[openssl-users] The default cipher of executable 'openssl'

[Aaron]

Hi Dave,

Thanks for your comments.

I am not really familiar with OpenSSL, so some parts of my descriptions may
not be not very clear.

Right, I am talking about s_server subcommand. You mentioned that there is
no change in this area. However I can easily show something is change using
s_server subcommand. I am using original OpenSSL code to build my 'openssl',
to this change is not from me.

1) 1.0.1l 
./apps/openssl s_server -ssl3 -cert certdb/ssl_server.pem -WWW -CAfile
certdb/cafile.pem 
Using default temp DH parameters 
Using default temp ECDH parameters 
ACCEPT 

2) 1.0.2 
./apps/openssl s_server -ssl3 -cert certdb/ssl_server.pem -WWW -CAfile
certdb/cafile.pem 
Using default temp DH parameters 
ACCEPT 

Note that, in 1.0.2, openssl doesn't print out 'Using default temp ECDH
parameters'. 

I checked related code in s_server.c and ssl_conf.c, There are some updates.
Some related code is moved from s_server.c to ssl_conf.c. However I haven't
found the root cause of this change. 

I encountered a similar issue when upgrading from OpenSSL 1.0.1l to 1.0.1m.
I paste my analysis and fix below. After I applied my fix, the issue
disappeared.
1) Analysis
File s_server.c was updated in OpenSSL 1.0.1m. Variable 'no_ecdhe' was
uninitialized after the update. This causes the condition of the if
statement (if (!no_ecdheon) {...}) on line 1682 not to be true. Then
ECDHE-RSA-AES256-SHA is not the default temp ECDH parameters of 'openssl
s_server' any more.

2) Fix
273   diff -wruN openssl-1.0.1m.original/apps/s_server.c
openssl-1.0.1m.working/apps/s_server.c
274   --- openssl-1.0.1m.original/apps/s_server.c     2015-03-19
06:37:10.000000000 -0700
275   +++ openssl-1.0.1m.working/apps/s_server.c      2015-05-25
01:46:35.000000000 -0700
276   @@ -998,7 +998,7 @@
277        int off = 0;
278        int no_tmp_rsa = 0, no_dhe = 0, nocert = 0;
279    #ifndef OPENSSL_NO_ECDH
280   -    int no_ecdhe;
281   +    int no_ecdhe = 0;
282    #endif
283        int state = 0;
284        const SSL_METHOD *meth = NULL;

I noticed that the issue in 1.0.2 is not the same as the issue in 1.0.1m.
The issue started to appear in 1.0.2 rather than 1.0.2a.

Thanks,
Aaron




--
View this message in context: http://openssl.6102.n7.nabble.com/The-behavior-change-of-command-line-utility-openssl-tp58557p58631.html
Sent from the OpenSSL - User mailing list archive at Nabble.com.