Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss
[openssl-users] How to make a rehandshake(renegotiation)?
298 views
Skip to first unread message
Serj Rakitov
Mar 8, 2015, 5:46:40 PM3/8/15
to
Hello
I want to test SSL_ERROR_WANT_READ/SSL_ERROR_WANT_WRITE.
I have client and server. Server is sending data to the client. Client is reading data.
After some bytes sent server initiates a rehandshake to cause SSL_ERROR_WANT_WRITE on client. But there is no rehandshake. On server SSL_do_handshake returns <0 and SSL_get_error returns SSL_ERROR_WANT_READ. And on client SSL_read returns<0 and SSL_get_error also returns SSL_ERROR_WANT_READ.
The code to rehandshake is:
SSL_set_session_id_context(...);
SSL_renegotiate(...)
SSL_do_handshake(...);
ssl->state=SSL_ST_ACCEPT;
//process SSL_do_handshake (WANT_READ/WANT_WRITE)
How to make a rehandshake from server side?
--
Best Regards,
Serj Rakitov
_______________________________________________
openssl-users mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
I want to test SSL_ERROR_WANT_READ/SSL_ERROR_WANT_WRITE.
I have client and server. Server is sending data to the client. Client is reading data.
After some bytes sent server initiates a rehandshake to cause SSL_ERROR_WANT_WRITE on client. But there is no rehandshake. On server SSL_do_handshake returns <0 and SSL_get_error returns SSL_ERROR_WANT_READ. And on client SSL_read returns<0 and SSL_get_error also returns SSL_ERROR_WANT_READ.
The code to rehandshake is:
SSL_set_session_id_context(...);
SSL_renegotiate(...)
SSL_do_handshake(...);
ssl->state=SSL_ST_ACCEPT;
//process SSL_do_handshake (WANT_READ/WANT_WRITE)
How to make a rehandshake from server side?
--
Best Regards,
Serj Rakitov
_______________________________________________
openssl-users mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
Serj Rakitov
Mar 8, 2015, 6:15:32 PM3/8/15
to
Serj Rakitov
Mar 9, 2015, 5:59:19 AM3/9/15
to
I can't start rehandshake even from client side.
If I try something like this on client side:
SSL_renegotiate(...)
//process SSL_do_handshake(SSL_ERROR_WANT_READ/SSL_ERROR_WANT_WRITE)
nothing happens.
Neither client nor server can't start a new handshake!
How to do a rehandshake?
Serj Rakitov
Mar 10, 2015, 12:44:45 PM3/10/15
to
Nobody knows?
Does OpenSSL support renegotiation?
I will be very grateful for answers because there is no any info about this in the net.
09.03.2015, 00:36, "Serj Rakitov" <ra...@yandex.com>:
> Hello
>
> I want to test SSL_ERROR_WANT_READ/SSL_ERROR_WANT_WRITE.
> I have client and server. Server is sending data to the client. Client is reading data.
> After some bytes sent server initiates a rehandshake to cause SSL_ERROR_WANT_WRITE on client. But there is no rehandshake. On server SSL_do_handshake returns <0 and SSL_get_error returns SSL_ERROR_WANT_READ. And on client SSL_read returns<0 and SSL_get_error also returns SSL_ERROR_WANT_READ.
>
> The code to rehandshake is:
> SSL_set_session_id_context(...);
> SSL_renegotiate(...)
> SSL_do_handshake(...);
> ssl->state=SSL_ST_ACCEPT;
> //process SSL_do_handshake (WANT_READ/WANT_WRITE)
>
> How to make a rehandshake from server side?
>
> I want to test SSL_ERROR_WANT_READ/SSL_ERROR_WANT_WRITE.
> I have client and server. Server is sending data to the client. Client is reading data.
> After some bytes sent server initiates a rehandshake to cause SSL_ERROR_WANT_WRITE on client. But there is no rehandshake. On server SSL_do_handshake returns <0 and SSL_get_error returns SSL_ERROR_WANT_READ. And on client SSL_read returns<0 and SSL_get_error also returns SSL_ERROR_WANT_READ.
>
> The code to rehandshake is:
> SSL_set_session_id_context(...);
> SSL_renegotiate(...)
> SSL_do_handshake(...);
> ssl->state=SSL_ST_ACCEPT;
> //process SSL_do_handshake (WANT_READ/WANT_WRITE)
>
> How to make a rehandshake from server side?
Salz, Rich
Mar 10, 2015, 2:43:39 PM3/10/15
to
> Does OpenSSL support renegotiation?
Yes.
You probably need more than that. :) Take a look at the apps/s_client and look for the 'R' constant to see how to do client-initiated reneg.
Yes.
You probably need more than that. :) Take a look at the apps/s_client and look for the 'R' constant to see how to do client-initiated reneg.
Serj Rakitov
Mar 11, 2015, 1:01:50 PM3/11/15
to
10.03.2015, 21:40, "Salz, Rich" <rs...@akamai.com>:
> Yes.
> You probably need more than that. :) Take a look at the apps/s_client and look for the 'R' constant to see how to do client-initiated reneg.
I have took a look at the apps/s_client.
> You probably need more than that. :) Take a look at the apps/s_client and look for the 'R' constant to see how to do client-initiated reneg.
I see only several lines of code about renegotiation:
//...............
static int iiii;
if (++iiii == 52) {
SSL_renegotiate(con);
iiii = 0;
}
//...............
if ((!c_ign_eof) && (cbuf[0] == 'R')) {
BIO_printf(bio_err, "RENEGOTIATING\n");
SSL_renegotiate(con);
cbuf_len = 0;
}
//...............
So only one function is used: SSL_renegotiate
I also use it - but nothing happens or error:
OpenSSL error: 5044:error:140940F5:SSL routines:ssl3_read_bytes:unexpected record:.\ssl\s3_pkt.c:1611:
NO renegotioation!
More than that I tested s_client on several domains. I typed "R" after s_client was connected but got a error:
2992:error:1409E0E5:SSL routines:ssl3_write_bytes:ssl handshake failure:.\ssl\s3_pkt.c:644: error in s_client
I also have took a look at the s_server and saw only one function: SSL_renegotiate that seems to be must make a renegotioation. I do some else in code but: NO renegotioation happens! Why?
Can anybody help and though explain about renegotiation at all? Maybe I don't know something...
When it can be used? Maybe it's disable by default for security reasons in OpenSSL?
There is a function SSL_get_secure_renegotiation_support. Seems to be renegotiation can be secure or no. Maybe something else....
But right now I want to perform ANY type of renegotiation )) Nothing happens or error...
Regards.
Salz, Rich
Mar 11, 2015, 1:42:18 PM3/11/15
to
Many servers have disabled client-initiated renegotation.
I thought you were testing your client/server.
I thought you were testing your client/server.
Serj Rakitov
Mar 11, 2015, 4:20:19 PM3/11/15
to
11.03.2015, 20:38, "Salz, Rich" <rs...@akamai.com>:
> Many servers have disabled client-initiated renegotation.
>
> I thought you were testing your client/server.
Yes I want to test my own client and server. I don't disable renegotation manually. I don't know how to do this. Maybe it disabled by default?
>
> I thought you were testing your client/server.
Regards.
Serj Rakitov
Mar 12, 2015, 11:36:11 AM3/12/15
to
Hi,
I managed to do a renegotiation.
My mistake was that I start renegotiation when not all data were received or sended.
Probably there was a situation when not all packets(records) were processed and i got a error: unexpected record or bad length.
Really only one function SSL_renegotiate and flag SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION are quite enough. Seems to be all others was for old OpenSLL versions.
Only one question remain, it's opposite to the first one: if i want don't use renegotiation at all, how to disable it?
I see that insecure renegotiation can be disabled by:
SSL_CTX_clear_options(ctx,SSL_OP_LEGACY_SERVER_CONNECT)
that is enabled by default.
But what about secure renegotiation? Is it possible to disable it at all for client and server. So, Server rejects queries on secure renegotiation from client and client rejects queries on secure renegotiation from server.
I managed to do a renegotiation.
My mistake was that I start renegotiation when not all data were received or sended.
Probably there was a situation when not all packets(records) were processed and i got a error: unexpected record or bad length.
Really only one function SSL_renegotiate and flag SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION are quite enough. Seems to be all others was for old OpenSLL versions.
Only one question remain, it's opposite to the first one: if i want don't use renegotiation at all, how to disable it?
I see that insecure renegotiation can be disabled by:
SSL_CTX_clear_options(ctx,SSL_OP_LEGACY_SERVER_CONNECT)
that is enabled by default.
But what about secure renegotiation? Is it possible to disable it at all for client and server. So, Server rejects queries on secure renegotiation from client and client rejects queries on secure renegotiation from server.
0 new messages