<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">In upgrading from 1.0.1i to 1.0.1l I found an issue in the behaviour of a non-resumed EAP-FAST session.</div><div class=""><br class=""></div><div class="">RFC 4851 indicates that the server can go straight from the serverHello to changeCipherSpec to resume a session but can also fall back to a full handshake. With 1.0.1l the client ends up issuing an unexpected message alert if the server continues with its certificate message.</div><div class=""><br class=""></div><div class="">I traced this to the following change:</div><div class=""><br class=""></div><div class=""><div class=""> Set s->hit when resuming from external pre-shared secret.</div><div class=""><br class=""></div> <a href="https://github.com/openssl/openssl/commit/7b3ba508af5c86afe43e28174aa3c53a0a24f4d9" class="">https://github.com/openssl/openssl/commit/7b3ba508af5c86afe43e28174aa3c53a0a24f4d9</a></div><div class=""><br class=""></div><div class="">When processing the serverHello s->tls_session_secret_cb() is called to see if the client has a session secret, and if so the old code would set the flag that a CCS was acceptable at that point. However, the above change now also sets s->hit, which then “requires* that a finished message is expected next, triggering the alert otherwise.</div><div class=""><br class=""></div><div class="">Also, another change is suspect in that the latest code no longer sets the flag that a CCS is acceptable at that point:</div><div class=""><br class=""></div><div class=""> Ensure SSL3_FLAGS_CCS_OK (or d1->change_cipher_spec_ok for DTLS) is reset</div><div class=""><br class=""></div><div class=""> <a href="https://github.com/openssl/openssl/commit/e94a6c0ede623960728415b68650a595e48f5a43" class="">https://github.com/openssl/openssl/commit/e94a6c0ede623960728415b68650a595e48f5a43</a></div><div class=""><br class=""></div><div class="">In order for EAP-FAST to work it seems that if the client does have a tls_session_secret that s->hit must NOT be set since there is no indication in the serverHello as to whether the session_ticket sent by the client is accepted by the server (the sessionTicket extension is not sent by the server in EAP-FAST), and that SSL3_FLAGS_CCS_OK has to be set since the server MAY continue immediately with a changeCipherSpec.</div><div class=""><br class=""></div><div class=""> Thanks,</div><div class=""> Erik</div><div class=""><br class=""></div><div apple-content-edited="true" class=""><div class="" style="font-family: Arial; orphans: 2; text-align: -webkit-auto; widows: 2;"><span class="Apple-style-span" style="font-family: Arial, sans-serif; font-size: 13px;">....................................</span></div><div class="" style="font-family: Arial; orphans: 2; text-align: -webkit-auto; widows: 2;">Erik Tkal</div><div class="" style="font-family: Arial; orphans: 2; text-align: -webkit-auto; widows: 2;"><a href="mailto:etkal@cisco.com" class="">etkal@cisco.com</a></div><div class="" style="font-family: Arial; orphans: 2; text-align: -webkit-auto; widows: 2;"><br class=""></div></div></body></html>