[openssl.org #3286] DTLS client crash while clearing (freeing) the dtls1_buffer_record queue (buffered_app_data)

2014-06-03 Thread Stephen Henson via RT
Fixed now, thanks for the report. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org __ OpenSSL Project

Re: AW: Which platforms will be supported in the future on which platforms will be removed?

2014-06-03 Thread Theodore Ts'o
On Tue, Jun 03, 2014 at 02:22:07PM +1000, Peter Waltenberg wrote: One of the uglier problems is that unless you can build/test on all the platforms on each change you'll almost certainly break platforms unexpectedly - that lack of hardware has been one of the long term problems and it's

Re: AW: Which platforms will be supported in the future on which platforms will be removed?

2014-06-03 Thread Michael Sierchio
On Tue, Jun 3, 2014 at 7:10 AM, Theodore Ts'o ty...@mit.edu wrote: There's a very simple solution to that problem, especially since we now have the support and attention of many hardware companies. The rule should be very simple. If a company doesn't contribute either (a) exclusive,

patch for make depend, chacha

2014-06-03 Thread Dirk Wetter
Hi, pls see attached. Is there somebody working on it to get Chacha/Poly cipher suites production ready? Cheers, Dirk --- crypto/chacha/Makefile.orig 2014-06-03 10:49:51.082287334 +0200 +++ crypto/chacha/Makefile 2014-06-03 10:50:07.496433689 +0200 @@ -21,7 +21,7 @@ APPS=

RE: AW: Which platforms will be supported in the future on which platforms will be removed?

2014-06-03 Thread Salz, Rich
especially Stephen Henson, who has kept it together in much the same way as Keith Richards did the Stones. With no disrespect intended to either man, I have to say that this is an analogy that never would have occurred to me in a million years. /r$ -- Principal Security Engineer

RE: patch for make depend, chacha

2014-06-03 Thread Salz, Rich
Is there somebody working on it to get Chacha/Poly cipher suites production ready? It's expected that the way the ciphers are used will change as it goes through the IETF TLS group. Therefore, Google has not been encouraging folks to pick up and use these patches other than an on your own

Re: [openssl.org #3374] Do not advertise ECC ciphersuites in SSLv2 client hello

2014-06-03 Thread Viktor Dukhovni
On Tue, Jun 03, 2014 at 06:01:03PM +0200, Tomas Mraz via RT wrote: openssl advertises ECC ciphersuites in SSLv2 client hello if ssl23 method is used. This is incorrect because the TLS extensions that indicate supported curves and point formats cannot be sent in SSLv2 client hello. The

Re: AW: Which platforms will be supported in the future on which platforms will be removed?

2014-06-03 Thread Geoffrey Thorpe
I don't disagree (or I certainly don't disagree completely) with anything that has been said so far. But I think it's easy to assign disproportionate angst to this or that problem. For example, and that's all this is, but one of the most serious issues I think we have in the openssl code is that

[openssl.org #3370] 1.0.1g / Windows / patch - wrong OPENSSL_EC_NISTP_64_GCC_128 definition in ec_lcl.h

2014-06-03 Thread Matt Caswell via RT
Patch applied: https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=8e3231642b89332fa56ed2b6f501e28722e2048e Thanks for your contribution. Matt __ OpenSSL Project http://www.openssl.org

[openssl.org #3372] Possible patch for typo fix in version number of dylib

2014-06-03 Thread Matt Caswell via RT
Hi Lubu Thanks for your submission. However this is intentional and won't be changed. Closing this ticket. Matt __ OpenSSL Project http://www.openssl.org Development Mailing List

Re: AW: Which platforms will be supported in the future on which platforms will be removed?

2014-06-03 Thread Peter Waltenberg
It's a simple solution, and obvious and I don't think it'll work. This is NOT the Linux kernel, the Linux kernel is directly funded by several of the larger companies, they have employees contributing directly on the kernel, with access to internal hardware resources. OpenSSL doesn't. Yes, it

Re: AW: Which platforms will be supported in the future on which platforms will be removed?

2014-06-03 Thread Theodore Ts'o
On Wed, Jun 04, 2014 at 09:14:18AM +1000, Peter Waltenberg wrote: This is NOT the Linux kernel, the Linux kernel is directly funded by several of the larger companies, they have employees contributing directly on the kernel, with access to internal hardware resources. Yes, and I'm saying