{"action":"closed","issue":{"url":"https://api.github.com/repos/libressl-portable/portable/issues/443","repository_url":"https://api.github.com/repos/libressl-portable/portable","labels_url":"https://api.github.com/repos/libressl-portable/portable/issues/443/labels{/name}","comments_url":"https://api.github.com/repos/libressl-portable/portable/issues/443/comments","events_url":"https://api.github.com/repos/libressl-portable/portable/issues/443/events","html_url":"https://github.com/libressl-portable/portable/issues/443","id":356466065,"node_id":"MDU6SXNzdWUzNTY0NjYwNjU=","number":443,"title":"Renegotiation is broken with specific changes in cipher suite","user":{"login":"Sp1l","id":7547697,"node_id":"MDQ6VXNlcjc1NDc2OTc=","avatar_url":"https://avatars3.githubusercontent.com/u/7547697?v=4","gravatar_id":"","url":"https://api.github.com/users/Sp1l","html_url":"https://github.com/Sp1l","followers_url":"https://api.github.com/users/Sp1l/followers","following_url":"https://api.github.com/users/Sp1l/following{/other_user}","gists_url":"https://api.github.com/users/Sp1l/gists{/gist_id}","starred_url":"https://api.github.com/users/Sp1l/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Sp1l/subscriptions","organizations_url":"https://api.github.com/users/Sp1l/orgs","repos_url":"https://api.github.com/users/Sp1l/repos","events_url":"https://api.github.com/users/Sp1l/events{/privacy}","received_events_url":"https://api.github.com/users/Sp1l/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2018-09-03T11:24:23Z","updated_at":"2018-09-05T17:30:39Z","closed_at":"2018-09-05T17:30:39Z","author_association":"CONTRIBUTOR","body":"I received a request to verify if renegotiation was working with LibreSSL from one of the Apache httpd devs.\r\nWith a bit of checking, I found out that it neither worked client- nor server-side.\r\n\r\n* cURL 7.61.0\r\n   * libcurl/7.61.0 LibreSSL/2.7.4 zlib/1.2.11 brotli/1.0.5 nghttp2/1.32.1\r\n   * libcurl/7.61.0 OpenSSL/1.0.2o zlib/1.2.11 nghttp2/1.32.1\r\n* Apache httpd\r\n   * 2.4.34 LibreSSL 2.7.4\r\n   * 2.5.1 (20180710 snapshot) OpenSSL 1.1.1pre9\r\n\r\ncURL | Apache | Result\r\n---- | ----- | -----\r\nOpenSSL| LibreSSL | SSL_read: error:140943FC:SSL routines:ssl3_read_bytes:sslv3 alert bad record mac, errno 0\r\nLibreSSL | LibreSSL | SSL_read: error:140943FC:SSL routines:ssl3_read_bytes:sslv3 alert bad record mac, errno 0\r\nLibreSSL | OpenSSL | SSL_read: error:1401E3FC:SSL routines:CONNECT_CR_FINISHED:sslv3 alert bad record mac, errno 0\r\nOpenSSL | OpenSSL | HTTP/1.1 200 OK\r\n\r\nIn all cases, the initial connection is OK, `SSL connection using TLSv1.2 / ECDHE-ECDSA-AES256-GCM-SHA384`, the errors appear in the renegotiation when the /renegotiate/cipher/ is requested.\r\n\r\nTested with `curl -ks --connect-timeout 5 -v --http1.1 https://test.brnrd.eu:42002/renegotiate/cipher`\r\nConfig in Apache httpd:\r\n```\r\nLoadModule ssl_module libexec/apache24/mod_ssl.so\r\nLoadModule socache_shmcb_module   libexec/apache24/mod_socache_shmcb.so\r\n\r\nListen 42002 https\r\n\r\nSSLHonorCipherOrder on\r\n#SSLPolicy modern\r\n# TLSv1.2 config\r\nSSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1\r\nSSLCipherSuite \"ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA\"\r\n\r\nSSLSessionCache         \"shmcb:/var/run/apache24/ssl_scache(512000)\"\r\nSSLSessionCacheTimeout  300\r\n\r\nSSLUseStapling          on\r\nSSLStaplingResponderTimeout 5\r\nSSLStaplingReturnResponderErrors off\r\nSSLStaplingCache        \"shmcb:/var/run/apache24/ocsp(128000)\"\r\n\r\nSSLCACertificateFile    \"share/certs/ca-root-nss.crt\"\r\n\r\n<VirtualHost _default_:42002>\r\nDocumentRoot www/apache24/data\r\n\r\nSSLEngine On\r\nSSLCertificateFile    /etc/ssl/certs/brnrd.eu.pem\r\nSSLCertificateKeyFile /etc/ssl/priv/brnrd.eu.key\r\n\r\n<Location /renegotiate/cipher>\r\n   SSLCipherSuite ECDHE-RSA-AES128-SHA256\r\n</Location>\r\n</VirtualHost>\r\n```"}}
{"actor":{"display_login":"4a6f656c"}}