I've been hit with a problem that makes me think very much of SGC, and
started searching for docs. The best documents so far are found as
links from http://www.microsoft.com/security/tech/sgc/default.asp,
most importantly, the protocol is roughly described in
http://www.microsoft.com/security/tech/sgc/TechnicalDetails.asp .
According to that one, the client doing SGC the M$ way sends a Reset
message to the server as an answer to the server cert. According to
the same page, Netscape clients do almost the same thing, except they
do a full handshake before renegotiating (I feel a bit unsure about if
Netscape clients actually close the connection and do a new connection
with a stronger cipher or if it sends a reset message like M$ clients
do).
Looking around in our source, all I can see is that we detect if
there's a suddent client hello coming when OpenSSL is in the client
certificate reading state. However, if the technical details page
given above is correct, OpenSSL should receive the mysterious Reset
message when getting the request from an M$ client, won't recognise
it, and will thusly fail the SSL_accept().
I wonder, is there anyone knowing if the alleged Reset message is
really an existing thing or just a way to show that the server should
implicitely expect this to possibly happen? The next question would
be what the message type code is, and what the contents of the packet
might be, if any.
Also, one might wonder how it really works in the Netscape world.
So many question, so little info (really, the technical info I've
found so far is crapy at best, and I can't find the document that M$
has supposedly sent to IETF either... *sigh*).
--
Richard Levitte \ Spannv�gen 38, II \ [EMAIL PROTECTED]
Chairman@Stacken \ S-168 35 BROMMA \ T: +46-8-26 52 47
Redakteur@Stacken \ SWEDEN \ or +46-709-50 36 10
Procurator Odiosus Ex Infernis -- [EMAIL PROTECTED]
Member of the OpenSSL development team: http://www.openssl.org/
Software Engineer, Celo Communications: http://www.celocom.com/
Unsolicited commercial email is subject to an archival fee of $400.
See <http://www.stacken.kth.se/~levitte/mail/> for more info.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
