[Openvpn-devel] Questions related to the SSL renegotiation vulnerability

2009-11-11 Thread Dunc
s in advance if anyone can shed light on this for me, and once again sorry if I'm just misunderstanding, which is quite possible :-) Cheers, Dunc

Re: [Openvpn-devel] Questions related to the SSL renegotiation vulnerability

2009-11-12 Thread Dunc
to disable renegotiation at the server side? Cheers, Dunc James Yonan wrote: > OpenVPN uses a fresh SSL/TLS session for each of its mid-session > renegotiations. This means that when you see: > > TLS: soft reset sec=0 bytes=314/0 pkts=6/0 > > OpenVPN is actually creati

Re: [Openvpn-devel] Questions related to the SSL renegotiation vulnerability

2009-11-12 Thread Dunc
I see, Thanks very much for clearing that up James. Cheers, Dunc James Yonan wrote: > Well the problem is that even though OpenVPN doesn't rely on OpenSSL > renegotiations, it does not explicitly disable them. So to be safe, > it's better to upgrade to the fixed version