do I understand this correctly: 0.9.8m sends a no_renegotiation alert and apache needs a mod_ssl patch that, by default, upon this alert closes the connection?
Thanks - Fred Dr. Stephen Henson wrote: > > On Thu, Jan 21, 2010, fredk2 wrote: > >> >> Yes I forgot to mention that I did test with the 0.9.8m s_client and that >> worked. >> The [new] problem 0.9.8m create is that a (old) client can request R and >> exhaust all apache threads. >> > > This is a bit of a problem for older clients because the specification > requires sending a no_renegotiation alert. OpenSSL clients before 0.9.8m > just ignore this alert and carry on expecting the handshake to continue. > This > never happens and the "hang" is the result. > > Presumably any client could just connect to the server and partly complete > the > handshake and get the same effect in any version of Apache and mod_ssl. > > Steve. > -- > Dr Stephen N. Henson. OpenSSL project core developer. > Commercial tech support now available see: http://www.openssl.org > ______________________________________________________________________ > OpenSSL Project http://www.openssl.org > User Support Mailing List [email protected] > Automated List Manager [email protected] > > -- View this message in context: http://old.nabble.com/openssl-0.9.8m-beta1-with-modssl-patch-does-not-disable-renegotiation-tp27263857p27266456.html Sent from the OpenSSL - User mailing list archive at Nabble.com. ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected]
