Folks,
The setup involves a http client posting a transaction to
a webmethods server. Stunnel is being used in client mode
for ssl. I am being told that SSL for webmethods is from the IAIK stack.
I apologize in advance for the lack of specific details at the moment,
but will provide them as soon as they are obtained.
The interop problem is with 0.9.7d (no hardware switch was used, but I
do not know at the moment wether this is relevant to the issue at hand).
The setup works fine with 0.9.6b with all others remaining constant.
However, with 0.9.7d, it seems that an empty record (unable to deduce if
the 24B length reported by ssldump indicates a truly empty record) is
being written first,
and the second record carries all of the data. With 0.9.6b on
the other hand, the very first app record carries all the data and
things work fine. Given these external symptoms as viewed with ssldump,
I am guessing that the 0.9.7d behaviour is
unacceptable to IAIK/Webmethods.
What are the differences between openssl-engine-0.9.6b and
openssl-0.9.7d wrt SSL_write that might explain this, if at all?
Why/what is this first
app record with 0.9.7d? ssldump o/p in either cases is included below.
(Pls search for [EMAIL PROTECTED]@ to get to the relevant sections in ssldump)
Thanks in advance for all responses, and for any advice on how to
further debug such situations (gdb bio?).
0.9.6b Output
=============
New TCP connection #2: maruthi-linux.cisco.com(34566) <->
172.25.17.51(5443) 2 1 0.0007 (0.0007) C>SV3.0(101) Handshake
ClientHello
Version 3.0
random[32]=
41 c8 9b 00 44 93 56 63 04 1e 21 48 41 9d 11 38
44 bb 4d 13 12 6f c1 db a3 7a 40 27 a7 2c 82 30
resume [16]=
7b ad b5 d5 98 2f 2e 22 2c b7 8f 62 7b 2c 90 76
cipher suites
SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
SSL_RSA_WITH_3DES_EDE_CBC_SHA
SSL_DHE_DSS_WITH_RC4_128_SHA
SSL_RSA_WITH_IDEA_CBC_SHA
SSL_RSA_WITH_RC4_128_SHA
SSL_RSA_WITH_RC4_128_MD5
SSL_DHE_DSS_WITH_RC2_56_CBC_SHA
SSL_RSA_EXPORT1024_WITH_RC4_56_SHA
SSL_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA
SSL_RSA_EXPORT1024_WITH_DES_CBC_SHA
SSL_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5
SSL_RSA_EXPORT1024_WITH_RC4_56_MD5
SSL_DHE_RSA_WITH_DES_CBC_SHA
SSL_DHE_DSS_WITH_DES_CBC_SHA
SSL_RSA_WITH_DES_CBC_SHA
SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA
SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA
SSL_RSA_EXPORT_WITH_DES40_CBC_SHA
SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
SSL_RSA_EXPORT_WITH_RC4_40_MD5
compression methods
NULL
2 2 0.0037 (0.0029) S>CV3.0(58) Handshake
ServerHello
Version 3.0
random[32]=
41 c8 aa 7d 03 a0 cc d8 a5 19 ce 4f 99 cb e4 53
5c 2f 93 7a 07 38 4d c2 d0 01 85 90 01 c4 04 ee
session_id[16]=
7b ad b5 d5 98 2f 2e 22 2c b7 8f 62 7b 2c 90 76
cipherSuite SSL_RSA_WITH_3DES_EDE_CBC_SHA
compressionMethod NULL
2 3 0.0044 (0.0007) S>CV3.0(1) ChangeCipherSpec
2 4 0.0044 (0.0000) S>CV3.0(64) Handshake
2 5 0.0048 (0.0003) C>SV3.0(1) ChangeCipherSpec
2 6 0.0048 (0.0000) C>SV3.0(64) Handshake
[EMAIL PROTECTED]@ First record below contains all of the app data.
[EMAIL PROTECTED]@ Server responds with http OK
2 7 0.1713 (0.1665) C>SV3.0(560) application_data
2 8 0.1977 (0.0263) S>CV3.0(376) application_data
2 9 0.1977 (0.0000) S>CV3.0(24) Alert
2 0.1977 (0.0000) S>C TCP FIN
2 10 0.1980 (0.0002) C>SV3.0(24) Alert
2 0.1981 (0.0001) C>S TCP FIN
0.9.7d Output
=============
maruthi-linux:> ssldump -A -i eth0 -d -X -k /home/ssl/certs/ca_key.pem
host 172.25.17.51 Enter PEM pass phrase: New TCP connection #1:
maruthi-linux.cisco.com(34600) <-> 172.25.17.51(5443) 1 1 0.0012
(0.0012) C>SV3.0(97) Handshake
ClientHello
Version 3.0
random[32]=
41 c8 de 2e 12 2d a9 82 a9 60 f6 19 8f f3 48 e6
ed 38 5f 6b d6 95 ec 84 ba c1 06 30 ac fc 0c 44
cipher suites
Unknown value 0x39
Unknown value 0x38
Unknown value 0x35
SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
SSL_RSA_WITH_3DES_EDE_CBC_SHA
Unknown value 0x33
Unknown value 0x32
Unknown value 0x2f
SSL_RSA_WITH_IDEA_CBC_SHA
SSL_DHE_DSS_WITH_RC4_128_SHA
SSL_RSA_WITH_RC4_128_SHA
SSL_RSA_WITH_RC4_128_MD5
SSL_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA
SSL_RSA_EXPORT1024_WITH_DES_CBC_SHA
SSL_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5
SSL_DHE_RSA_WITH_DES_CBC_SHA
SSL_DHE_DSS_WITH_DES_CBC_SHA
SSL_RSA_WITH_DES_CBC_SHA
SSL_DHE_DSS_WITH_RC2_56_CBC_SHA
SSL_RSA_EXPORT1024_WITH_RC4_56_SHA
SSL_RSA_EXPORT1024_WITH_RC4_56_MD5
SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA
SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA
SSL_RSA_EXPORT_WITH_DES40_CBC_SHA
SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
SSL_RSA_EXPORT_WITH_RC4_40_MD5
compression methods
NULL
1 2 0.0043 (0.0031) S>CV3.0(1871) Handshake
ServerHello
Version 3.0
random[32]=
41 c8 ed ac 7a 66 d1 b4 90 35 28 d0 c9 eb 27 09
63 94 dc 91 e6 57 80 3a 13 8f 2e 1a 09 20 c7 07
session_id[16]=
65 b0 9d be a4 c6 4c 61 ca 43 00 0f 5f 9a b7 a8
cipherSuite SSL_RSA_WITH_3DES_EDE_CBC_SHA
compressionMethod NULL
Certificate
ServerHelloDone
1 3 0.0060 (0.0016) C>SV3.0(260) Handshake
ClientKeyExchange
EncryptedPreMasterSecret[256]=
98 67 ba 70 80 53 9b f0 79 49 cc d0 19 d1 22 ed
e1 6b c8 19 df 09 21 c8 5a 85 90 5c ab 2e 13 bd
42 68 07 20 57 f9 c2 12 a5 df 3b b7 4c 80 19 6e
de 21 6a f8 aa 9f 1d a6 61 fb 47 8a d4 92 ba d6
94 bc 57 c0 d1 57 32 5f 52 62 44 5e 19 62 df df
a1 32 63 5d f7 61 52 d6 dc 80 ec 64 e0 14 c1 1b
b7 59 1f a9 1b cb 6d bb 7e da 15 36 08 af 23 d5
ee 83 2c f3 0f 2c ed 33 aa c8 20 92 e1 a2 a5 97
87 c2 21 93 aa 69 32 eb 3d f6 6c 2d 60 14 05 2f
00 b6 37 f7 75 3f 83 47 97 29 f8 9a 5c 12 e6 a7
ed f3 86 db b6 5c 8b c9 38 cb 77 9a f4 95 f0 d2
4b ce bd 65 54 a3 c2 b4 ea 5a a1 dc d8 21 85 b9
46 e0 57 a1 6f 1d 3b 3b f6 cf 3b b0 1f 60 55 fd
ba 4d d4 09 3f a7 4d 2b b1 a3 7e ef ff 9d 25 c8
71 d1 5a f4 b0 f9 f5 61 e3 fb b2 9b 8c b2 16 59
db 09 7f c2 04 f9 8b 97 da df 25 44 28 5e 70 74
1 4 0.0060 (0.0000) C>SV3.0(1) ChangeCipherSpec
1 5 0.0060 (0.0000) C>SV3.0(64) Handshake
1 6 0.0565 (0.0505) S>CV3.0(1) ChangeCipherSpec
1 7 0.0918 (0.0353) S>CV3.0(64) Handshake
[EMAIL PROTECTED]@ First record is possibly empty?
1 8 0.0922 (0.0003) C>SV3.0(24) application_data
[EMAIL PROTECTED]@ Second record contains all of the 560B of data
1 9 0.0922 (0.0000) C>SV3.0(560) application_data
[EMAIL PROTECTED]@ Webmethods sends a close notify rightaway
1 10 0.0936 (0.0013) S>CV3.0(24) Alert
1 0.0936 (0.0000) S>C TCP FIN
-Maruthi
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [email protected]
Automated List Manager [EMAIL PROTECTED]
