Subject: strange problem with unclean shutdown

From: Andreas Gietl <[email-masked]>
Date: Wed, 23 Jan 2002 19:12:35 +0100

hi,

i've got a really really strange problem with mod_ssl 2.8.5-1.3.22 on Apache 
1.3.22 with openssl 0.9.6c.

As we all know MSIE needs the unclean-shutdown to sucessfully work with 
mod_ssl. This is why we add the SetEnvIf for this Browser. (full vhost-config 
see below). The strange thing is that this for some reason seems not to match 
IE 5.01 and 5.5.
This are the user-agent for these browsers:

Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; DT)
Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; DT)

Versions > 6 worked. Others not tested.

The certificate is issued let's say for www.defaulthost.de. And not it is 
really getting unbelievable:
if i connect to defaulhost.de it's doing the unclean-shutdown and to 
www.defaulhost.de it is doing a standard-shutdown, which does not work.
Connecting to www.defaulhost.de does give the ie standard-error-page. There's 
no HTTP-Request in the access_log, just in the SSLLog an entry that it 
connected and quited with standard shutdown.

Any ideas?

Andreas

Here's the config:

#
# Global SSL
#

AddType application/x-x509-ca-cert .cer
AddType application/x-pkcs7-crl    .crl

#SSLPassPhraseDialog     builtin
SSLSessionCache        dbm:/tmp/ssl_scache
SSLSessionCacheTimeout  100
#SSLMutex  file:domlogs/ssl_mutex
#SSLRandomSeed startup builtin
#SSLRandomSeed connect builtin

#SSLLog      domlogs/ssl_engine_log
#SSLLogLevel debug

# SSL - Virtual-Host

<VirtualHost XXXXXXX:443>
ServerName www.defaulthost.de
ServerAdmin [email-masked]
DocumentRoot /home/defaulthost/public_html

SSLEngine on

SSLCipherSuite ALL:!ADH:!EXP56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL

ErrorLog domlogs/defaulthost.errors.https
CustomLog domlogs/defaulthost.de.ssl combined
SetEnvIf User-Agent "MSIE" nokeepalive ssl-unclean-shutdown downgrade-1.0 
force-response-1.0

CustomLog domlogs/defaulthost.de.ssl_request_log \
        "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

SSLCertificateFile /usr/local/apache/conf/cert/www.defaulthost.de.cer
SSLCertificateKeyFile /usr/local/apache/conf/cert/www.defaulthost.de.key
ScriptAlias /cgi-bin/ /home/defaulhost/public_html/cgi-bin/
</VirtualHost>

-- 
e-admin internet gmbh
Andreas Gietl
Roter-Brach-Weg 124a
tel +49 941 3810884
fax +49 941 3810891
mobil +49 171 6070008
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: jon schatz <[email-masked]>
Date: 23 Jan 2002 10:52:18 -0800

> 1.3.22 with openssl 0.9.6c.
<---snip--->
> Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; DT)

This is the same problem i reported yesterday (to this list and
apache-users). Check your logs; is apache aware of the User-Agent value
when a ssl connection is made? In my particular setup, it wasn't (even
though the value was set), and that caused the regex to fail. 

-jon

-- 
[email-masked] || www.divisionbyzero.com
gpg key: www.divisionbyzero.com/pubkey.asc
think i have a virus?: www.divisionbyzero.com/pgp.html
"You are in a twisty little maze of Sendmail rules, all confusing."

---

From: Andreas Gietl <[email-masked]>
Date: Wed, 23 Jan 2002 21:10:46 +0100

On Wednesday 23 January 2002 19:52, you wrote:

uh - how did you fix this problem? I don't see any logentry in the 
ssl-access-log.

> > i've got a really really strange problem with mod_ssl 2.8.5-1.3.22 on
> > Apache 1.3.22 with openssl 0.9.6c.
>
> <---snip--->
>

---

From: jon schatz <[email-masked]>
Date: 23 Jan 2002 12:45:50 -0800

On Wed, 2002-01-23 at 12:10, Andreas Gietl wrote:
> uh - how did you fix this problem? 

I haven't fixed it. I've gotten no feedback from either list
(modssl-users and apache-users) on this, and i've found older reports in
the apache bug db. so i'm not sure what to do. i've tried
unconditionally setting the broken ssl variables like so:

	SetEnv nokeepalive
	SetEnv ssl-unclean-shutdown
	SetEnv downgrade-1.0 
	SetEnv force-response-1.0 

inside of the ssl virtualhost container, but they're still being
ignored, and the errors still show up in the log. 

> I don't see any logentry in the  ssl-access-log.

Do you log user agents? i use this to log:

	LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\"
\"%{User-Agent}i\"" combined

What's not being logged on my setup is the user-agent field...

-jon

---

From: Andreas Gietl <[email-masked]>
Date: Thu, 24 Jan 2002 10:06:04 +0100

On Wednesday 23 January 2002 21:45, you wrote:

I just tried apache-ssl and that one did not work either.

---

From: Thomas Binder <[email-masked]>
Date: Thu, 24 Jan 2002 17:24:35 +0100

Hi!

> ignored, and the errors still show up in the log. 

How do you tell they're being ignored? The access log isn't the
place to check that, as it only contains the protocol the browser
initially send in the request, not which protocol was used to
answer the request.

Test this using OpenSSL's s_client:

openssl s_client -quiet -connect server:443 <<EOF
GET / HTTP/1.1
Host: server
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 4.0)
Connection: close

EOF

Output starts with:
HTTP/1.0 200 OK
     ^^^

Whereas with:

openssl s_client -quiet -connect server:443 <<EOF
GET / HTTP/1.1
Host: server
User-Agent: Mozilla/4.79 [en] (X11; U; SunOS 5.8 sun4u)
Connection: close

EOF

Output starts with:
HTTP/1.1 200 OK
     ^^^

You see, it's the HTTP _response_ you have to look at, not the
request you see in the access log.

Ciao

Thomas

-- 
Whom the gods would destroy, they first teach BASIC.

---

From: jon schatz <[email-masked]>
Date: 25 Jan 2002 10:05:46 -0800

> Test this using OpenSSL's s_client:

[jon@devotchka jon]$ openssl s_client -quiet -connect devotchka:23456
<<EOF
> Host: devotchka
<----snip---->
HTTP/1.1 200 OK
Date: Fri, 25 Jan 2002 17:56:17 GMT
Server: Apache/1.3.22 (Unix) mod_ssl/2.8.5 OpenSSL/0.9.6b mod_perl/1.26
<---snip---->

again, ignoring the environment variables i set. I'm now fairly positive
that this is an apache bug, because these lines:

	SetEnv downgrade-1.0

aren't respected in the main (non-ssl) container either:

[jon@devotchka conf]$ telnet devotchka 12345
Trying 192.168.1.106...
Connected to devotchka.
Escape character is '^]'.
GET / HTTP/1.1 
Host: devotchka.sonicopia.com
User-Agent: Mozilla/4.0
Connection: close

HTTP/1.1 200 OK
Date: Fri, 25 Jan 2002 18:00:42 GMT
Server: Apache/1.3.22 (Unix) mod_ssl/2.8.5 OpenSSL/0.9.6b mod_perl/1.26

Since apache 1.2.23 came out last night, I'm going to wait until mod_ssl
is released for 1.2.23. If the problem still exists, i'm submitting this
to the apache-httpd bug db...

-jon

---

From: David Rees <[email-masked]>
Date: Fri, 8 Feb 2002 17:59:09 -0800

> DocumentRoot /home/defaulthost/public_html

Sorry for the late reply, been on vacation.

Does this server host multiple SSL sites?  What are you using in your
configuration of XXXXXXX?

Can you replace XXXXXXX with * or the IP address of the virtual host?

-Dave

---

From: Andreas Gietl <[email-masked]>
Date: Sat, 9 Feb 2002 12:43:59 +0100

On Saturday 09 February 2002 02:59, you wrote:

There's just one host at this SSL-Server. XXX is the IP-Adress of the 
SSL-Host. 

I already tried to work with the shm-cache, but this didn't work.