openssl
openssl copied to clipboard
ruby
implement SSLSocket#export_keying_material for doing RFC 5705 operations
I need to generate shared ttls secrets from TLS sessions using this API. Note this implementation is incomplete! as it does not allow using the context. See the first commit how that could look. It did not work for me so I removed it.
Should I write a test for this?
Refs: https://datatracker.ietf.org/doc/html/rfc5705 https://datatracker.ietf.org/doc/html/rfc8446#section-7.5 https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#exporter-labels https://man.openbsd.org/SSL_export_keying_material.3
A super hacky radius implementation as a "real live" example can be found here: https://gist.github.com/madblobfish/9f1e89a3b5847ab80dcef16c56a4c0f9
See the first commit how that could look. It did not work for me so I removed it.
What is blocking it from working? Check for rb_scan_args() for how to implement optional parameters in C extensions.
It also needs a StringValue() to ensure that the argument is actually an instance of String.
Should I write a test for this?
Yes. :)
This should fix everything, also squashed everything together (also did it wrong the first time, sorry for that noise).
Thanks for the rb_scan_args hint, that really helped :)
I've added a simple test, not sure how to test it deeper, but it seems to work (I also verified it with my application).
I got no example application code for the optional context functionality though.
Edit: removed useless comments from the test by another fix and squash
Fixed failed tests (should have checked locally first :facepalm:) lets hope there are no compiler warnings left now
@madblobfish, @rhenium: Thanks a lot!
It is not possible to add text about RFC 9266 support in code?
Hi @Neustradamus The mechanism is defined in https://datatracker.ietf.org/doc/html/rfc8446#section-7.5 and formerly in https://datatracker.ietf.org/doc/html/rfc5705. I do not think it makes sense to collect all implementing RFCs for that in this openssl library. The information would quickly be outdated and annoying to keep up to date.
An official and proper overview of them may be found in IANA's registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#exporter-labels. Maybe this could be linked. But in the end you can already find this registry linked in the openssl documentation: https://www.openssl.org/docs/man3.0/man3/SSL_export_keying_material.html