{"action":"created","issue":{"url":"https://api.github.com/repos/npgsql/npgsql/issues/493","labels_url":"https://api.github.com/repos/npgsql/npgsql/issues/493/labels{/name}","comments_url":"https://api.github.com/repos/npgsql/npgsql/issues/493/comments","events_url":"https://api.github.com/repos/npgsql/npgsql/issues/493/events","html_url":"https://github.com/npgsql/npgsql/issues/493","id":58245867,"number":493,"title":"Several issues related to SSL/TLS","user":{"login":"roji","id":1862641,"avatar_url":"https://avatars.githubusercontent.com/u/1862641?v=3","gravatar_id":"","url":"https://api.github.com/users/roji","html_url":"https://github.com/roji","followers_url":"https://api.github.com/users/roji/followers","following_url":"https://api.github.com/users/roji/following{/other_user}","gists_url":"https://api.github.com/users/roji/gists{/gist_id}","starred_url":"https://api.github.com/users/roji/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/roji/subscriptions","organizations_url":"https://api.github.com/users/roji/orgs","repos_url":"https://api.github.com/users/roji/repos","events_url":"https://api.github.com/users/roji/events{/privacy}","received_events_url":"https://api.github.com/users/roji/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/npgsql/npgsql/milestones/3","html_url":"https://github.com/npgsql/npgsql/milestones/3.0","labels_url":"https://api.github.com/repos/npgsql/npgsql/milestones/3/labels","id":620657,"number":3,"title":"3.0","description":"","creator":{"login":"franciscojunior","id":829924,"avatar_url":"https://avatars.githubusercontent.com/u/829924?v=3","gravatar_id":"","url":"https://api.github.com/users/franciscojunior","html_url":"https://github.com/franciscojunior","followers_url":"https://api.github.com/users/franciscojunior/followers","following_url":"https://api.github.com/users/franciscojunior/following{/other_user}","gists_url":"https://api.github.com/users/franciscojunior/gists{/gist_id}","starred_url":"https://api.github.com/users/franciscojunior/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/franciscojunior/subscriptions","organizations_url":"https://api.github.com/users/franciscojunior/orgs","repos_url":"https://api.github.com/users/franciscojunior/repos","events_url":"https://api.github.com/users/franciscojunior/events{/privacy}","received_events_url":"https://api.github.com/users/franciscojunior/received_events","type":"User","site_admin":false},"open_issues":41,"closed_issues":33,"state":"open","created_at":"2014-04-04T16:37:19Z","updated_at":"2015-02-25T12:01:23Z","due_on":null,"closed_at":null},"comments":18,"created_at":"2015-02-19T18:09:10Z","updated_at":"2015-02-25T20:55:34Z","closed_at":null,"body":"This issue summarizes open questions on SSL, following conversations on gitter with @Emill and other existing issues.\r\n\r\n1. Mono's SslStream implementation isn't amazing security-wise: lack of ciphers, perfect forward security, etc.\r\n2. Mono's SslStream implementation does not support SSL renegotiation well, causing an IOException after a while (see #380).\r\n3. The SslStream API (Microsoft or mono) does not have a DataAvailable property like NetworkStream, but our current async notifications depend on this.\r\n\r\nOne (extreme?) option to address the above, is to drop the built-in SslStream and move to another implementation.\r\n\r\nFollowing the open sourcing of .NET, Mono seem to be [actively working](https://trello.com/c/PvUaV89u/16-tls-stack) on replacing their SslStream implementation with Microsoft's. If and when that happens, problems 1 and 2 will go away.\r\n\r\nUnless I've missed other problems/concerns, my vote would be to keep SslStream as is. We would need to find a solution for problem 3, but aside from that I see the 1 and 2 as outside of Npgsql's problem field (and probable to go away soon anyway).\r\n\r\nIf we do decide to keep SslStream, we need to do two things:\r\n\r\n* #380: Send ssl_renegotiation_limit only if using SSL, and *only* if running on mono (runtime check).\r\n* #127: Remove Mono.Security (which is mono's SslStream) as a dependency of Npgsql. We simply use SslStream everywhere, and get the Microsoft or mono implementation."},"comment":{"url":"https://api.github.com/repos/npgsql/npgsql/issues/comments/76054720","html_url":"https://github.com/npgsql/npgsql/issues/493#issuecomment-76054720","issue_url":"https://api.github.com/repos/npgsql/npgsql/issues/493","id":76054720,"user":{"login":"franciscojunior","id":829924,"avatar_url":"https://avatars.githubusercontent.com/u/829924?v=3","gravatar_id":"","url":"https://api.github.com/users/franciscojunior","html_url":"https://github.com/franciscojunior","followers_url":"https://api.github.com/users/franciscojunior/followers","following_url":"https://api.github.com/users/franciscojunior/following{/other_user}","gists_url":"https://api.github.com/users/franciscojunior/gists{/gist_id}","starred_url":"https://api.github.com/users/franciscojunior/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/franciscojunior/subscriptions","organizations_url":"https://api.github.com/users/franciscojunior/orgs","repos_url":"https://api.github.com/users/franciscojunior/repos","events_url":"https://api.github.com/users/franciscojunior/events{/privacy}","received_events_url":"https://api.github.com/users/franciscojunior/received_events","type":"User","site_admin":false},"created_at":"2015-02-25T20:55:34Z","updated_at":"2015-02-25T20:55:34Z","body":"This is what I get when running on windows: \r\n```\r\n\r\nUnhandled Exception: System.IO.IOException: Unable to write data to the transpor\r\nt connection: An existing connection was forcibly closed by the remote host. ---\r\n> System.Net.Sockets.SocketException: An existing connection was forcibly closed\r\n by the remote host\r\n   at System.Net.Sockets.Socket.Send(Byte[] buffer, Int32 offset, Int32 size, So\r\ncketFlags socketFlags)\r\n   at System.Net.Sockets.NetworkStream.Write(Byte[] buffer, Int32 offset, Int32\r\nsize)\r\n   --- End of inner exception stack trace ---\r\n   at System.Net.Sockets.NetworkStream.Write(Byte[] buffer, Int32 offset, Int32\r\nsize)\r\n   at TlsClientStream.TlsClientStream.Flush()\r\n   at Npgsql.NpgsqlBuffer.Flush()\r\n   at Npgsql.NpgsqlConnector.Open()\r\n   at Npgsql.NpgsqlConnectorPool.GetPooledConnector(NpgsqlConnection Connection)\r\n\r\n   at Npgsql.NpgsqlConnectorPool.RequestConnector(NpgsqlConnection Connection)\r\n   at Npgsql.NpgsqlConnection.Open()\r\n   at npgsqltest.NpgsqlTest.Main(String[] args) in z:\\sslrenegotiationtest\\temp\\\r\nteste.cs:line 31\r\n```\r\n\r\nAnd this is what the server logs:\r\n\r\n```\r\nDEBUG:  forked new backend, pid=16452 socket=1280\r\nLOG:  connection received: host=::1 port=1958\r\nLOG:  could not accept SSL connection: decryption failed or bad record mac`\r\n```\r\n\r\nI even recreated the server certificate in the windows server thinking this could be the problem cause.\r\n"}}