Bug 527015

Summary: DTLS broken in 1.0.0-beta3
Product: [Fedora] Fedora Reporter: David Woodhouse <dwmw2>
Component: opensslAssignee: Tomas Mraz <tmraz>
Status: CLOSED RAWHIDE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: low    
Version: rawhideCC: tmraz
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2009-10-09 08:40:34 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 473302    
Attachments:
Description Flags
Patch none

Description David Woodhouse 2009-10-03 08:40:16 UTC 
As soon as the openconnect VPN client tries to call SSL_read() on a DTLS connection, it goes into an endless loop.

GDB is useless...

(gdb) bt
#0  0xffffffffff60013b in ?? ()
#1  0x00007fff4c765610 in ?? ()
#2  0x00007fff4c7ff644 in ?? ()
Backtrace stopped: previous frame identical to this frame (corrupt stack?)

The fix is already in the 1.0.0 branch in CVS; it's the second hunk of RT#1993:
http://rt.openssl.org/Ticket/Display.html?id=1993&user=guest&pass=guest

--- ssl/d1_pkt.c 2009-07-13 13:44:04.000000000 +0200
+++ ssl/d1_pkt.c 2009-07-23 12:47:41.000000000 +0200
@@ -775,7 +775,7 @@
/* Check for timeout */
if (dtls1_is_timer_expired(s))
{
- if (dtls1_read_failed(s, -1) > 0);
+ if (dtls1_read_failed(s, -1) > 0)
goto start;
}
Comment 1 David Woodhouse 2009-10-03 08:48:13 UTC 
Created attachment 363544 [details]
Patch
Comment 2 David Woodhouse 2009-10-08 16:37:06 UTC 
Is it OK for me to commit this patch and build a new package?

This bug has broken my VPN connectivity under F-12.
Comment 3 Tomas Mraz 2009-10-08 18:01:37 UTC 
I'll commit&build it but we will also need a releng request to tag it into F-12.
Comment 4 Tomas Mraz 2009-10-09 08:40:34 UTC 
Built as openssl-1.0.0-0.beta3.9.fc12.
Also created a tag request https://fedorahosted.org/rel-eng/ticket/2417
Comment 5 David Woodhouse 2009-10-09 09:19:20 UTC 
VPN works with this package; thanks.