Hello. Great! With all web servers 1)-3) works well. Here is the part of s_client message log with IIS7:
[r...@mstestsv2 ~]# openssl s_client -host 192.168.220.182 -port
443 -showcerts -msg
CONNECTED(00000003)
>>> TLS 1.0 Handshake [length 00cd], ClientHello
01 00 00 c9 03 01 4b d4 ed a6 5e 55 e3 b9 e3 83
93 7b ba f2 e8 a3 7b 54 21 83 a9 4b 68 99 46 8e
b7 b8 82 4f e3 87 00 00 5c c0 14 c0 0a 00 39 00
38 00 88 00 87 c0 0f c0 05 00 35 00 84 c0 12 c0
08 00 16 00 13 c0 0d c0 03 00 0a c0 13 c0 09 00
33 00 32 00 9a 00 99 00 45 00 44 c0 0e c0 04 00
2f 00 96 00 41 00 07 c0 11 c0 07 c0 0c c0 02 00
05 00 04 00 15 00 12 00 09 00 14 00 11 00 08 00
06 00 03 00 ff 01 00 00 44 00 0b 00 04 03 00 01
02 00 0a 00 34 00 32 00 01 00 02 00 03 00 04 00
05 00 06 00 07 00 08 00 09 00 0a 00 0b 00 0c 00
0d 00 0e 00 0f 00 10 00 11 00 12 00 13 00 14 00
15 00 16 00 17 00 18 00 19 00 23 00 00
<<< TLS 1.0 Handshake [length 004a], ServerHello
02 00 00 46 03 01 4b d4 f2 f8 3a 8b 05 e8 61 d2
4b 2f c6 f1 f6 be a5 56 e1 e9 0d 1d 3e fd cb b6
83 6b 4a f7 85 11 20 90 26 00 00 51 2f a5 f3 11
88 6d 74 3e 78 53 b3 05 f7 c0 49 fe b0 27 da 38
9b 9b 0a 0d 1f ae 7d c0 09 00
<<< TLS 1.0 Handshake [length 05da], Certificate
0b 00 05 d6 00 05 d3 00 02 fc 30 82 02 f8 30 82
02 9d a0 03 02 01 02 02 08 33 9d 56 4d bd 65 1e
fc 30 0a 06 08 2a 86 48 ce 3d 04 03 02 30 43 31
1a 30 18 06 03 55 04 03 13 11 53 48 41 32 35 36
....
Thanks.
Regards,
Koichi Sugimoto.
-----Original Message-----
From: owner-openssl-...@openssl.org [mailto:owner-openssl-...@openssl.org] On
Behalf Of Mounir IDRASSI via RT
Sent: Sunday, April 25, 2010 2:13 PM
To: ll...@randombit.net
Cc: openssl-dev@openssl.org
Subject: Re: [openssl.org #2240] Missing Supported Point Formats Extension in
ServerHello should be ignored
Hi,
I'm attaching a simple patch that should correct this behavior.
Can you test it and tell us the results?
Thanks,
--
Mounir IDRASSI
IDRIX
http://www.idrix.fr
> Dear openssl support,
>
> I investigated the following web servers.
> But all of them failed with the same error.
>
> 1) apache-tomcat-6.0.26 + bcprov-ext-jdk16-145 + jdk1.6.0_17 (centos
> 5)
> 2) jboss-4.2.3.GA + bcprov-jdk15 + jdk1.6.0_17 (centos 5)
> 3) IIS 7 (windows 7)
>
> On the other hand, many browsers except for opera successfully connect
> to the servers.
> Something wrong?
>
> Regards,
> Koichi Sugimoto.
>
> 2010/4/20 Jack Lloyd via RT <r...@openssl.org>
>
>>
>> RFC 4492 says:
>>
>> A client that receives a ServerHello message containing a Supported
>> Point Formats Extension MUST respect the server's choice of point
>> formats during the handshake (cf. Sections 5.6 and 5.7). If no
>> Supported Point Formats Extension is received with the ServerHello,
>> this is equivalent to an extension allowing only the uncompressed
>> point format.
>>
>> OpenSSL 1.0.0 rejects such a negotiation, always requiring the
>> extension to exist in the ServerHello:
>>
>> CONNECTED(00000003)
>> >>> TLS 1.0 Handshake [length 00cd], ClientHello
>> 01 00 00 c9 03 01 4b cc f2 87 fc 1d 05 2d 0c 1f
>> 4a 74 8b 8c 6f 20 c3 56 fb 35 4a 73 b0 9c e0 c1
>> 6f 34 1b 10 f9 9f 00 00 5c c0 14 c0 0a 00 39 00
>> 38 00 88 00 87 c0 0f c0 05 00 35 00 84 c0 12 c0
>> 08 00 16 00 13 c0 0d c0 03 00 0a c0 13 c0 09 00
>> 33 00 32 00 9a 00 99 00 45 00 44 c0 0e c0 04 00
>> 2f 00 96 00 41 00 07 c0 11 c0 07 c0 0c c0 02 00
>> 05 00 04 00 15 00 12 00 09 00 14 00 11 00 08 00
>> 06 00 03 00 ff 01 00 00 44 00 0b 00 04 03 00 01
>> 02 00 0a 00 34 00 32 00 01 00 02 00 03 00 04 00
>> 05 00 06 00 07 00 08 00 09 00 0a 00 0b 00 0c 00
>> 0d 00 0e 00 0f 00 10 00 11 00 12 00 13 00 14 00
>> 15 00 16 00 17 00 18 00 19 00 23 00 00 <<< TLS 1.0 Handshake
>> [length 002a], ServerHello
>> 02 00 00 26 03 01 20 3f 72 c5 29 9f 22 b1 a6 af
>> 4b 81 31 eb 4c 85 bf bb 3a a5 8b b8 21 86 16 c5
>> 7c 84 5c 73 4a 4a 00 c0 08 00
>> 139742562498200:error:1411809D:SSL
>> routines:SSL_CHECK_SERVERHELLO_TLSEXT:tls invalid ecpointformat
>> list:t1_lib.c:1440:
>> 139742562498200:error:14092113:SSL
>> routines:SSL3_GET_SERVER_HELLO:serverhello tlsext:s3_clnt.c:942:
>>
>> OpenSSL 1.0.0 29 Mar 2010
>> built on: Mon Apr 19 19:52:35 EDT 2010
>> platform: linux-x86_64
>> options: bn(64,64) rc4(1x,char) des(idx,cisc,16,int) idea(int)
>> blowfish(idx)
>> compiler: gcc -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN
>> -DHAVE_DLFCN_H
>> -m64 -DL_ENDIAN -DTERMIO -O3 -Wall -DMD32_REG_T=int
>> -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DSHA1_ASM -DSHA256_ASM
>> -DSHA512_ASM -DMD5_ASM -DAES_ASM -DWHIRLPOOL_ASM
>> OPENSSLDIR: "/usr/local/ssl"
>>
>> ______________________________________________________________________
>> OpenSSL Project http://www.openssl.org
>> Development Mailing List openssl-dev@openssl.org
>> Automated List Manager majord...@openssl.org
>>
>
smime.p7s
Description: S/MIME cryptographic signature
