On Thu, Jan 21, 2010, fredk2 wrote: > > Yes I forgot to mention that I did test with the 0.9.8m s_client and that > worked. > The [new] problem 0.9.8m create is that a (old) client can request R and > exhaust all apache threads. >
This is a bit of a problem for older clients because the specification requires sending a no_renegotiation alert. OpenSSL clients before 0.9.8m just ignore this alert and carry on expecting the handshake to continue. This never happens and the "hang" is the result. Presumably any client could just connect to the server and partly complete the handshake and get the same effect in any version of Apache and mod_ssl. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected]
