On Thu, Jan 21, 2010, fredk2 wrote: > > Hi, > > I have tried to read some of the old posts, but do not understand if the > following is an apache or openssl question. > > I am using the apache 2.2.14 mod_ssl with the patch: > http://www.apache.org/dist/httpd/patches/apply_to_2.2.14/CVE-2009-3555-2.2.patch > When I test with openssl 0.9.8i the renegotiation is as expected: refused. > When I use 0.9.8m-beta1 the Renegotiation hangs until the Timeout kicks > in... > > with mod_ssl dynamically linked to 0.9.8i libs > --- > GET / HTTP/1.0 > R > RENEGOTIATING > 28534:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake > failure:s3_pkt.c:529: > > So this is perfect ... > > > now the same with 0.9.8m libs > --- > GET / HTTP/1.0 > R > RENEGOTIATING > > ............hangs for 5 min .............. > > 25764:error:140940F5:SSL routines:SSL3_READ_BYTES:unexpected > record:s3_pkt.c:1202: > > In this case the error log (debug level) shows: > [Thu Jan 21 18:32:29 2010] [debug] ssl_engine_io.c(1884): OpenSSL: I/O > error, 5 bytes expected to read on BIO#8e2d040 [mem: b71e9568] > [Thu Jan 21 18:32:29 2010] [info] [client 192.168.1.190] (70007)The timeout > specified has expired: SSL input filter read failed. > [Thu Jan 21 18:32:29 2010] [error] [client 192.168.1.190] request failed: > error reading the headers > [Thu Jan 21 18:32:29 2010] [debug] ssl_engine_kernel.c(1879): OpenSSL: > Write: SSL negotiation finished successfully > > Any ideas ? >
Are you using an OpenSSL 0.9.8m-beta1 client? Try it without that patch too. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected]
