Add a New Comment (Rich Markup)
Comment Type & Canned Response: None None
thanks for the quick fix. Looked fairly extensive.
Thank you for reporting that and for the test site. This is indeed a bug in gnutls. It does not handle session tickets when received during resumption, and even worse it terminates the handshake when it sees them.
I committed a fix for the 3.0.x releases at: http://git.savannah.gnu.org/gitweb/?p=gnutls.git;a=commitdiff;h=52f373cdf26d50e05f5dd49e4ecc8b29fc742535
correction: was rfc5077 3.3 paragraph 2
RFC5077 3.4 paragraph two allows for renewing session tickets.
I've used the openssl SSL_CTX_set_tlsext_ticket_key_cb returning the value 2 to perform a renew of the session ticket the following implementation in nginx. http://trac.nginx.org/nginx/ticket/120
I've setup a test site with 20 seconds expiry on session tickets and it attempts to renew the session ticket after 10 seconds.
A thin client program using is here: https://github.com/grooverdan/rfc5077
running the following generates:
$ ./gnutls-client -r -r -r -d 15 nginxtest.openquery.com 443 [✔] Parse arguments. [✔] Initialize GNU TLS library. [✔] Solve nginxtest.openquery.com:443: │ Will connect to 173.230.149.19 [✔] Initialize TLS session. [✔] Enable use of session tickets (RFC 5077). [✔] Connect to nginxtest.openquery.com:443. [✔] Start TLS renegotiation. [✔] Check if session was reused: │ SSL session was not used [✔] Get current session: │ Session context: │ Protocol : TLS1.2 │ Cipher : AES-128-CBC │ Kx : RSA │ Compression : NULL │ PSK : (null) │ ID : D589B43480B198100389F2223D4FC3EA162E6402AD53D03A16509D6155D57FDD [✔] Send HTTP GET. [✔] Get HTTP answer: │ HTTP/1.1 200 OK [✔] End TLS connection. [✔] waiting 15 seconds. [✔] Initialize TLS session. [✔] Enable use of session tickets (RFC 5077). [✔] Copy old session. [✔] Connect to nginxtest.openquery.com:443. [✘] Start TLS renegotiation: │ Unable to start TLS renegotiation: │ An unexpected TLS packet was received.
This was running with gnutls version 2.12.17
(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)
Attach Files: Comment:
No files currently attached
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Only logged-in users can vote.
Please enter the title of George Orwell's famous dystopian book (it's a date):
Follow 3 latest changes.
Copyright © 2022 Free Software Foundation, Inc. Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved. The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team. Source Code
Powered by Savane 3.9