[Date Prev] [Date Index] [Date Next] [Thread Prev] [Thread Index] [Thread Next]

Re: Porting conserver to OpenSSL 1.1

John Stoffel john@stoffel.org
Tue, 1 Aug 2017 20:38:03 GMT

Been speding a little time  poking at this.  Tried using the openssl
client to test connections, and I suspect that this points us in the
right direction to fix this.  Using the latest patch you posted a week
ago, I get the following in my test, where I start the conserver
daemon using the test.cf file and the args from the dotest script:

    > ../conserver/conserver -M -p 7777 -v -C test.cf  -P \
    test.passwd -m 32

Then I just used the the following to do a test connection:

   root@sid:/home/john/conserver/test# openssl s_client -connect
   [Tue Aug  1 16:31:01 2017] conserver (12052): ERROR: ParseIACBuf(): fd
   4: unrecognized quoted-OB_IAC char
   140153917515008:error:1408F10B:SSL routines:ssl3_get_record:wrong
   version number:../ssl/record/ssl3_record.c:252:
   no peer certificate available
   No client certificate CA names sent
   SSL handshake has read 5 bytes and written 176 bytes
   Verification: OK
   New, (NONE), Cipher is (NONE)
   Secure Renegotiation IS NOT supported
   Compression: NONE
   Expansion: NONE
   No ALPN negotiated
   Protocol  : TLSv1.2
   Cipher    : 0000
   PSK identity: None
   PSK identity hint: None
   SRP username: None
   Start Time: 1501619461
   Timeout   : 7200 (sec)
   Verify return code: 0 (ok)
   Extended master
   secret: no
   [Tue Aug  1 16:31:01 2017] conserver (12052): ERROR: FileRead(): fd 4: Connection reset by peer

Which doesn't tell us a ton really... maybe that I'm not doing the connection correctly.  But more importantly, I think it's showing that there's a connection made using ssl3, which has problems.

It's just a thought...