Introduce ticket support. To enable them it is enough to set a positive

lifetime with tls_config_set_session_lifetime(). This enables tickets
and uses an internal automatic rekeying mode for the ticket keys.

If multiple processes are involved the following functions can be used to make
tickets work accross all instances:
- tls_config_set_session_id() sets the session identifier
- tls_config_add_ticket_key() adds an encryption and authentication key

For now only the last 4 keys added will be used (unless they are too old).
If tls_config_add_ticket_key() is used the caller must ensure to add new keys
regularly. It is best to do this 4 times per session lifetime (which is also
the ticket key lifetime).

Since tickets break PFS it is best to minimize the session lifetime according
to needs.

With a lot of help, input and OK beck@, jsing@

6 files changed, 251 insertions, 14 deletions

diff --git a/src/lib/libtls/Symbols.list b/src/lib/libtls/Symbols.list
index 7ed1d58bdc..a033e3e242 100644
--- a/src/lib/libtls/Symbols.list
+++ b/src/lib/libtls/Symbols.list
@@ -5,6 +5,7 @@ tls_client
 tls_close
 tls_config_add_keypair_file
 tls_config_add_keypair_mem
+tls_config_add_ticket_key
 tls_config_clear_keys
 tls_config_error
 tls_config_free
@@ -32,6 +33,8 @@ tls_config_set_keypair_mem
 tls_config_set_ocsp_staple_mem
 tls_config_set_ocsp_staple_file
 tls_config_set_protocols
+tls_config_set_session_id
+tls_config_set_session_lifetime
 tls_config_set_verify_depth
 tls_config_verify
 tls_config_verify_client
diff --git a/src/lib/libtls/tls.h b/src/lib/libtls/tls.h
index 645204a170..25d7c258e7 100644
--- a/src/lib/libtls/tls.h
+++ b/src/lib/libtls/tls.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls.h,v 1.44 2017/01/22 03:59:30 jsing Exp $ */
+/* $OpenBSD: tls.h,v 1.45 2017/01/24 01:48:05 claudio Exp $ */
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  *
@@ -66,6 +66,9 @@ extern "C" {
 #define TLS_CRL_REASON_PRIVILEGE_WITHDRAWN      9
 #define TLS_CRL_REASON_AA_COMPROMISE            10
 
+#define TLS_MAX_SESSION_ID_LENGTH               32
+#define TLS_TICKET_KEY_SIZE                     48
+
 struct tls;
 struct tls_config;
 
@@ -128,6 +131,12 @@ void tls_config_verify_client_optional(struct tls_config *_config);
 void tls_config_clear_keys(struct tls_config *_config);
 int tls_config_parse_protocols(uint32_t *_protocols, const char *_protostr);
 
+int tls_config_set_session_id(struct tls_config *_config,
+    const unsigned char *_session_id, size_t _len);
+int tls_config_set_session_lifetime(struct tls_config *_config, int _lifetime);
+int tls_config_add_ticket_key(struct tls_config *_config, uint32_t _keyrev,
+    unsigned char *_key, size_t _keylen);
+
 struct tls *tls_client(void);
 struct tls *tls_server(void);
 int tls_configure(struct tls *_ctx, struct tls_config *_config);
diff --git a/src/lib/libtls/tls_config.c b/src/lib/libtls/tls_config.c
index 5bc671fc99..8fa810461c 100644
--- a/src/lib/libtls/tls_config.c
+++ b/src/lib/libtls/tls_config.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls_config.c,v 1.33 2016/11/11 14:02:24 jsing Exp $ */
+/* $OpenBSD: tls_config.c,v 1.34 2017/01/24 01:48:05 claudio Exp $ */
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  *
@@ -177,6 +177,7 @@ struct tls_config *
 tls_config_new(void)
 {
         struct tls_config *config;
+        unsigned char sid[TLS_MAX_SESSION_ID_LENGTH];
 
         if ((config = calloc(1, sizeof(*config))) == NULL)
                 return (NULL);
@@ -199,6 +200,17 @@ tls_config_new(void)
         if (tls_config_set_verify_depth(config, 6) != 0)
                 goto err;
 
+        /*
+         * Set session ID context to a random value.  For the simple case
+         * of a single process server this is good enough. For multiprocess
+         * servers the session ID needs to be set by the caller.
+         */
+        arc4random_buf(sid, sizeof(sid));
+        if (tls_config_set_session_id(config, sid, sizeof(sid)) != 0)
+                goto err;
+        config->ticket_keyrev = arc4random();
+        config->ticket_autorekey = 1;
+
         tls_config_prefer_ciphers_server(config);
 
         tls_config_verify(config);
@@ -661,3 +673,91 @@ tls_config_set_ocsp_staple_mem(struct tls_config *config, char *staple, size_t l
 {
         return set_mem(&config->ocsp_staple, &config->ocsp_staple_len, staple, len);
 }
+
+int
+tls_config_set_session_id(struct tls_config *config,
+    const unsigned char *session_id, size_t len)
+{
+        if (len > TLS_MAX_SESSION_ID_LENGTH) {
+                tls_config_set_errorx(config, "session ID too large");
+                return (-1);
+        }
+        memset(config->session_id, 0, sizeof(config->session_id));
+        memcpy(config->session_id, session_id, len);
+        return (0);
+}
+
+int
+tls_config_set_session_lifetime(struct tls_config *config, int lifetime)
+{
+        if (lifetime > TLS_MAX_SESSION_TIMEOUT) {
+                tls_config_set_errorx(config, "session lifetime too large");
+                return (-1);
+        }
+        if (lifetime != 0 && lifetime < TLS_MIN_SESSION_TIMEOUT) {
+                tls_config_set_errorx(config, "session lifetime too small");
+                return (-1);
+        }
+
+        config->session_lifetime = lifetime;
+        return (0);
+}
+
+int
+tls_config_add_ticket_key(struct tls_config *config, uint32_t keyrev,
+    unsigned char *key, size_t keylen)
+{
+        struct tls_ticket_key newkey;
+        int i;
+
+        if (TLS_TICKET_KEY_SIZE != keylen ||
+            sizeof(newkey.aes_key) + sizeof(newkey.hmac_key) > keylen) {
+                tls_config_set_errorx(config,
+                    "wrong amount of ticket key data");
+                return (-1);
+        }
+
+        keyrev = htonl(keyrev);
+        memset(&newkey, 0, sizeof(newkey));
+        memcpy(newkey.key_name, &keyrev, sizeof(keyrev));
+        memcpy(newkey.aes_key, key, sizeof(newkey.aes_key));
+        memcpy(newkey.hmac_key, key + sizeof(newkey.aes_key),
+            sizeof(newkey.hmac_key));
+        newkey.time = time(NULL);
+
+        for (i = 0; i < TLS_NUM_TICKETS; i++) {
+                struct tls_ticket_key *tk = &config->ticket_keys[i];
+                if (memcmp(newkey.key_name, tk->key_name,
+                    sizeof(tk->key_name)) != 0)
+                        continue;
+
+                /* allow re-entry of most recent key */
+                if (i == 0 && memcmp(newkey.aes_key, tk->aes_key,
+                    sizeof(tk->aes_key)) == 0 && memcmp(newkey.hmac_key,
+                    tk->hmac_key, sizeof(tk->hmac_key)) == 0)
+                        return (0);
+                tls_config_set_errorx(config, "ticket key already present");
+                return (-1);
+        }
+
+        memmove(&config->ticket_keys[1], &config->ticket_keys[0],
+            sizeof(config->ticket_keys) - sizeof(config->ticket_keys[0]));
+        config->ticket_keys[0] = newkey;
+
+        config->ticket_autorekey = 0;
+
+        return (0);
+}
+
+int
+tls_config_ticket_autorekey(struct tls_config *config)
+{
+        unsigned char key[TLS_TICKET_KEY_SIZE];
+        int rv;
+
+        arc4random_buf(key, sizeof(key));
+        rv = tls_config_add_ticket_key(config, config->ticket_keyrev++, key,
+            sizeof(key));
+        config->ticket_autorekey = 1;
+        return (rv);
+}
diff --git a/src/lib/libtls/tls_init.3 b/src/lib/libtls/tls_init.3
index 05474016f4..f5cada93a5 100644
--- a/src/lib/libtls/tls_init.3
+++ b/src/lib/libtls/tls_init.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: tls_init.3,v 1.84 2017/01/24 01:16:26 claudio Exp $
+.\" $OpenBSD: tls_init.3,v 1.85 2017/01/24 01:48:05 claudio Exp $
 .\"
 .\" Copyright (c) 2014 Ted Unangst <tedu@openbsd.org>
 .\"
@@ -26,6 +26,7 @@
 .Nm tls_config_parse_protocols ,
 .Nm tls_config_add_keypair_file ,
 .Nm tls_config_add_keypair_mem ,
+.Nm tls_config_add_ticket_key ,
 .Nm tls_config_set_alpn ,
 .Nm tls_config_set_ca_file ,
 .Nm tls_config_set_ca_path ,
@@ -42,6 +43,8 @@
 .Nm tls_config_set_ocsp_staple_mem ,
 .Nm tls_config_set_ocsp_staple_file ,
 .Nm tls_config_set_protocols ,
+.Nm tls_config_set_session_id ,
+.Nm tls_config_set_session_lifetime ,
 .Nm tls_config_set_verify_depth ,
 .Nm tls_config_prefer_ciphers_client ,
 .Nm tls_config_prefer_ciphers_server ,
@@ -111,6 +114,8 @@
 .Ft "int"
 .Fn tls_config_add_keypair_mem "struct tls_config *config" "const uint8_t *cert" "size_t cert_len" "const uint8_t *key" "size_t key_len"
 .Ft "int"
+.Fn tls_config_add_ticket_key "struct tls_config *config" "uint32_t keyrev" "unsigned char *key" "size_t keylen"
+.Ft "int"
 .Fn tls_config_set_alpn "struct tls_config *config" "const char *alpn"
 .Ft "int"
 .Fn tls_config_set_ca_file "struct tls_config *config" "const char *ca_file"
@@ -143,6 +148,10 @@
 .Ft "int"
 .Fn tls_config_set_protocols "struct tls_config *config" "uint32_t protocols"
 .Ft "int"
+.Fn tls_config_set_session_id "struct tls_config *config" "const unsigned char *session_id" "size_t len"
+.Ft "int"
+.Fn tls_config_set_session_lifetime "struct tls_config *config" "int lifetime"
+.Ft "int"
 .Fn tls_config_set_verify_depth "struct tls_config *config" "int verify_depth"
 .Ft "void"
 .Fn tls_config_prefer_ciphers_client "struct tls_config *config"
@@ -371,6 +380,14 @@ used as an alternative certificate for Server Name Indication (server only).
 adds an additional public certificate and private key from memory,
 used as an alternative certificate for Server Name Indication (server only).
 .It
+.Fn tls_config_add_ticket_key
+adds a key used for the encryption and authentication of TLS tickets.
+By default keys are generated and rotated automatically based on their lifetime.
+This function should only be used to synchronise ticket encryption key accross
+multiple processes.
+Re-adding a known key will result in an error, unless it is the most recently
+added key.
+.It
 .Fn tls_config_set_alpn
 sets the ALPN protocols that are supported.
 The alpn string is a comma separated list of protocols, in order of preference.
@@ -447,6 +464,16 @@ Additionally, the values
 .Dv TLS_PROTOCOLS_DEFAULT
 (TLSv1.2 only) may be used.
 .It
+.Fn tls_config_set_session_id
+sets the session identifier that will be used by the TLS server when
+sessions are enabled.
+By default a random value is used.
+.It
+.Fn tls_config_set_session_lifetime
+sets the lifetime to be used for TLS sessions.
+Session support is disabled if a lifetime of zero is specified, which is the
+default.
+.It
 .Fn tls_config_set_verify_depth
 limits the number of intermediate certificates that will be followed during
 certificate validation.
diff --git a/src/lib/libtls/tls_internal.h b/src/lib/libtls/tls_internal.h
index 1db186a05f..3650ca9462 100644
--- a/src/lib/libtls/tls_internal.h
+++ b/src/lib/libtls/tls_internal.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls_internal.h,v 1.50 2016/11/05 15:13:26 beck Exp $ */
+/* $OpenBSD: tls_internal.h,v 1.51 2017/01/24 01:48:05 claudio Exp $ */
 /*
  * Copyright (c) 2014 Jeremie Courreges-Anglas <jca@openbsd.org>
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
@@ -53,6 +53,22 @@ struct tls_keypair {
         size_t key_len;
 };
 
+#define TLS_MIN_SESSION_TIMEOUT (4)
+#define TLS_MAX_SESSION_TIMEOUT (24 * 60 * 60)
+
+#define TLS_NUM_TICKETS                         4
+#define TLS_TICKET_NAME_SIZE                    16
+#define TLS_TICKET_AES_SIZE                     32
+#define TLS_TICKET_HMAC_SIZE                    16
+
+struct tls_ticket_key {
+        /* The key_name must be 16 bytes according to -lssl */
+        unsigned char   key_name[TLS_TICKET_NAME_SIZE];
+        unsigned char   aes_key[TLS_TICKET_AES_SIZE];
+        unsigned char   hmac_key[TLS_TICKET_HMAC_SIZE];
+        time_t          time;
+};
+
 struct tls_config {
         struct tls_error error;
 
@@ -70,6 +86,11 @@ struct tls_config {
         char *ocsp_staple;
         size_t ocsp_staple_len;
         uint32_t protocols;
+        unsigned char session_id[TLS_MAX_SESSION_ID_LENGTH];
+        int session_lifetime;
+        struct tls_ticket_key ticket_keys[TLS_NUM_TICKETS];
+        uint32_t ticket_keyrev;
+        int ticket_autorekey;
         int verify_cert;
         int verify_client;
         int verify_depth;
@@ -171,6 +192,7 @@ int tls_handshake_server(struct tls *ctx);
 
 int tls_config_load_file(struct tls_error *error, const char *filetype,
     const char *filename, char **buf, size_t *len);
+int tls_config_ticket_autorekey(struct tls_config *config);
 int tls_host_port(const char *hostport, char **host, char **port);
 
 int tls_set_cbs(struct tls *ctx,
diff --git a/src/lib/libtls/tls_server.c b/src/lib/libtls/tls_server.c
index 091dd7a153..5bf87552cb 100644
--- a/src/lib/libtls/tls_server.c
+++ b/src/lib/libtls/tls_server.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls_server.c,v 1.32 2017/01/12 16:15:58 jsing Exp $ */
+/* $OpenBSD: tls_server.c,v 1.33 2017/01/24 01:48:05 claudio Exp $ */
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  *
@@ -116,6 +116,77 @@ tls_servername_cb(SSL *ssl, int *al, void *arg)
         return (SSL_TLSEXT_ERR_ALERT_FATAL);
 }
 
+static struct tls_ticket_key *
+tls_server_ticket_key(struct tls_config *config, unsigned char *keyname)
+{
+        struct tls_ticket_key *key = NULL;
+        time_t now;
+        int i;
+
+        now = time(NULL);
+        if (config->ticket_autorekey == 1) {
+                if (now - 3 * (config->session_lifetime / 4) >
+                    config->ticket_keys[0].time) {
+                        if (tls_config_ticket_autorekey(config) == -1)
+                                return (NULL);
+                }
+        }
+        for (i = 0; i < TLS_NUM_TICKETS; i++) {
+                struct tls_ticket_key *tk = &config->ticket_keys[i];
+                if (now - config->session_lifetime > tk->time)
+                        continue;
+                if (keyname == NULL || timingsafe_memcmp(keyname,
+                    tk->key_name, sizeof(tk->key_name)) == 0) {
+                        key = tk;
+                        break;
+                }
+        }
+        return (key);
+}
+
+static int
+tls_server_ticket_cb(SSL *ssl, unsigned char *keyname, unsigned char *iv,
+    EVP_CIPHER_CTX *ctx, HMAC_CTX *hctx, int mode)
+{
+        struct tls_ticket_key *key;
+        struct tls *tls_ctx;
+
+        if ((tls_ctx = SSL_get_app_data(ssl)) == NULL)
+                return (-1);
+
+        if (mode == 1) {
+                /* create new session */
+                key = tls_server_ticket_key(tls_ctx->config, NULL);
+                if (key == NULL) {
+                        tls_set_errorx(tls_ctx, "no valid ticket key found");
+                        return (-1);
+                }
+
+                memcpy(keyname, key->key_name, sizeof(key->key_name));
+                arc4random_buf(iv, EVP_MAX_IV_LENGTH);
+                EVP_EncryptInit_ex(ctx, EVP_aes_256_cbc(), NULL,
+                    key->aes_key, iv);
+                HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
+                    EVP_sha256(), NULL);
+                return (0);
+        } else {
+                /* get key by name */
+                key = tls_server_ticket_key(tls_ctx->config, keyname);
+                if (key == NULL)
+                        return (0);
+
+                EVP_DecryptInit_ex(ctx, EVP_aes_256_cbc(), NULL,
+                    key->aes_key, iv);
+                HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
+                    EVP_sha256(), NULL);
+
+                /* time to renew the ticket? is it the primary key? */
+                if (key != &tls_ctx->config->ticket_keys[0])
+                        return (2);
+                return (1);
+        }
+}
+
 static int
 tls_keypair_load_cert(struct tls_keypair *keypair, struct tls_error *error,
     X509 **cert)
@@ -157,7 +228,6 @@ static int
 tls_configure_server_ssl(struct tls *ctx, SSL_CTX **ssl_ctx,
     struct tls_keypair *keypair)
 {
-        unsigned char sid[SSL_MAX_SSL_SESSION_ID_LENGTH];
         EC_KEY *ecdh_key;
 
         SSL_CTX_free(*ssl_ctx);
@@ -219,14 +289,20 @@ tls_configure_server_ssl(struct tls *ctx, SSL_CTX **ssl_ctx,
                 goto err;
         }
 
-        /*
-         * Set session ID context to a random value.  We don't support
-         * persistent caching of sessions so it is OK to set a temporary
-         * session ID context that is valid during run time.
-         */
-        arc4random_buf(sid, sizeof(sid));
-        if (SSL_CTX_set_session_id_context(*ssl_ctx, sid,
-            sizeof(sid)) != 1) {
+        if (ctx->config->session_lifetime > 0) {
+                /* set the session lifetime and enable tickets */
+                SSL_CTX_set_timeout(*ssl_ctx, ctx->config->session_lifetime);
+                SSL_CTX_clear_options(*ssl_ctx, SSL_OP_NO_TICKET);
+                if (!SSL_CTX_set_tlsext_ticket_key_cb(*ssl_ctx,
+                    tls_server_ticket_cb)) {
+                        tls_set_error(ctx,
+                            "failed to set the TLS ticket callback");
+                        goto err;
+                }
+        }
+
+        if (SSL_CTX_set_session_id_context(*ssl_ctx, ctx->config->session_id,
+            sizeof(ctx->config->session_id)) != 1) {
                 tls_set_error(ctx, "failed to set session id context");
                 goto err;
         }