Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

OpenSslEngine should not call SSL_set_state

See original GitHub issue

OpenSslEngine currently calls SSL_set_state(SSL_ST_ACCEPT) during the renegotiation process. The OpenSSL team has advised against this [1]. We should investigate and avoid calling SSL_ST_ACCEPT if possible.

[1] https://github.com/openssl/openssl/issues/2551#issuecomment-277644153

Issue Analytics

State:
Created 7 years ago
Reactions:2
Comments:5 (3 by maintainers)

Top GitHub Comments

3reactions

normanmaurercommented, Oct 24, 2017

@Scottmitch I wonder if we should just remove the support for renegotiation as its risky business anyway. This would also allow us to just drop set_state usage and so support openssl 1.1.x.

WDYT ?

@carl-mastrangelo @ejona86 @nmittler WDYT as well?

1reaction

snazycommented, Apr 6, 2017

OpenSSL 1.1.0e cannot be used in netty-tcnative, because SSL_set_state no longer exists in OpenSSL since 1.1.0 (https://github.com/netty/netty-tcnative/issues/263). Given that OpenSSL 1.1.1 (hopefully) supports TLS 1.3, it seems worth to remove usage of SSL_set_state.

Top Results From Across the Web

Netty | Java example | OpenSslEngine.java - Alvin Alexander

This example Java source code file (OpenSslEngine.java) is included in the alvinalexander.com "Java Source Code Warehouse" project. The intent of this project ...

Architecture specific change in rpms/netty.git - Arch-excludes

The package rpms/netty.git has added or updated architecture specific content in its spec file (ExclusiveArch/ExcludeArch or ...

Diff - external/netty-tcnative - Google Git

+ * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use...

Java Examples for java.nio.ReadOnlyBufferException

The output buffer's * position will have advanced by n, where n is the value returned * by this method; the output buffer's...