Re: Deprecation of SSL v2/3

[Reindl Harald]

Am 17.04.2016 um 00:52 schrieb Leif Hedstrom:

On Apr 16, 2016, at 4:44 PM, Reindl Harald <h.rei...@thelounge.net> wrote:

Am 17.04.2016 um 00:38 schrieb Leif Hedstrom:

so what gives you ab -c 5 -n 100https://www.thelounge.net/on your client?

It fails too from that CentOS7 box to your box.

[harry@srv-rhsoft:~]$ ab -c 5 -n 100https://docs.trafficserver.apache.org/
This is ApacheBench, Version 2.3 <$Revision: 1706008 $>
Copyright 1996 Adam Twiss, Zeus Technology Ltd,http://www.zeustech.net/
Licensed to The Apache Software Foundation,http://www.apache.org/

Benchmarkingdocs.trafficserver.apache.org
<http://docs.trafficserver.apache.org/>(be patient)...^C

Server Software:        ATS/6.2.0
Server Hostname: docs.trafficserver.apache.org
<http://docs.trafficserver.apache.org/>
Server Port:            443
SSL/TLS Protocol:       TLSv1.2,ECDHE-RSA-AES128-GCM-SHA256,2048,128

So it seems your ab works against this CentOS7 box running ATS v6.2.0 ?

yes

What version of OpenSSL did you build ATS with? I am running
docs.trafficserver.a.o with OpenSSL v1.0.2g if I recall (latest stable
release)

seems not matter that much since i have this issue for years now and the httpd 
servers are built in the same environments with the same libraries and don't 
have that issue

Wonder if it could be one of those -f compiler flags? I’m attaching my 
config.nice that I run on docs.trafficserver, this compiles with ASAN though, 
so you likely want to remove that at least (if you are willing to try).

__________________________________

[root@buildserver:~]$ cat /home/builduser/.rpmrc

__________________________________

[root@buildserver:~]$ cat /home/builduser/.rpmmacros
%_topdir %(echo $HOME)/rpmbuild
%__arch_install_post /usr/lib/rpm/check-rpaths /usr/lib/rpm/check-buildroot

%fedora                 23
%dist                   .fc%fedora.%(echo $(/bin/date +%Y%m%d)).rh
%packager               Reindl Harald
%vendor                 thelounge interactive design
%php_api                .php56
%_smp_mflags            -j10
%_include_minidebuginfo 0
%_binary_payload        w1.gzdio
%_source_payload        w1.gzdio


%configure \
  CFLAGS="${CFLAGS:-%optflags}"; export CFLAGS; \
  CXXFLAGS="${CXXFLAGS:-%optflags}"; export CXXFLAGS; \
  FFLAGS="${FFLAGS:-%optflags -I%_fmoddir}"; export FFLAGS; \
  FCFLAGS="${FCFLAGS:-%optflags -I%_fmoddir}"; export FCFLAGS; \
  LDFLAGS="${LDFLAGS:-%__global_ldflags}"; export LDFLAGS; \
  ./configure \\\
   --host=x86_64-redhat-linux \\\
   --build=x86_64-redhat-linux \\\
   --target=x86_64-redhat-linux \\\
   --program-prefix=%{?_program_prefix} \\\
   --disable-dependency-tracking \\\
   --prefix=%{_prefix} \\\
   --exec-prefix=%{_exec_prefix} \\\
   --bindir=%{_bindir} \\\
   --sbindir=%{_sbindir} \\\
   --sysconfdir=%{_sysconfdir} \\\
   --datadir=%{_datadir} \\\
   --includedir=%{_includedir} \\\
   --libdir=%{_libdir} \\\
   --libexecdir=%{_libexecdir} \\\
   --localstatedir=%{_localstatedir} \\\
   --sharedstatedir=%{_sharedstatedir} \\\
   --mandir=%{_mandir} \\\
   --infodir=%{_infodir}

i will give it a try ASAP, however the whole web and mail stack is built with that flags (based on the flags below which are %{optflags} and only ATS has the specific problem optflags: x86_64 -m64 -O2 -g0 -march=sandybridge -mtune=sandybridge -fopenmp -mfpmath=sse -pipe -fno-strict-aliasing -fomit-frame-pointer -finline-functions -fexceptions -fstack-protector-strong --param=ssp-buffer-size=6 -D_FORTIFY_SOURCE=2 -Wstack-protector -Wformat -Werror=format-security %__global_ldflags -Wl,-z,now -Wl,-z,relro,-z,noexecstack -specs=/usr/lib/rpm/redhat/redhat-hardened-ld

signature.asc
Description: OpenPGP digital signature