upstream/monitoring-plugins
1
0
Fork 0
mirror of https://github.com/monitoring-plugins/monitoring-plugins.git synced 2026-04-20 21:57:10 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Disable stateless SSL session resumption

Browse source 
Some versions of OpenSSL fail to negotiate the SSL connection with at
least some versions of Tomcat if stateless SSL session resumption
support (see RFC4507) is enabled:

| CRITICAL - Cannot make SSL connection
| 140099330348712:error:140943F2:SSL routines:SSL3_READ_BYTES:sslv3 alert unexpected message:s3_pkt.c:1195:SSL alert number 10

The problem is reproducible with OpenSSL 1.0.0h, but not with OpenSSL
0.9.8o-4squeeze12 (as shipped with Debian 6.0.4).  We work around it by
disabling the RFC4507 functionality when using OpenSSL versions which
support it.

Thanks to Dag Bakke for reporting the issue and for giving me access to
a server I could use to reproduce the problem.
This commit is contained in:
Holger Weiss 2012-05-07 12:11:48 +02:00
parent efa2a32a16
commit 5a5d3d7013
2 changed files with 4 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
NEWS
View file

@ -20,6 +20,7 @@ This file documents the major additions and syntax changes between releases.
Fix check_procs where regex input of '|' would get displayed in output - now replaced with ','
Fix segfault in check_host when hostname returns multiple IP addresses (Sebastian Harl)
Fix check_smtp and check_tcp where duplicate messages were displayed for certificate errors
Disable RFC4507 support, to work around SSL negotiation issues with (at least) some Tomcat versions
1.4.15 27th July 2010
ENHANCEMENTS

3
plugins/sslutils.c
View file

@ -52,6 +52,9 @@ int np_net_ssl_init_with_hostname (int sd, char *host_name) {
printf ("%s\n", _("CRITICAL - Cannot create SSL context."));
return STATE_CRITICAL;
}
#ifdef SSL_OP_NO_TICKET
SSL_CTX_set_options(c, SSL_OP_NO_TICKET);
#endif
if ((s = SSL_new (c)) != NULL){
#ifdef SSL_set_tlsext_host_name
if (host_name != NULL)