Yes I forgot to mention that I did test with the 0.9.8m s_client and that worked. The [new] problem 0.9.8m create is that a (old) client can request R and exhaust all apache threads.
Thanks for the reply - Fred Dr. Stephen Henson wrote: > > On Thu, Jan 21, 2010, fredk2 wrote: > >> >> Hi, >> >> I have tried to read some of the old posts, but do not understand if the >> following is an apache or openssl question. >> >> I am using the apache 2.2.14 mod_ssl with the patch: >> http://www.apache.org/dist/httpd/patches/apply_to_2.2.14/CVE-2009-3555-2.2.patch >> When I test with openssl 0.9.8i the renegotiation is as expected: >> refused. >> When I use 0.9.8m-beta1 the Renegotiation hangs until the Timeout kicks >> in... >> >> with mod_ssl dynamically linked to 0.9.8i libs >> --- >> GET / HTTP/1.0 >> R >> RENEGOTIATING >> 28534:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake >> failure:s3_pkt.c:529: >> >> So this is perfect ... >> >> >> now the same with 0.9.8m libs >> --- >> GET / HTTP/1.0 >> R >> RENEGOTIATING >> >> ............hangs for 5 min .............. >> >> 25764:error:140940F5:SSL routines:SSL3_READ_BYTES:unexpected >> record:s3_pkt.c:1202: >> >> In this case the error log (debug level) shows: >> [Thu Jan 21 18:32:29 2010] [debug] ssl_engine_io.c(1884): OpenSSL: I/O >> error, 5 bytes expected to read on BIO#8e2d040 [mem: b71e9568] >> [Thu Jan 21 18:32:29 2010] [info] [client 192.168.1.190] (70007)The >> timeout >> specified has expired: SSL input filter read failed. >> [Thu Jan 21 18:32:29 2010] [error] [client 192.168.1.190] request failed: >> error reading the headers >> [Thu Jan 21 18:32:29 2010] [debug] ssl_engine_kernel.c(1879): OpenSSL: >> Write: SSL negotiation finished successfully >> >> Any ideas ? >> > > Are you using an OpenSSL 0.9.8m-beta1 client? > > Try it without that patch too. > > Steve. > -- > Dr Stephen N. Henson. OpenSSL project core developer. > Commercial tech support now available see: http://www.openssl.org > ______________________________________________________________________ > OpenSSL Project http://www.openssl.org > User Support Mailing List [email protected] > Automated List Manager [email protected] > > -- View this message in context: http://old.nabble.com/openssl-0.9.8m-beta1-with-modssl-patch-does-not-disable-renegotiation-tp27263857p27265869.html Sent from the OpenSSL - User mailing list archive at Nabble.com. ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected]
