Hello!

On Fri, Nov 20, 2009 at 04:18:10PM -0800, Quanah Gibson-Mount wrote:

> --On Saturday, November 21, 2009 3:12 AM +0300 Maxim Dounin
> <mdounin@mdounin.ru> wrote:
>
> >Hello!
> >
> >On Fri, Nov 20, 2009 at 03:14:29PM -0800, Quanah Gibson-Mount wrote:
> >
> >>I've patched nginx, and tested https, POPS, and IMAPS. https fails
> >>correctly:
> >
> >
> >What patch you used, nginx version and openssl version? Recent
> >nginx versions (0.8.23+, 0.7.64) already has workarounds for older
> >openssl libraries and correctly disable renegotiation in all
> >mentioned cases, closing connection immediately. At least they do
> >so on all openssl versions I've tested.
>
> nginx-0.5.37 + security patches
> (http://sysoev.ru/nginx/patch.cve-2009-3555.txt, etc)
> openssl 0.9.8l
>
> As I noted, it correctly hangs up HTTPS. It leaves POPS and IMAPS open.

Just tested - works ok here.

Are you sure you aren't used openssl 0.9.8l s_client for
imaps/pop3s tests? It has renegotiation disabled and can't be
used for testing ("R" only prints "RENEGOTIATING" and do nothing).

Maxim Dounin