[Date Prev] [Date Index] [Date Next] [Thread Prev] [Thread Index] [Thread Next]

Re: Porting conserver to OpenSSL 1.1

John Stoffel john@stoffel.org
Tue, 1 Aug 2017 20:38:03 GMT


Chris,
Been speding a little time  poking at this.  Tried using the openssl
client to test connections, and I suspect that this points us in the
right direction to fix this.  Using the latest patch you posted a week
ago, I get the following in my test, where I start the conserver
daemon using the test.cf file and the args from the dotest script:

    > ../conserver/conserver -M 127.0.0.1 -p 7777 -v -C test.cf  -P \
    test.passwd -m 32


Then I just used the the following to do a test connection:

   root@sid:/home/john/conserver/test# openssl s_client -connect
   localhost:7777
   CONNECTED(00000003)
   [Tue Aug  1 16:31:01 2017] conserver (12052): ERROR: ParseIACBuf(): fd
   4: unrecognized quoted-OB_IAC char
   140153917515008:error:1408F10B:SSL routines:ssl3_get_record:wrong
   version number:../ssl/record/ssl3_record.c:252:
   ---
   no peer certificate available
   ---
   No client certificate CA names sent
   ---
   SSL handshake has read 5 bytes and written 176 bytes
   Verification: OK
   ---
   New, (NONE), Cipher is (NONE)
   Secure Renegotiation IS NOT supported
   Compression: NONE
   Expansion: NONE
   No ALPN negotiated
   SSL-Session:
   Protocol  : TLSv1.2
   Cipher    : 0000
   Session-ID:
   Session-ID-ctx:
   Master-Key:
   PSK identity: None
   PSK identity hint: None
   SRP username: None
   Start Time: 1501619461
   Timeout   : 7200 (sec)
   Verify return code: 0 (ok)
   Extended master
   secret: no
   ---
   [Tue Aug  1 16:31:01 2017] conserver (12052): ERROR: FileRead(): fd 4: Connection reset by peer


Which doesn't tell us a ton really... maybe that I'm not doing the connection correctly.  But more importantly, I think it's showing that there's a connection made using ssl3, which has problems.

It's just a thought...

John