SSL Renegotiation in openssl using blocking sockets

1
votes

This is regarding openssl renegotiation issue in client server communication.The openssl version is 1.0.1c.

The client and server are establishing the SSL connection using blocking sockets and communication is fine.The client sends the data and server receives and send back to client.

When server want to do renegotiation it is done using SSL_renogotiate, SSL_do_handshake after that setting SSL state as SSL_ST_ACCEPT.

The client side general behaviour is waiting on console to read data using SSL_write to send it to server.During this time if server renegotiates and client side sends any data from console by calling SSL_write the rehandshake is failed.

The following lines are printed at server side returning -1 from second SSL_do_handshake

3086063264:error:140940F5:SSL routines:SSL3_READ_BYTES:unexpected record:s3_pkt.c:1404:

The following lines are printed at client side when it is reading using SSL_read which is returning -1 after it sends data to server

3086079648:error:140943F2:SSL routines:SSL3_READ_BYTES:sslv3 alert unexpected message:s3_pkt.c:1251:SSL alert number 10 3086079648:error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure:s3_pkt.c:1151:

In openssl.org for blocking sockets following is given

If the underlying BIO is blocking, SSL_write() will only return, once the write operation has been finished or an error occurred, except when a renegotiation take place, in which case a SSL_ERROR_WANT_READ may occur.

How exactly SSL_write behaves at the clint side when it receives SSL renogotiation. How can the rehandshake be successful in this case.

Regards, Pradeep

1
openssl

1 Answers

1
votes

SSL_write will return in a blocking context if the underlying SSL channel needs a read or write operation for renegotiation. You can permit SSL to automatically renegotiate by using SSL_set_mode with SSL_MODE_AUTO_RETRY. This flag can be set per connection, or on the CTX.

(documentation)