Bug 1680118

Description of problem:
When TLS 1.2 client attempts client initiated renegotiation, httpd just closes the TCP connection. RFC 5246 specifies the no_renegotiation alert as the recommended way to inform client that renegotiation is not supported. The server in such situation shouldn't close the connection, but allow the client to select next course of action.

Version-Release number of selected component (if applicable):
httpd-2.4.37-10.module+el8+2764+7127e69e.x86_64
mod_ssl-2.4.37-10.module+el8+2764+7127e69e.x86_64
openssl-1.1.1-8.el8.x86_64

How reproducible:
always

Steps to Reproduce:
setup mod_ssl with default configuration

git clone https://github.com/tomato42/tlsfuzzer
pushd tlsfuzzer
git clone https://github.com/tomato42/tlslite-ng .tlslite-ng
ln -s .tlslite-ng/tlslite tlslite
git clone https://github.com/warner/python-ecdsa .python-ecdsa
ln -s .python-ecdsa/src/ecdsa ecdsa
PYTHONPATH=. python3 scripts/test-renegotiation-disabled.py -h localhost -p 443 "try secure renegotiation with GET after 2nd CH"


Actual results:
try secure renegotiation with GET after 2nd CH ...
Error encountered while processing node <tlsfuzzer.expect.ExpectAlert object at 0x7fdf7dd73208> (child: <tlsfuzzer.messages.ApplicationDataGenerator object at 0x7fdf7dd73278>) with last message being: None
Error while processing
Traceback (most recent call last):
  File "/root/tlsfuzzer/tlsfuzzer/runner.py", line 184, in run
    header, parser = self.state.msg_sock.\
  File "/root/tlsfuzzer/tlslite/messagesocket.py", line 102, in recvMessageBlocking
    for res in self.recvMessage():
  File "/root/tlsfuzzer/tlslite/messagesocket.py", line 84, in recvMessage
    for ret in self.recvRecord():
  File "/root/tlsfuzzer/tlslite/recordlayer.py", line 894, in recvRecord
    for result in self._recordSocket.recv():
  File "/root/tlsfuzzer/tlslite/recordlayer.py", line 211, in recv
    for record in self._recvHeader():
  File "/root/tlsfuzzer/tlslite/recordlayer.py", line 145, in _recvHeader
    for result in self._sockRecvAll(1):
  File "/root/tlsfuzzer/tlslite/recordlayer.py", line 132, in _sockRecvAll
    raise TLSAbruptCloseError()
tlslite.errors.TLSAbruptCloseError: TLSAbruptCloseError()

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "scripts/test-renegotiation-disabled.py", line 283, in main
    runner.run()
  File "/root/tlsfuzzer/tlsfuzzer/runner.py", line 207, in run
    "Unexpected closure from peer")
AssertionError: Unexpected closure from peer

Expected results:
try secure renegotiation with GET after 2nd CH ...
ok

Additional info:
While the RFC recommends continuation of the connection, it is technically acceptable to close the connection by sending two alerts, first no_renegotiation to announce lack of support and then close_notify to perform orderly shutdown.

if this is the expected behaviour of httpd, the script can be run like so to verify it:
PYTHONPATH=. python3 scripts/test-renegotiation-disabled.py -h localhost -p 443 --no-renego-close "try secure renegotiation with GET after 2nd CH"