From owner-freebsd-bugs@FreeBSD.ORG Thu Mar 7 07:40:01 2013 Return-Path: Delivered-To: freebsd-bugs@smarthost.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by hub.freebsd.org (Postfix) with ESMTP id 74F4C95 for ; Thu, 7 Mar 2013 07:40:01 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:1900:2254:206c::16:87]) by mx1.freebsd.org (Postfix) with ESMTP id 43FBC61D for ; Thu, 7 Mar 2013 07:40:01 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.6/8.14.6) with ESMTP id r277e1HB007457 for ; Thu, 7 Mar 2013 07:40:01 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.6/8.14.6/Submit) id r277e18I007456; Thu, 7 Mar 2013 07:40:01 GMT (envelope-from gnats) Resent-Date: Thu, 7 Mar 2013 07:40:01 GMT Resent-Message-Id: <201303070740.r277e18I007456@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Johannes Meixner Received: from mx1.freebsd.org (mx1.FreeBSD.org [8.8.178.115]) by hub.freebsd.org (Postfix) with ESMTP id 4446EFF8 for ; Thu, 7 Mar 2013 07:37:54 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from red.freebsd.org (red.freebsd.org [IPv6:2001:4f8:fff6::22]) by mx1.freebsd.org (Postfix) with ESMTP id 1DC3660F for ; Thu, 7 Mar 2013 07:37:54 +0000 (UTC) Received: from red.freebsd.org (localhost [127.0.0.1]) by red.freebsd.org (8.14.5/8.14.5) with ESMTP id r277br4K076713 for ; Thu, 7 Mar 2013 07:37:53 GMT (envelope-from nobody@red.freebsd.org) Received: (from nobody@localhost) by red.freebsd.org (8.14.5/8.14.5/Submit) id r277brU2076712; Thu, 7 Mar 2013 07:37:53 GMT (envelope-from nobody) Message-Id: <201303070737.r277brU2076712@red.freebsd.org> Date: Thu, 7 Mar 2013 07:37:53 GMT From: Johannes Meixner To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Subject: misc/176722: OpenSSL 1.0.1e fails to fallback to TLS1 if the server doesn't allow for anything else X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Mar 2013 07:40:01 -0000 >Number: 176722 >Category: misc >Synopsis: OpenSSL 1.0.1e fails to fallback to TLS1 if the server doesn't allow for anything else >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Thu Mar 07 07:40:00 UTC 2013 >Closed-Date: >Last-Modified: >Originator: Johannes Meixner >Release: 10.0-CURRENT >Organization: >Environment: FreeBSD xmj.local 10.0-CURRENT FreeBSD 10.0-CURRENT #2 r247490M: Fri Mar 1 19:16:27 EET 2013 root@xmj.local:/usr/obj/usr/src/sys/xmj amd64 >Description: Error first described by Pablo Almeida on https://bugs.launchpad.net/openssl/+bug/965371/ -- when trying to `openssl s_client -showcerts -connect coremis-cas.myocean.eu:443' OpenSSL1.0.1e (11 Feb 13 from ports) doesn't fall back (as it does for 0.9.8x 10 May 2012) to TLS1 and, instead of showing certs, gives CONNECTED(00000004) --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 0 bytes and written 319 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE --- However, when forcing s_client to use -tls1, the result is as expected, returning the site's certificates. Why doesn't openssl notice it can't any other method but TLS1 -- and fall back to that one, as in previous versions? >How-To-Repeat: Run `openssl s_client -showcerts -connect coremis-cas.myocean.eu:443' on OpenSSL 1.0.1e versus openssl s_client -showcerts -tls1 -connect coremis-cas.myocean.eu:443 >Fix: >Release-Note: >Audit-Trail: >Unformatted: