Re: nameConstraints : leading . in permission list items

On 08/13/2014 09:59 AM, at the end of a long message I wrote: [.] I will rewrite my patch code accordingly. It will take me a little while to do this and test it. This is now done. The improved patch can be found at http://www.av8n.com/openssl/leading-dot-better.diff The patch

Re: [openssl-dev] nameConstraints : leading . in permission list items

On 08/13/2014 08:27 AM, Erwann Abalea wrote in part: the question isn't should we tolerate it?, but what do the sacred scriptures ask compliant implementation to do? What sacred scriptures are we talking about here? I'm not an expert, so correct me if I'm wrong, but I thought RFC stood for

[openssl.org #3491] Cert signing request verification false positive.

I have found a bug in the openssl req -verify . It is present in 101i as well as a couple older versions. I have not gone on a testing spree. This may be a semantic discussion, as it accurately verifies if the signature is correct, based on the data, but not if the data is correct. The CSR

Re: Netware support?

Hi Rich, On 13.08.2014 22:59, Salz, Rich wrote: Is anyone willing to step up and maintain the Netware port? If not, then we will probably remove it after the next release. please dont do that! I maintained it in the past (and try to do in future as my time permits), and currently it still

Re: Netware support?

Hi, I was working a lot with Netware some 10-15 years ago. I wonder if you have some recent install media with ev. licence to donate to polarhome.com I am building up a jenkins farm with polarhome servers that would build OpenSSL, Vim and other opensource projects and follow up CI. That

RE: Netware support?

please dont do that! I maintained it in the past (and try to do in future as my time permits), and currently it still builds (except for asm support were ich Okay. Thanks for your efforts. The NETWARE port is really messy, with about 130 #ifdef flags in 70 files. It would be great if we

[openssl.org #3252] OpenSSL v1.0.1f issue: decryption failed or bad record

I can reproduce this issue using the version from master branch. Interestingly, it doesn't happen if I set it to use SSLv3 only. Below are the traces from universal ClientHello and from SSLv3 only one. $ openssl s_client -connect courtapps.utcourts.gov:443 -msg -debug

[openssl.org #2300] BUG REPORT: md2(3)/md5(3) man page HISTORY section inconsistency

These are good poitns. Merging this into RT1665 for general crypto doc cleanup. -- Rich Salz, OpenSSL dev team; rs...@openssl.org __ OpenSSL Project http://www.openssl.org Development Mailing List

[openssl.org #696] SSLv2: server requires client certificate despite SSL_VERIFY_PEER

we're not going to fix this. SSLv2 is now like the Monty Python comment: This is not a wine for drinking, this is a wine for laying down and avoiding -- Rich Salz, OpenSSL dev team; rs...@openssl.org __ OpenSSL Project

No DTLSv1_2_get_timeout() in openssl 1.1.0-dev

Hi, OpenSSL 1.1.0-dev comes with DTLS 1.2 support by adding DTLSv1_2_*_method() and DTLS_*_method() (that supports both DTLS 1.0 and 1.2). But it only has DTLS timeout related functions for DTLS 1.0: DTLSv1_get_timeout( ) DTLSv1_handle_timeout( ) Is it safe to use them when the method is

Single-Makefile Build Experiment report

As announced on the openssl-testing list, I'm happy to report early, promising success in my Makefile refactoring experiment. Here's the short link to the Google Doc containing all of the details: http://goo.gl/yhvCno Feedback welcome. Regardless of the ultimate judgment of the experiment, I'm

RE: VMS building rework

Hi Richard, I absolutely welcome the idea, that the build needs to be improved on OpenVMS. You have my full support and I'll help as much I can appreciate time-wise. Currently, I am struggling to include OpenVMS architectures into a jenkins farm that would at least warn for anomalies as soon

[openssl.org #1029] Linking Error

You probably figured this out years ago, but the library order should be -lssl -lcrypto -- Rich Salz, OpenSSL dev team; rs...@openssl.org __ OpenSSL Project http://www.openssl.org Development

[openssl.org #1013] test idea exits with error but tests are OK

old release, can't reproduce, closing this. -- Rich Salz, OpenSSL dev team; rs...@openssl.org __ OpenSSL Project http://www.openssl.org Development Mailing List

DTLS initial timeout duration

Hello, maybe I miss something ... But there seems to be no way to change the initial timeout duration for DTLSv1. It's value is set to one second, and it's hard-coded in d1_lib.c in function dtls1_start_timer. The problem is I need to set a higher value, because in a project, I am working on,

[openssl.org #646] Fix for Linux problems using TERMIOS

Last update, a decade ago, pointed to user issues. Closing this. -- Rich Salz, OpenSSL dev team; rs...@openssl.org __ OpenSSL Project http://www.openssl.org Development Mailing List

Re: DTLS initial timeout duration

On 14 Aug 2014, at 20:27, Tobias Herre 7...@mail.ru wrote: Hello, maybe I miss something ... But there seems to be no way to change the initial timeout duration for DTLSv1. It's value is set to one second, and it's hard-coded in d1_lib.c in function dtls1_start_timer. The problem is I

Re: DTLS initial timeout duration

On 14.08.2014 22:05, Michael Tuexen wrote: Isn't this a problem of the client which has to be fixed anyway? The client is a Cisco AP. I don't think, Cisco would fix that for me, because their APs work fine with their own controllers. Best regards Tobias

RE: Single-Makefile Build Experiment report

Have you considered moving to CMake? It makes lots of the issues you discuss in the document just go away. cmake should work on the vast majority of supported operating systems, if not all of them ... -Original Message- From: owner-openssl-...@openssl.org

[openssl.org #1033] BUG REPORT : Unreachable code in OpenSSL 0.9.7f

This particular set of issues has been resolved. We need to run with -Wall, etc., flags regularly. -- Rich Salz, OpenSSL dev team; rs...@openssl.org __ OpenSSL Project http://www.openssl.org

[openssl.org #1166] Search for Signature File

Urgent need for a response by 29 Julye 2005... oops :) -- Rich Salz, OpenSSL dev team; rs...@openssl.org __ OpenSSL Project http://www.openssl.org Development Mailing List

[openssl.org #1163] add a list-client-ciphers option to s_server

seems to be a browser setup issue, closing this. -- Rich Salz, OpenSSL dev team; rs...@openssl.org __ OpenSSL Project http://www.openssl.org Development Mailing List

Re: Single-Makefile Build Experiment report

On Thu, Aug 14, 2014 at 4:32 PM, Tim Hollebeek tholleb...@trustwave.com wrote: Have you considered moving to CMake? It makes lots of the issues you discuss in the document just go away. cmake should work on the vast majority of supported operating systems, if not all of them ... Nope;

Re: Netware support?

Rich, On 14.08.2014 16:19, Salz, Rich wrote: Okay. Thanks for your efforts. The NETWARE port is really messy, with about 130 #ifdef flags in 70 files. It would be great if we could reduce that impact. perhaps its possible to introduce some macros and then kill some code paths - but since a

Re: [openssl.org #3470] [BUG] DTLS abort

On 22 Jul 2014, at 23:32, Brian Hassink via RT r...@openssl.org wrote: OpenSSL: 1.0.1e OS: Red Hat Enterprise Linux Server release 6.5 (Santiago) Hello, We recently did some negative testing against OpenSSL 1.0.1e, with a focus on DTLS,

Re: [openssl.org #3470] [BUG] DTLS abort

On 22 Jul 2014, at 23:32, Brian Hassink via RT r...@openssl.org wrote: OpenSSL: 1.0.1e OS: Red Hat Enterprise Linux Server release 6.5 (Santiago) Hello, We recently did some negative testing against OpenSSL 1.0.1e, with a focus on DTLS,

[openssl.org #1724] s_server does not escape HTML

This will be fixed in post-1.0.2 release. In -www mode, s_server escapes the three special charactersby writing their entities isntead. -- Rich Salz, OpenSSL dev team; rs...@openssl.org __ OpenSSL Project

RE: Netware support?

Thanks for the info! -- Principal Security Engineer Akamai Technologies, Cambridge MA IM: rs...@jabber.me Twitter: RichSalz __ OpenSSL Project http://www.openssl.org Development Mailing List

Re: Single-Makefile Build Experiment report

On 08/14, Tim Hollebeek wrote: Have you considered moving to CMake? It makes lots of the issues you discuss in the document just go away. cmake should work on the vast majority of supported operating systems, if not all of them ... Cmake has disadvantages. I haven't actually used it enough

Re: Single-Makefile Build Experiment report

Just a comment. the OpenSSL build already depends on Perl and Perl already has a Make of it's own . That would at least relieve some of the problems with being dependent on lowest common denominator features common to the various platform makes. I'll admit, I have no idea whether the Perl variant

RE: Single-Makefile Build Experiment report

Just a comment. the OpenSSL build already depends on Perl and Perl already has a Make of it's own . Ooh, that could be interesting. What's the perl make thing called? A web search for perl make was too voluminous... /r$ -- Principal Security Engineer Akamai Technologies,

[openssl.org #724] RQ: Library name unification for Win32 possible?

It would break downstream users. Just for consistency. Closing this ticket. -- Rich Salz, OpenSSL dev team; rs...@openssl.org __ OpenSSL Project http://www.openssl.org Development Mailing List

[openssl.org #635] Manual pages.

We don't package the manpages separately and search engines are pretty good nowadays -- Rich Salz, OpenSSL dev team; rs...@openssl.org __ OpenSSL Project http://www.openssl.org Development

[openssl.org #784] Library cleanup functionality

After a decade of silence, time to face facts that global library cleanup isn't a high priority, and does have some concerns/drawbacks (see Pete's note in the RT). We're nog going to address this unless someone on the team, or someone with a patch, re-opens the ticket. -- Rich Salz, OpenSSL dev

Re: Single-Makefile Build Experiment report

On 08/14, Salz, Rich wrote: Just a comment. the OpenSSL build already depends on Perl and Perl already has a Make of it's own . Ooh, that could be interesting. What's the perl make thing called? A web search for perl make was too voluminous... Hm ... maybe some of my Google-fu can come

[openssl.org #736] 0.9.6k another misuse of RSA_size()

Fixed a long time ago; adding *8 to convert RSA_size() from bytes to bits. -- Rich Salz, OpenSSL dev team; rs...@openssl.org __ OpenSSL Project http://www.openssl.org Development Mailing List

[openssl.org #782] IBM patches to OpenSSL-0.9.7c

The assembly code seems to have been included already. The platforms we want are included already. I think we've got the 'good bits' from this; if not, please open a new ticket to cover it. thanks. -- Rich Salz, OpenSSL dev team; rs...@openssl.org

[openssl.org #787] New target platform

More then 10 years; not going to get around to this. (MinGW cross-compiler target BTW) -- Rich Salz, OpenSSL dev team; rs...@openssl.org __ OpenSSL Project http://www.openssl.org Development

[openssl.org #832] ocsp and dsa key+socket option SO_REUSEADDR for responder

SO_REUSEADDR is done. The discussion about DSA key and sig verificdation: I think that's now also done as part of EVP_DigestSign. -- Rich Salz, OpenSSL dev team; rs...@openssl.org __ OpenSSL Project

[openssl.org #1794] [PATCH] SRP in OpenSSL 1.0.1

SRP is in opensls -- Rich Salz, OpenSSL dev team; rs...@openssl.org __ OpenSSL Project http://www.openssl.org Development Mailing List openssl-dev@openssl.org Automated List

Re: [openssl.org #782] IBM patches to OpenSSL-0.9.7c

That's essentially correct. Any IBM contributions from me have been dealt already, just to save time if you hit more. Thanks Peter From: Rich Salz via RT r...@openssl.org To: Peter Waltenberg/Australia/IBM@IBMAU Cc: openssl-dev@openssl.org Date: 15/08/2014 12:27 PM Subject:

[openssl.org #1885] [PATCH] PSK support for 0.9.8j

PSK support is in openssl; thanks for your work. -- Rich Salz, OpenSSL dev team; rs...@openssl.org __ OpenSSL Project http://www.openssl.org Development Mailing List

[openssl.org #2202] Resolved: OpenSSL 0.9.8n v. VMS

According to our records, your request has been resolved. If you have any further questions or concerns, please respond to this message. __ OpenSSL Project http://www.openssl.org Development Mailing

[openssl.org #2202] OpenSSL 0.9.8n v. VMS

DrH applied the patches, VMS is supported and others are working on the build stuff. Closing this. -- Rich Salz, OpenSSL dev team; rs...@openssl.org __ OpenSSL Project http://www.openssl.org

[openssl.org #2355] Support for SHA2 ciphersuite in TLS

We support SHA-2 for signatures. We support SHA-256, etc., where defined in TLS Nothing extra for openssl to do. -- Rich Salz, OpenSSL dev team; rs...@openssl.org __ OpenSSL Project

[openssl.org #2332] Issue while generating SSL certificate using Apache 2.216 + openssl 0.9.8o

Yes, can't specify a date beyond 2038 :) -- Rich Salz, OpenSSL dev team; rs...@openssl.org __ OpenSSL Project http://www.openssl.org Development Mailing List

[openssl.org #2322] openssl question

Local gcc config/install issue, not an openssl issue. -- Rich Salz, OpenSSL dev team; rs...@openssl.org __ OpenSSL Project http://www.openssl.org Development Mailing List

[openssl.org #2446] Need clarification on licensing requirements of certain files

We're working on clarifying and updating everything in the distribution, as far as licenses go. But it is a slow complicated procedure. Until then, the only information available is in the files themselves. -- Rich Salz, OpenSSL dev team; rs...@openssl.org

[openssl.org #2467] undefined reference to `main'

Seems to be a local gcc config issue. Can't reproduce, closing ticket. -- Rich Salz, OpenSSL dev team; rs...@openssl.org __ OpenSSL Project http://www.openssl.org Development Mailing List

[openssl.org #2442] OCSP digest methods bug

This is fixed post-1.0.2 If you specify the -sha256 (or other digest) after -serial or -cert, which have the side effect of setting the digest to sha1, then an error message is displayed. Can't be tested by look at rsalz-monolith branch on akamai/openssl on github. -- Rich Salz, OpenSSL dev team;

[openssl.org #2452] error at make test

Can't reproduce on current releases or current version of the mac platform -- Rich Salz, OpenSSL dev team; rs...@openssl.org __ OpenSSL Project http://www.openssl.org Development Mailing List

[openssl.org #2433] Const char * parameter of ASN1_STRING_set_default_mask_asc

Someone already fixed this. -- Rich Salz, OpenSSL dev team; rs...@openssl.org __ OpenSSL Project http://www.openssl.org Development Mailing List openssl-dev@openssl.org

[openssl.org #2468] bind 9.8.0 and OpenSSL 1.0.0d

Old versions, not enough information to reproduce, closing ticket. -- Rich Salz, OpenSSL dev team; rs...@openssl.org __ OpenSSL Project http://www.openssl.org Development Mailing List

[openssl.org #2483] X509 conversions

Very old platform, not supported, we can't reproduce this. -- Rich Salz, OpenSSL dev team; rs...@openssl.org __ OpenSSL Project http://www.openssl.org Development Mailing List

[openssl.org #2508] rt website hits cookie error for me

Can';t reproduce this issue with rt.openssl.org -- Rich Salz, OpenSSL dev team; rs...@openssl.org __ OpenSSL Project http://www.openssl.org Development Mailing List

[openssl.org #3195] [bug] aes-cbc encryption on x86 is not working

Yes, in CBC mode you cannot have short blocks. User error, closing ticket. -- Rich Salz, OpenSSL dev team; rs...@openssl.org __ OpenSSL Project http://www.openssl.org Development Mailing List

[openssl.org #2892] [BUG]Cannot make openssl-1.0.2-stable-SNAP-20121003

old snapshot; current ones should work. -- Rich Salz, OpenSSL dev team; rs...@openssl.org __ OpenSSL Project http://www.openssl.org Development Mailing List

[openssl.org #2893] [BUG]Cannot make openssl-1.0.2-stable-SNAP-20121003

old snapshot; things should work now. or at least build :) -- Rich Salz, OpenSSL dev team; rs...@openssl.org __ OpenSSL Project http://www.openssl.org Development Mailing List