {ERR_REASON(SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED),"session id context uninitialized"},
++{ERR_REASON(SSL_R_SESSION_MAY_NOT_BE_CREATED),"session may not be created"},
+ {ERR_REASON(SSL_R_SHORT_READ) ,"short read"},
+ {ERR_REASON(SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE),"signature for non signing certificate"},
+ {ERR_REASON(SSL_R_SSL23_DOING_SESSION_ID_REUSE),"ssl23 doing session id reuse"},
+--- openssl-1.0.0.orig/ssl/ssl_lib.c 2010-02-17 11:43:46.000000000 -0800
++++ openssl-1.0.0/ssl/ssl_lib.c 2010-05-03 01:44:52.000000000 -0700
+@@ -326,6 +326,7 @@ SSL *SSL_new(SSL_CTX *ctx)
+ OPENSSL_assert(s->sid_ctx_length <= sizeof s->sid_ctx);
+ memcpy(&s->sid_ctx,&ctx->sid_ctx,sizeof(s->sid_ctx));
+ s->verify_callback=ctx->default_verify_callback;
++ s->session_creation_enabled=1;
+ s->generate_session_id=ctx->generate_session_id;
+
+ s->param = X509_VERIFY_PARAM_new();
+--- openssl-1.0.0.orig/ssl/ssl_sess.c 2010-02-01 08:49:42.000000000 -0800
++++ openssl-1.0.0/ssl/ssl_sess.c 2010-05-03 01:44:52.000000000 -0700
+@@ -261,6 +261,11 @@ static int def_generate_session_id(const
+ return 0;
+ }
+
++void SSL_set_session_creation_enabled (SSL *s, int creation_enabled)
++ {
++ s->session_creation_enabled = creation_enabled;
++ }
++
+ int ssl_get_new_session(SSL *s, int session)
+ {
+ /* This gets used by clients and servers. */
+@@ -269,6 +274,8 @@ int ssl_get_new_session(SSL *s, int sess
+ SSL_SESSION *ss=NULL;
+ GEN_SESSION_CB cb = def_generate_session_id;
+
++ /* caller should check this if they can do better error handling */
++ if (!s->session_creation_enabled) return(0);
+ if ((ss=SSL_SESSION_new()) == NULL) return(0);
+
+ /* If the context has a default timeout, use it */
diff --git a/ssl/d1_clnt.c b/ssl/d1_clnt.c
index 5bc9eb6..aabbef8 100644
--- a/ssl/d1_clnt.c
+++ b/ssl/d1_clnt.c
@@ -613,6 +613,12 @@
#endif
(s->session->not_resumable))
{
+ if (!s->session_creation_enabled)
+ {
+ ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE);
+ SSLerr(SSL_F_DTLS1_CLIENT_HELLO,SSL_R_SESSION_MAY_NOT_BE_CREATED);
+ goto err;
+ }
if (!ssl_get_new_session(s,0))
goto err;
}
diff --git a/ssl/s23_clnt.c b/ssl/s23_clnt.c
index c4d8bf2..f41fe3a 100644
--- a/ssl/s23_clnt.c
+++ b/ssl/s23_clnt.c
@@ -687,6 +687,13 @@
/* Since, if we are sending a ssl23 client hello, we are not
* reusing a session-id */
+ if (!s->session_creation_enabled)
+ {
+ if (!(s->client_version == SSL2_VERSION))
+ ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE);
+ SSLerr(SSL_F_SSL23_GET_SERVER_HELLO,SSL_R_SESSION_MAY_NOT_BE_CREATED);
+ goto err;
+ }
if (!ssl_get_new_session(s,0))
goto err;
diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index 6bff3cc..1bca966 100644
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -668,6 +668,12 @@
#endif
(sess->not_resumable))
{
+ if (!s->session_creation_enabled)
+ {
+ ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE);
+ SSLerr(SSL_F_SSL3_CLIENT_HELLO,SSL_R_SESSION_MAY_NOT_BE_CREATED);
+ goto err;
+ }
if (!ssl_get_new_session(s,0))
goto err;
}
@@ -876,6 +882,12 @@
s->hit=0;
if (s->session->session_id_length > 0)
{
+ if (!s->session_creation_enabled)
+ {
+ ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE);
+ SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_SESSION_MAY_NOT_BE_CREATED);
+ goto err;
+ }
if (!ssl_get_new_session(s,0))
{
al=SSL_AD_INTERNAL_ERROR;
diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c
index 92f73b6..0d3b536 100644
--- a/ssl/s3_srvr.c
+++ b/ssl/s3_srvr.c
@@ -869,6 +869,12 @@
*/
if ((s->new_session && (s->options & SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION)))
{
+ if (!s->session_creation_enabled)
+ {
+ ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE);
+ SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_SESSION_MAY_NOT_BE_CREATED);
+ goto err;
+ }
if (!ssl_get_new_session(s,1))
goto err;
}
@@ -883,6 +889,12 @@
goto err;
else /* i == 0 */
{
+ if (!s->session_creation_enabled)
+ {
+ ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE);
+ SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_SESSION_MAY_NOT_BE_CREATED);
+ goto err;
+ }
if (!ssl_get_new_session(s,1))
goto err;
}
diff --git a/ssl/ssl.h b/ssl/ssl.h
index a05c90f..e48f42e 100644
--- a/ssl/ssl.h
+++ b/ssl/ssl.h
@@ -1090,6 +1090,9 @@
/* This can also be in the session once a session is established */
SSL_SESSION *session;
+ /* This can be disabled to prevent the use of uncached sessions */
+ int session_creation_enabled;
+
/* Default generate session ID callback. */
GEN_SESSION_CB generate_session_id;
@@ -1568,6 +1571,7 @@
void SSL_SESSION_free(SSL_SESSION *ses);
int i2d_SSL_SESSION(SSL_SESSION *in,unsigned char **pp);
int SSL_set_session(SSL *to, SSL_SESSION *session);
+void SSL_set_session_creation_enabled(SSL *, int);
int SSL_CTX_add_session(SSL_CTX *s, SSL_SESSION *c);
int SSL_CTX_remove_session(SSL_CTX *,SSL_SESSION *c);
int SSL_CTX_set_generate_session_id(SSL_CTX *, GEN_SESSION_CB);
@@ -2213,6 +2217,7 @@
#define SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING 345
#define SSL_R_SERVERHELLO_TLSEXT 275
#define SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED 277
+#define SSL_R_SESSION_MAY_NOT_BE_CREATED 2000
#define SSL_R_SHORT_READ 219
#define SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE 220
#define SSL_R_SSL23_DOING_SESSION_ID_REUSE 221
diff --git a/ssl/ssl_err.c b/ssl/ssl_err.c
index 0eed464..34f7db7 100644
--- a/ssl/ssl_err.c
+++ b/ssl/ssl_err.c
@@ -462,6 +462,7 @@
{ERR_REASON(SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING),"scsv received when renegotiating"},
{ERR_REASON(SSL_R_SERVERHELLO_TLSEXT) ,"serverhello tlsext"},
{ERR_REASON(SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED),"session id context uninitialized"},
+{ERR_REASON(SSL_R_SESSION_MAY_NOT_BE_CREATED),"session may not be created"},
{ERR_REASON(SSL_R_SHORT_READ) ,"short read"},
{ERR_REASON(SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE),"signature for non signing certificate"},
{ERR_REASON(SSL_R_SSL23_DOING_SESSION_ID_REUSE),"ssl23 doing session id reuse"},
diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
index fc2a227..a594b79 100644
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -326,6 +326,7 @@
OPENSSL_assert(s->sid_ctx_length <= sizeof s->sid_ctx);
memcpy(&s->sid_ctx,&ctx->sid_ctx,sizeof(s->sid_ctx));
s->verify_callback=ctx->default_verify_callback;
+ s->session_creation_enabled=1;
s->generate_session_id=ctx->generate_session_id;
s->param = X509_VERIFY_PARAM_new();
diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c
index 8e5d8a0..93954e4 100644
--- a/ssl/ssl_sess.c
+++ b/ssl/ssl_sess.c
@@ -261,6 +261,11 @@
return 0;
}
+void SSL_set_session_creation_enabled (SSL *s, int creation_enabled)
+ {
+ s->session_creation_enabled = creation_enabled;
+ }
+
int ssl_get_new_session(SSL *s, int session)
{
/* This gets used by clients and servers. */
@@ -269,6 +274,8 @@
SSL_SESSION *ss=NULL;
GEN_SESSION_CB cb = def_generate_session_id;
+ /* caller should check this if they can do better error handling */
+ if (!s->session_creation_enabled) return(0);
if ((ss=SSL_SESSION_new()) == NULL) return(0);
/* If the context has a default timeout, use it */
