Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (athena.apache.org: domain of jorton@redhat.com designates
 209.132.183.28 as permitted sender)
Date: Wed, 3 Mar 2010 22:41:37 +0000
From: Joe Orton <jorton@redhat.com>
To: dev@httpd.apache.org
Subject: Re: [vote] release 2.2.15?
Message-ID: <20100303224137.GA15413@redhat.com>
Mail-Followup-To: dev@httpd.apache.org
References: <4B8CAB83.20902@rowe-clan.net>
 <4B8E8853.2050108@apache.org>
 <201003031850.25419.sf@sfritsch.de>
 <4B8EA429.7050908@rowe-clan.net>
 <4B8EAB08.4040303@oss-institute.org>
 <20100303220128.GA12139@redhat.com>
 <4B8EE0FB.6050401@apache.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
In-Reply-To: <4B8EE0FB.6050401@apache.org>
User-Agent: Mutt/1.5.20 (2009-08-17)
Organization: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor,
 Berkshire, SL4 1TE, United Kingdom.
  Registered in UK and Wales under Company Registration No. 03798903
  Directors: Michael Cunningham (USA), Brendan Lane (Ireland),
 Matt Parson (USA), Charlie Peters (USA)

On Wed, Mar 03, 2010 at 11:21:47PM +0100, Mladen Turk wrote:
> SSLInsecureRenegotiation off
> echo R | openssl-0.9.8m s_client  .. disconnects
> echo R | openssl-0.9.8k s_client  .. hangs until ServerTimeout

Ah, right, hmm.  Yes, this is exactly as Bill says, the client is 
ignoring the alert and then the server is hanging until a read times 
out.  This consumes exactly the same amount of server resources as the 
client doing nothing with the connection.

I'm not sure why the connection is not being forcibly closed by the 
server in this case, but:

a) it's certainly not a security issue
b) real clients don't initiate reneg, so it's not a practical issue

Regards, Joe