<div dir="ltr"><div><div><div>Hi Matt,<br></div>Thanks for such a detailed reply. I will work on the pointers provided. And will plan to move openssl implementation to 1.0.2 series as suggested. I will check the random method used if that is the cause of this issue.<br><br></div>Many thanks,<br></div>Senthil.<br><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Jan 26, 2017 at 3:38 PM, Matt Caswell <span dir="ltr"><<a href="mailto:matt@openssl.org" target="_blank">matt@openssl.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class=""><br>
<br>
On 26/01/17 04:38, Senthil Raja Velu wrote:<br>
> Hi,<br>
> I have a setup where the handshake between openssl server and client<br>
> fails at times but not always. And when it does, the client keeps<br>
> retrying and all of trials fail. Only way to recover is to restart the<br>
> server.<br>
><br>
> Currently on the server side the openssl version that I have installed<br>
> is 1.0.1m.<br>
<br>
</span>That's quite an old version and is likely to be vulnerable to various<br>
security issues. You should upgrade. Further the 1.0.1 series is no<br>
longer supported (unless your 1.0.1m is actually supplied by your OS<br>
vendor - in which case they may be backporting security fixes to it). If<br>
you are not using an OS supplied version then I recommend you upgrade to<br>
version 1.0.2k (which should be a straight forward upgrade) or 1.1.0d<br>
(which may be more difficult). Those versions will be released later today.<br>
<span class=""><br>
> The SSL code path </server/openssl/ssl/s3_srvr.<wbr>c:1265> refers to the<br>
> following section of code in ssl3_get_client_hello() routine in s3_srvr.c.<br>
><br>
> ------------------------------<wbr>------------------------------<wbr>--------------<br>
> /*<br>
> * Check if we want to use external pre-shared secret for this handshake<br>
> * for not reused session only. We need to generate server_random before<br>
> * calling tls_session_secret_cb in order to allow SessionTicket<br>
> * processing to use it in key derivation.<br>
> */<br>
> {<br>
> unsigned char *pos;<br>
> pos = s->s3->server_random;<br>
> if (ssl_fill_hello_random(s, 1, pos, SSL3_RANDOM_SIZE) <= 0) {<br>
> #ifdef USER_EXTENSIONS<br>
> SSLerr(SSL_F_SSL3_GET_CLIENT_<wbr>HELLO, ERR_R_INTERNAL_ERROR);<br>
> #endif // USER_EXTENSIONS<br>
> goto f_err;<br>
> }<br>
> }<br>
> ------------------------------<wbr>------------------------------<wbr>--------------<br>
><br>
> Note, I have edited the SSL library to include this USER_EXTENSIONS<br>
> section, so that I could confirm where exactly this issue is happening<br>
> in the library.<br>
><br>
> Clearly ssl_fill_hello_ramdom() routine is returning -1 or something<br>
> less than zero.<br>
<br>
</span>Well zero or less to be exact. The code for ssl_fill_hello_random()<br>
looks like this:<br>
<br>
int ssl_fill_hello_random(SSL *s, int server, unsigned char *result, int<br>
len)<br>
{<br>
int send_time = 0;<br>
<br>
if (len < 4)<br>
return 0;<br>
if (server)<br>
send_time = (s->mode & SSL_MODE_SEND_SERVERHELLO_<wbr>TIME) != 0;<br>
else<br>
send_time = (s->mode & SSL_MODE_SEND_CLIENTHELLO_<wbr>TIME) != 0;<br>
if (send_time) {<br>
unsigned long Time = (unsigned long)time(NULL);<br>
unsigned char *p = result;<br>
l2n(Time, p);<br>
return RAND_pseudo_bytes(p, len - 4);<br>
} else<br>
return RAND_pseudo_bytes(result, len);<br>
}<br>
<br>
<br>
As you can see it can return 0 if len < 4 - but in this case it is clear<br>
that that isn't happening (because len is set to SSL3_RANDOM_SIZE == 32).<br>
<br>
Otherwise it returns the result of RAND_pseudo_bytes(). There are a few<br>
reasons why that function returns <= 0:<br>
<br>
1) It can't find the random method to use (either built-in or default).<br>
This is really a "should never happen" type condition.<br>
<br>
2) If using the default random method then it has insufficient entropy.<br>
<br>
3) If using an engine supplied random method, then it has failed for<br>
some engine specific reason.<br>
<br>
Are you using an engine that might supply its own random method? If so<br>
you might want to look at whether that is failing.<br>
<br>
If not, then look here:<br>
<a href="https://www.openssl.org/docs/faq.html#USER1" rel="noreferrer" target="_blank">https://www.openssl.org/docs/<wbr>faq.html#USER1</a><br>
<br>
Incidentally if you were to do the upgrade to 1.0.2 or 1.1.0 then you<br>
would probably get an additional error message confirming that it is a<br>
low entropy issue. In 1.0.2 the RAND_pseudo_bytes() call has been<br>
changed to RAND_bytes(). These two are very similar, but on failure due<br>
to low entropy RAND_bytes() puts an error in the error queue.<br>
<span class="HOEnZb"><font color="#888888"><br>
Matt<br>
--<br>
openssl-users mailing list<br>
To unsubscribe: <a href="https://mta.openssl.org/mailman/listinfo/openssl-users" rel="noreferrer" target="_blank">https://mta.openssl.org/<wbr>mailman/listinfo/openssl-users</a><br>
</font></span></blockquote></div><br></div>