[openssl.org #2240] Missing Supported Point Formats Extension in ServerHello should be ignored
[ste...@uplinklabs.net - Fri Oct 01 00:59:01 2010]: The patch you attached to PR 2240 works perfectly here. Was having difficulty connecting to an OpenFire Jabber server via Gajim, Psi, and Kopete, but now I'm not. I've now committed an equivalent patch which should resolve this issue. Another fix I discovered for the Psi/Kopete issue was to use SSLv3_server_method() instead of SSLv23_server_method() in qca-ossl. Any idea why this makes a difference? That would work because the point format extension is not sent for SSLv3. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org __ OpenSSL Project http://www.openssl.org Development Mailing List openssl-dev@openssl.org Automated List Manager majord...@openssl.org
Re: [openssl.org #2240] Missing Supported Point Formats Extension in ServerHello should be ignored
Hi Steven, Can you please check the protocol and the cipher used for each case (SSLv3_server_method vs SSLv23_server_method) using the same client? The only explanation for the difference you are seeing is that when you use SSLv3_server_method, TLS extension ECPointFormats is sent with ServerHello message whereas it is not sent when SSLv23_server_method is used. -- Mounir IDRASSI IDRIX http://www.idrix.fr On 10/1/2010 12:59 AM, Steven Noonan via RT wrote: Hi Mounir, The patch you attached to PR 2240 works perfectly here. Was having difficulty connecting to an OpenFire Jabber server via Gajim, Psi, and Kopete, but now I'm not. Another fix I discovered for the Psi/Kopete issue was to use SSLv3_server_method() instead of SSLv23_server_method() in qca-ossl. Any idea why this makes a difference? - Steven __ OpenSSL Project http://www.openssl.org Development Mailing List openssl-dev@openssl.org Automated List Manager majord...@openssl.org __ OpenSSL Project http://www.openssl.org Development Mailing List openssl-dev@openssl.org Automated List Manager majord...@openssl.org
Re: [openssl.org #2240] Missing Supported Point Formats Extension in ServerHello should be ignored
Hi Mounir, The patch you attached to PR 2240 works perfectly here. Was having difficulty connecting to an OpenFire Jabber server via Gajim, Psi, and Kopete, but now I'm not. Another fix I discovered for the Psi/Kopete issue was to use SSLv3_server_method() instead of SSLv23_server_method() in qca-ossl. Any idea why this makes a difference? - Steven __ OpenSSL Project http://www.openssl.org Development Mailing List openssl-dev@openssl.org Automated List Manager majord...@openssl.org
Re: [openssl.org #2240] Missing Supported Point Formats Extension in ServerHello should be ignored
Hi Mounir, The patch you attached to PR 2240 works perfectly here. Was having difficulty connecting to an OpenFire Jabber server via Gajim, Psi, and Kopete, but now I'm not. Another fix I discovered for the Psi/Kopete issue was to use SSLv3_server_method() instead of SSLv23_server_method() in qca-ossl. Any idea why this makes a difference? - Steven __ OpenSSL Project http://www.openssl.org Development Mailing List openssl-dev@openssl.org Automated List Manager majord...@openssl.org
RE: [openssl.org #2240] Missing Supported Point Formats Extension in ServerHello should be ignored
Hello. Great! With all web servers 1)-3) works well. Here is the part of s_client message log with IIS7: [r...@mstestsv2 ~]# openssl s_client -host 192.168.220.182 -port 443 -showcerts -msg CONNECTED(0003) TLS 1.0 Handshake [length 00cd], ClientHello 01 00 00 c9 03 01 4b d4 ed a6 5e 55 e3 b9 e3 83 93 7b ba f2 e8 a3 7b 54 21 83 a9 4b 68 99 46 8e b7 b8 82 4f e3 87 00 00 5c c0 14 c0 0a 00 39 00 38 00 88 00 87 c0 0f c0 05 00 35 00 84 c0 12 c0 08 00 16 00 13 c0 0d c0 03 00 0a c0 13 c0 09 00 33 00 32 00 9a 00 99 00 45 00 44 c0 0e c0 04 00 2f 00 96 00 41 00 07 c0 11 c0 07 c0 0c c0 02 00 05 00 04 00 15 00 12 00 09 00 14 00 11 00 08 00 06 00 03 00 ff 01 00 00 44 00 0b 00 04 03 00 01 02 00 0a 00 34 00 32 00 01 00 02 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0a 00 0b 00 0c 00 0d 00 0e 00 0f 00 10 00 11 00 12 00 13 00 14 00 15 00 16 00 17 00 18 00 19 00 23 00 00 TLS 1.0 Handshake [length 004a], ServerHello 02 00 00 46 03 01 4b d4 f2 f8 3a 8b 05 e8 61 d2 4b 2f c6 f1 f6 be a5 56 e1 e9 0d 1d 3e fd cb b6 83 6b 4a f7 85 11 20 90 26 00 00 51 2f a5 f3 11 88 6d 74 3e 78 53 b3 05 f7 c0 49 fe b0 27 da 38 9b 9b 0a 0d 1f ae 7d c0 09 00 TLS 1.0 Handshake [length 05da], Certificate 0b 00 05 d6 00 05 d3 00 02 fc 30 82 02 f8 30 82 02 9d a0 03 02 01 02 02 08 33 9d 56 4d bd 65 1e fc 30 0a 06 08 2a 86 48 ce 3d 04 03 02 30 43 31 1a 30 18 06 03 55 04 03 13 11 53 48 41 32 35 36 Thanks. Regards, Koichi Sugimoto. -Original Message- From: owner-openssl-...@openssl.org [mailto:owner-openssl-...@openssl.org] On Behalf Of Mounir IDRASSI via RT Sent: Sunday, April 25, 2010 2:13 PM To: ll...@randombit.net Cc: openssl-dev@openssl.org Subject: Re: [openssl.org #2240] Missing Supported Point Formats Extension in ServerHello should be ignored Hi, I'm attaching a simple patch that should correct this behavior. Can you test it and tell us the results? Thanks, -- Mounir IDRASSI IDRIX http://www.idrix.fr Dear openssl support, I investigated the following web servers. But all of them failed with the same error. 1) apache-tomcat-6.0.26 + bcprov-ext-jdk16-145 + jdk1.6.0_17 (centos 5) 2) jboss-4.2.3.GA + bcprov-jdk15 + jdk1.6.0_17 (centos 5) 3) IIS 7 (windows 7) On the other hand, many browsers except for opera successfully connect to the servers. Something wrong? Regards, Koichi Sugimoto. 2010/4/20 Jack Lloyd via RT r...@openssl.org RFC 4492 says: A client that receives a ServerHello message containing a Supported Point Formats Extension MUST respect the server's choice of point formats during the handshake (cf. Sections 5.6 and 5.7). If no Supported Point Formats Extension is received with the ServerHello, this is equivalent to an extension allowing only the uncompressed point format. OpenSSL 1.0.0 rejects such a negotiation, always requiring the extension to exist in the ServerHello: CONNECTED(0003) TLS 1.0 Handshake [length 00cd], ClientHello 01 00 00 c9 03 01 4b cc f2 87 fc 1d 05 2d 0c 1f 4a 74 8b 8c 6f 20 c3 56 fb 35 4a 73 b0 9c e0 c1 6f 34 1b 10 f9 9f 00 00 5c c0 14 c0 0a 00 39 00 38 00 88 00 87 c0 0f c0 05 00 35 00 84 c0 12 c0 08 00 16 00 13 c0 0d c0 03 00 0a c0 13 c0 09 00 33 00 32 00 9a 00 99 00 45 00 44 c0 0e c0 04 00 2f 00 96 00 41 00 07 c0 11 c0 07 c0 0c c0 02 00 05 00 04 00 15 00 12 00 09 00 14 00 11 00 08 00 06 00 03 00 ff 01 00 00 44 00 0b 00 04 03 00 01 02 00 0a 00 34 00 32 00 01 00 02 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0a 00 0b 00 0c 00 0d 00 0e 00 0f 00 10 00 11 00 12 00 13 00 14 00 15 00 16 00 17 00 18 00 19 00 23 00 00 TLS 1.0 Handshake [length 002a], ServerHello 02 00 00 26 03 01 20 3f 72 c5 29 9f 22 b1 a6 af 4b 81 31 eb 4c 85 bf bb 3a a5 8b b8 21 86 16 c5 7c 84 5c 73 4a 4a 00 c0 08 00 139742562498200:error:1411809D:SSL routines:SSL_CHECK_SERVERHELLO_TLSEXT:tls invalid ecpointformat list:t1_lib.c:1440: 139742562498200:error:14092113:SSL routines:SSL3_GET_SERVER_HELLO:serverhello tlsext:s3_clnt.c:942: OpenSSL 1.0.0 29 Mar 2010 built on: Mon Apr 19 19:52:35 EDT 2010 platform: linux-x86_64 options: bn(64,64) rc4(1x,char) des(idx,cisc,16,int) idea(int) blowfish(idx) compiler: gcc -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -m64 -DL_ENDIAN -DTERMIO -O3 -Wall -DMD32_REG_T=int -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DWHIRLPOOL_ASM OPENSSLDIR: /usr/local/ssl __ OpenSSL Project http://www.openssl.org Development Mailing List openssl-dev@openssl.org Automated List Manager majord...@openssl.org smime.p7s Description: S/MIME cryptographic signature
Re: [openssl.org #2240] Missing Supported Point Formats Extension in ServerHello should be ignored
Hi, I'm attaching a simple patch that should correct this behavior. Can you test it and tell us the results? Thanks, -- Mounir IDRASSI IDRIX http://www.idrix.fr Dear openssl support, I investigated the following web servers. But all of them failed with the same error. 1) apache-tomcat-6.0.26 + bcprov-ext-jdk16-145 + jdk1.6.0_17 (centos 5) 2) jboss-4.2.3.GA + bcprov-jdk15 + jdk1.6.0_17 (centos 5) 3) IIS 7 (windows 7) On the other hand, many browsers except for opera successfully connect to the servers. Something wrong? Regards, Koichi Sugimoto. 2010/4/20 Jack Lloyd via RT r...@openssl.org RFC 4492 says: A client that receives a ServerHello message containing a Supported Point Formats Extension MUST respect the server's choice of point formats during the handshake (cf. Sections 5.6 and 5.7). If no Supported Point Formats Extension is received with the ServerHello, this is equivalent to an extension allowing only the uncompressed point format. OpenSSL 1.0.0 rejects such a negotiation, always requiring the extension to exist in the ServerHello: CONNECTED(0003) TLS 1.0 Handshake [length 00cd], ClientHello 01 00 00 c9 03 01 4b cc f2 87 fc 1d 05 2d 0c 1f 4a 74 8b 8c 6f 20 c3 56 fb 35 4a 73 b0 9c e0 c1 6f 34 1b 10 f9 9f 00 00 5c c0 14 c0 0a 00 39 00 38 00 88 00 87 c0 0f c0 05 00 35 00 84 c0 12 c0 08 00 16 00 13 c0 0d c0 03 00 0a c0 13 c0 09 00 33 00 32 00 9a 00 99 00 45 00 44 c0 0e c0 04 00 2f 00 96 00 41 00 07 c0 11 c0 07 c0 0c c0 02 00 05 00 04 00 15 00 12 00 09 00 14 00 11 00 08 00 06 00 03 00 ff 01 00 00 44 00 0b 00 04 03 00 01 02 00 0a 00 34 00 32 00 01 00 02 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0a 00 0b 00 0c 00 0d 00 0e 00 0f 00 10 00 11 00 12 00 13 00 14 00 15 00 16 00 17 00 18 00 19 00 23 00 00 TLS 1.0 Handshake [length 002a], ServerHello 02 00 00 26 03 01 20 3f 72 c5 29 9f 22 b1 a6 af 4b 81 31 eb 4c 85 bf bb 3a a5 8b b8 21 86 16 c5 7c 84 5c 73 4a 4a 00 c0 08 00 139742562498200:error:1411809D:SSL routines:SSL_CHECK_SERVERHELLO_TLSEXT:tls invalid ecpointformat list:t1_lib.c:1440: 139742562498200:error:14092113:SSL routines:SSL3_GET_SERVER_HELLO:serverhello tlsext:s3_clnt.c:942: OpenSSL 1.0.0 29 Mar 2010 built on: Mon Apr 19 19:52:35 EDT 2010 platform: linux-x86_64 options: bn(64,64) rc4(1x,char) des(idx,cisc,16,int) idea(int) blowfish(idx) compiler: gcc -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -m64 -DL_ENDIAN -DTERMIO -O3 -Wall -DMD32_REG_T=int -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DWHIRLPOOL_ASM OPENSSLDIR: /usr/local/ssl __ OpenSSL Project http://www.openssl.org Development Mailing List openssl-dev@openssl.org Automated List Manager majord...@openssl.org t1_lib.c.diff Description: Binary data
Re: [openssl.org #2240] Missing Supported Point Formats Extension in ServerHello should be ignored
Hi, I'm attaching a simple patch that should correct this behavior. Can you test it and tell us the results? Thanks, -- Mounir IDRASSI IDRIX http://www.idrix.fr Dear openssl support, I investigated the following web servers. But all of them failed with the same error. 1) apache-tomcat-6.0.26 + bcprov-ext-jdk16-145 + jdk1.6.0_17 (centos 5) 2) jboss-4.2.3.GA + bcprov-jdk15 + jdk1.6.0_17 (centos 5) 3) IIS 7 (windows 7) On the other hand, many browsers except for opera successfully connect to the servers. Something wrong? Regards, Koichi Sugimoto. 2010/4/20 Jack Lloyd via RT r...@openssl.org RFC 4492 says: A client that receives a ServerHello message containing a Supported Point Formats Extension MUST respect the server's choice of point formats during the handshake (cf. Sections 5.6 and 5.7). If no Supported Point Formats Extension is received with the ServerHello, this is equivalent to an extension allowing only the uncompressed point format. OpenSSL 1.0.0 rejects such a negotiation, always requiring the extension to exist in the ServerHello: CONNECTED(0003) TLS 1.0 Handshake [length 00cd], ClientHello 01 00 00 c9 03 01 4b cc f2 87 fc 1d 05 2d 0c 1f 4a 74 8b 8c 6f 20 c3 56 fb 35 4a 73 b0 9c e0 c1 6f 34 1b 10 f9 9f 00 00 5c c0 14 c0 0a 00 39 00 38 00 88 00 87 c0 0f c0 05 00 35 00 84 c0 12 c0 08 00 16 00 13 c0 0d c0 03 00 0a c0 13 c0 09 00 33 00 32 00 9a 00 99 00 45 00 44 c0 0e c0 04 00 2f 00 96 00 41 00 07 c0 11 c0 07 c0 0c c0 02 00 05 00 04 00 15 00 12 00 09 00 14 00 11 00 08 00 06 00 03 00 ff 01 00 00 44 00 0b 00 04 03 00 01 02 00 0a 00 34 00 32 00 01 00 02 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0a 00 0b 00 0c 00 0d 00 0e 00 0f 00 10 00 11 00 12 00 13 00 14 00 15 00 16 00 17 00 18 00 19 00 23 00 00 TLS 1.0 Handshake [length 002a], ServerHello 02 00 00 26 03 01 20 3f 72 c5 29 9f 22 b1 a6 af 4b 81 31 eb 4c 85 bf bb 3a a5 8b b8 21 86 16 c5 7c 84 5c 73 4a 4a 00 c0 08 00 139742562498200:error:1411809D:SSL routines:SSL_CHECK_SERVERHELLO_TLSEXT:tls invalid ecpointformat list:t1_lib.c:1440: 139742562498200:error:14092113:SSL routines:SSL3_GET_SERVER_HELLO:serverhello tlsext:s3_clnt.c:942: OpenSSL 1.0.0 29 Mar 2010 built on: Mon Apr 19 19:52:35 EDT 2010 platform: linux-x86_64 options: bn(64,64) rc4(1x,char) des(idx,cisc,16,int) idea(int) blowfish(idx) compiler: gcc -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -m64 -DL_ENDIAN -DTERMIO -O3 -Wall -DMD32_REG_T=int -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DWHIRLPOOL_ASM OPENSSLDIR: /usr/local/ssl __ OpenSSL Project http://www.openssl.org Development Mailing List openssl-dev@openssl.org Automated List Manager majord...@openssl.org t1_lib.c.diff Description: Binary data
Re: [openssl.org #2240] Missing Supported Point Formats Extension in ServerHello should be ignored
Dear openssl support, I investigated the following web servers. But all of them failed with the same error. 1) apache-tomcat-6.0.26 + bcprov-ext-jdk16-145 + jdk1.6.0_17 (centos 5) 2) jboss-4.2.3.GA + bcprov-jdk15 + jdk1.6.0_17 (centos 5) 3) IIS 7 (windows 7) On the other hand, many browsers except for opera successfully connect to the servers. Something wrong? Regards, Koichi Sugimoto. 2010/4/20 Jack Lloyd via RT r...@openssl.org RFC 4492 says: A client that receives a ServerHello message containing a Supported Point Formats Extension MUST respect the server's choice of point formats during the handshake (cf. Sections 5.6 and 5.7). If no Supported Point Formats Extension is received with the ServerHello, this is equivalent to an extension allowing only the uncompressed point format. OpenSSL 1.0.0 rejects such a negotiation, always requiring the extension to exist in the ServerHello: CONNECTED(0003) TLS 1.0 Handshake [length 00cd], ClientHello 01 00 00 c9 03 01 4b cc f2 87 fc 1d 05 2d 0c 1f 4a 74 8b 8c 6f 20 c3 56 fb 35 4a 73 b0 9c e0 c1 6f 34 1b 10 f9 9f 00 00 5c c0 14 c0 0a 00 39 00 38 00 88 00 87 c0 0f c0 05 00 35 00 84 c0 12 c0 08 00 16 00 13 c0 0d c0 03 00 0a c0 13 c0 09 00 33 00 32 00 9a 00 99 00 45 00 44 c0 0e c0 04 00 2f 00 96 00 41 00 07 c0 11 c0 07 c0 0c c0 02 00 05 00 04 00 15 00 12 00 09 00 14 00 11 00 08 00 06 00 03 00 ff 01 00 00 44 00 0b 00 04 03 00 01 02 00 0a 00 34 00 32 00 01 00 02 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0a 00 0b 00 0c 00 0d 00 0e 00 0f 00 10 00 11 00 12 00 13 00 14 00 15 00 16 00 17 00 18 00 19 00 23 00 00 TLS 1.0 Handshake [length 002a], ServerHello 02 00 00 26 03 01 20 3f 72 c5 29 9f 22 b1 a6 af 4b 81 31 eb 4c 85 bf bb 3a a5 8b b8 21 86 16 c5 7c 84 5c 73 4a 4a 00 c0 08 00 139742562498200:error:1411809D:SSL routines:SSL_CHECK_SERVERHELLO_TLSEXT:tls invalid ecpointformat list:t1_lib.c:1440: 139742562498200:error:14092113:SSL routines:SSL3_GET_SERVER_HELLO:serverhello tlsext:s3_clnt.c:942: OpenSSL 1.0.0 29 Mar 2010 built on: Mon Apr 19 19:52:35 EDT 2010 platform: linux-x86_64 options: bn(64,64) rc4(1x,char) des(idx,cisc,16,int) idea(int) blowfish(idx) compiler: gcc -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -m64 -DL_ENDIAN -DTERMIO -O3 -Wall -DMD32_REG_T=int -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DWHIRLPOOL_ASM OPENSSLDIR: /usr/local/ssl __ OpenSSL Project http://www.openssl.org Development Mailing List openssl-dev@openssl.org Automated List Manager majord...@openssl.org
[openssl.org #2240] Missing Supported Point Formats Extension in ServerHello should be ignored
RFC 4492 says: A client that receives a ServerHello message containing a Supported Point Formats Extension MUST respect the server's choice of point formats during the handshake (cf. Sections 5.6 and 5.7). If no Supported Point Formats Extension is received with the ServerHello, this is equivalent to an extension allowing only the uncompressed point format. OpenSSL 1.0.0 rejects such a negotiation, always requiring the extension to exist in the ServerHello: CONNECTED(0003) TLS 1.0 Handshake [length 00cd], ClientHello 01 00 00 c9 03 01 4b cc f2 87 fc 1d 05 2d 0c 1f 4a 74 8b 8c 6f 20 c3 56 fb 35 4a 73 b0 9c e0 c1 6f 34 1b 10 f9 9f 00 00 5c c0 14 c0 0a 00 39 00 38 00 88 00 87 c0 0f c0 05 00 35 00 84 c0 12 c0 08 00 16 00 13 c0 0d c0 03 00 0a c0 13 c0 09 00 33 00 32 00 9a 00 99 00 45 00 44 c0 0e c0 04 00 2f 00 96 00 41 00 07 c0 11 c0 07 c0 0c c0 02 00 05 00 04 00 15 00 12 00 09 00 14 00 11 00 08 00 06 00 03 00 ff 01 00 00 44 00 0b 00 04 03 00 01 02 00 0a 00 34 00 32 00 01 00 02 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0a 00 0b 00 0c 00 0d 00 0e 00 0f 00 10 00 11 00 12 00 13 00 14 00 15 00 16 00 17 00 18 00 19 00 23 00 00 TLS 1.0 Handshake [length 002a], ServerHello 02 00 00 26 03 01 20 3f 72 c5 29 9f 22 b1 a6 af 4b 81 31 eb 4c 85 bf bb 3a a5 8b b8 21 86 16 c5 7c 84 5c 73 4a 4a 00 c0 08 00 139742562498200:error:1411809D:SSL routines:SSL_CHECK_SERVERHELLO_TLSEXT:tls invalid ecpointformat list:t1_lib.c:1440: 139742562498200:error:14092113:SSL routines:SSL3_GET_SERVER_HELLO:serverhello tlsext:s3_clnt.c:942: OpenSSL 1.0.0 29 Mar 2010 built on: Mon Apr 19 19:52:35 EDT 2010 platform: linux-x86_64 options: bn(64,64) rc4(1x,char) des(idx,cisc,16,int) idea(int) blowfish(idx) compiler: gcc -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -m64 -DL_ENDIAN -DTERMIO -O3 -Wall -DMD32_REG_T=int -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DWHIRLPOOL_ASM OPENSSLDIR: /usr/local/ssl __ OpenSSL Project http://www.openssl.org Development Mailing List openssl-dev@openssl.org Automated List Manager majord...@openssl.org
