Skip to content

Commit 85d8d44

Browse files
committed
Try to fix the renegotiation problem
as suggested, see #2765 (comment)
1 parent a685fc2 commit 85d8d44

1 file changed

Lines changed: 2 additions & 2 deletions

File tree

testssl.sh

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17656,7 +17656,7 @@ run_renego() {
1765617656
# s_client STDIN too early as the close could come at any time and race with the tear down of s_client.
1765717657
# See https://github.com/drwetter/testssl.sh/issues/2590
1765817658
# In this case the added iteration is harmless as it will just spin in backgroup
17659-
for ((i=0; i <= ssl_reneg_attempts; i++ )); do sleep $ssl_reneg_wait; /usr/bin/echo R 2>/dev/null; k=0; \
17659+
for ((i=0; i <= ssl_reneg_attempts; i++ )); do sleep $ssl_reneg_wait; echo R 2>/dev/null; k=0; \
1766017660
# 0 means client is renegotiating & doesn't return an error --> vuln!
1766117661
# 1 means client tried to renegotiating but the server side errored then. You still see RENEGOTIATING in the output
1766217662
# Exemption from above: server closed the connection but return value was zero
@@ -17665,7 +17665,7 @@ run_renego() {
1766517665
&& [[ $(tail -1 $ERRFILE | grep -acE '^(RENEGOTIATING|depth|verify|notAfter)') -eq 1 ]] \
1766617666
&& [[ $k -lt 120 ]]; \
1766717667
do sleep $ssl_reneg_wait; ((k++)); if (tail -5 $TMPFILE| grep -qa '^closed'); then break; fi; done; \
17668-
done) | \
17668+
done) 2> /dev/null | \
1766917669
$OPENSSL_NOTIMEOUT s_client $(s_client_options "$proto $legacycmd $STARTTLS $BUGS -connect $NODEIP:$PORT $PROXY $SNI") >$TMPFILE 2>$ERRFILE &
1767017670
pid=$!
1767117671
( sleep $((ssl_reneg_attempts*3+3)) && kill $pid && touch $TEMPDIR/was_killed ) >&2 2>/dev/null &

0 commit comments

Comments
 (0)