(A more complete response than my initial mobile reply yesterday) On Mon, 2015-02-16 at 08:39 -0500, John Foley wrote: > Which Cisco product are you using, the ASA? What version of software > do you have on the product? While I can't speak for all Cisco > products, I can confirm that many Cisco products are using OpenSSL > 1.0.1, which implies support for DTLS 1.0. If you care to share more > details, I can try to engage the product team to better understand > this.
The so-called DTLS1_BAD_VER that AnyConnect still uses is actually a snapshot of the DTLS protocol from around OpenSSL 0.9.8e before it was standardised — with *some* but not all of the later modifications backported. Even new versions of OpenSSL still support it, to a certain extent. So just because you've updated to OpenSSL 1.0.1, that doesn't necessarily mean you've updated to DTLS 1.0. You *could*, but as far I can tell you haven't. I really wish you *would*, because the old protocol has a tendency to break when people don't really account for it while "cleaning up" the code. Hence RT#2984 when it broke in various previous releases of OpenSSL, and the three patches I've just sent to fix 1.0.2 and HEAD: https://mta.openssl.org/pipermail/openssl-dev/2015-February/000698.html https://mta.openssl.org/pipermail/openssl-dev/2015-February/000710.html https://mta.openssl.org/pipermail/openssl-dev/2015-February/000707.html It would be really nice to be able to use the real DTLS protocol, and for the client not to suffer such frequent breakage with new versions of OpenSSL. I'm sure your VPN client team must also find similar issues, since they do use OpenSSL. Although they don't seem to be very visible around here — it was *me* who made OpenSSL support DTLS1_BAD_VER as a client again, when that support had been dropped. And it was me who submitted all the above fixes. So maybe they don't find issues because I've fixed them all by the time they update? :) (I also wish you'd support AES-GCM, FWIW. With ocserv that goes nice and fast on modern hardware. AES-SHA is all we get with the ASA, and it's a lot more cpu-intensive.) -- dwmw2
smime.p7s
Description: S/MIME cryptographic signature
_______________________________________________ openssl-dev mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
