Bug 1267218

Summary: Interleaved Application Data with Handshake data in renegotiated handshakes cause connection abort [rhel-6]
Product: Red Hat Enterprise Linux 6 Reporter: Hubert Kario <hkario>
Component: opensslAssignee: Tomas Mraz <tmraz>
Status: CLOSED WONTFIX QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: high Docs Contact:
Priority: high    
Version: 6.7CC: chorn, cww, franz.brauneder, hklein, pvrabec
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 1267220 (view as bug list) Environment:
Last Closed: 2016-06-09 12:07:30 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1172231, 1267220, 1271982    

Description Hubert Kario 2015-09-29 11:28:49 UTC 
Description of problem:
When a server receives a client initiated renegotiation and interleaved Application Data with Handshake messages in any of the subsequent handshakes, the connection is aborted with "unexpected record" error on the server side.

This causes applications like PostgreSQL JDBC driver to be incompatible with PostgreSQL.

Version-Release number of selected component (if applicable):
openssl-1.0.1e-42.el6.x86_64

How reproducible:
Always

Steps to Reproduce:
1. openssl req -x509 -newkey rsa -keyout localhost.key -out localhost.crt\
-nodes -batch
2. openssl s_server -key localhost.key -cert\
localhost.crt

In another terminal:

3. pip install --pre tlslite-ng
4. git clone https://github.com/tomato42/tlsfuzzer.git

5. cd tlsfuzzer
6. PYTHONPATH=. python scripts/test-openssl-3712.py

Actual results:
139623736735560:error:140940F5:SSL routines:SSL3_READ_BYTES:unexpected record:s3_pkt.c:1421:

Expected results:
Test pass

Additional info:
https://rt.openssl.org/Ticket/Display.html?id=3712&user=guest&pass=guest
Comment 13 Tomas Mraz 2016-06-09 12:07:30 UTC 
Upstream rejected any changes in this regard and we will not diverge.