Verify p7m countersignatures

2010-11-16 Thread Pietro Petteni
Hi all, I'm trying to successfully analyze and verify a p7m file with countersignatures with OpenSSL 0.9.8o I didn't find the right place\point where the pkcs7_verify function analyzes the unauthenticated attributes for countersignatures so I started to write the countersignatures verify function

OpenSSL 1.0.0b released

2010-11-16 Thread OpenSSL
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 OpenSSL version 1.0.0b released === OpenSSL - The Open Source toolkit for SSL/TLS http://www.openssl.org/ The OpenSSL project team is pleased to announce the release of version 1.0.0b of our open source

OpenSSL Security Advisory

2010-11-16 Thread OpenSSL
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 OpenSSL Security Advisory [16 November 2010] TLS extension parsing race condition. = A flaw has been found in the OpenSSL TLS server extension code parsing which on affected servers can be exploited in a buffer

OpenSSL 0.9.8p released

2010-11-16 Thread OpenSSL
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 OpenSSL version 0.9.8p released === OpenSSL - The Open Source toolkit for SSL/TLS http://www.openssl.org/ The OpenSSL project team is pleased to announce the release of version 0.9.8p of our open source

Re: OpenSSL 1.0.0b released

2010-11-16 Thread Carter Browne
Make test fails with Openssl 1.0.0b. Configure option: make -shared Attached is the CPU information. The same code tested without issues on VC 2008. Operating system is CentOS 5.5 with all current patches applied. Carter Carter Browne CBCS cbro...@cbcs-usa.com test BN_add test BN_sub test

building openssl libs in a build farm

2010-11-16 Thread Nicholas Wehr
Greetings, I was hoping to solicit users' feedback on how OpenSSL is getting built for distributed environments. How are you guys building the code stack? Do you use the shipped ./config --prefix=xx --install-prefix=xx and resultant Makefile without modification? We ran into an issue building

OpenSSL 1.0.0b testssl fails

2010-11-16 Thread Victor Duchovni
Anyone know why I am seeing the below errors: ../util/shlib_wrap.sh ./ssltest -v -bio_pair -tls1 -cert ../apps/server2.pem -no_dhe -num 10 -f -time Available compression methods: NONE DONE via BIO pair: TLSv1, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-SHA, 1024 bit RSA ERROR in SERVER

Re: OpenSSL 1.0.0b testssl fails

2010-11-16 Thread Dr. Stephen Henson
On Tue, Nov 16, 2010, Victor Duchovni wrote: Anyone know why I am seeing the below errors: ../util/shlib_wrap.sh ./ssltest -v -bio_pair -tls1 -cert ../apps/server2.pem -no_dhe -num 10 -f -time Available compression methods: NONE DONE via BIO pair: TLSv1, cipher TLSv1/SSLv3

Re: OpenSSL 1.0.0b released

2010-11-16 Thread Leonard F. Elia
Make test fails here too RHEL 5.5 64bit, 12gb mem, 8 core xeon Lee included: rsa test tls1 with 1024bit RSA, no DHE, multiple handshakes Available compression methods: NONE DONE via BIO pair: TLSv1, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-SHA, 1024 bit RSA ERROR in SERVER

Re: OpenSSL 1.0.0b testssl fails

2010-11-16 Thread Victor Duchovni
On Tue, Nov 16, 2010 at 03:48:13PM -0500, Victor Duchovni wrote: Anyone know why I am seeing the below errors: ../util/shlib_wrap.sh ./ssltest -v -bio_pair -tls1 -cert ../apps/server2.pem -no_dhe -num 10 -f -time Available compression methods: NONE DONE via BIO pair: TLSv1, cipher

Re: OpenSSL 1.0.0b testssl fails

2010-11-16 Thread Dr. Stephen Henson
On Tue, Nov 16, 2010, Victor Duchovni wrote: On Tue, Nov 16, 2010 at 03:48:13PM -0500, Victor Duchovni wrote: Anyone know why I am seeing the below errors: ../util/shlib_wrap.sh ./ssltest -v -bio_pair -tls1 -cert ../apps/server2.pem -no_dhe -num 10 -f -time Available compression

Re: OpenSSL 1.0.0b testssl fails

2010-11-16 Thread Mounir IDRASSI
Under Windows (32bit and 64bit) with VC++ 2008, all tests are OK. But under Ubuntu 8.04 LTS with gcc 4.2.4, I have the same error. I don't see anything OS specific in the changes introduced in t1_lib.c or s3_srvr.c. Could it be a gcc bug? -- Mounir IDRASSI IDRIX http://www.idrix.fr On

Re: OpenSSL 1.0.0b testssl fails

2010-11-16 Thread Dr. Stephen Henson
On Tue, Nov 16, 2010, Mounir IDRASSI wrote: Under Windows (32bit and 64bit) with VC++ 2008, all tests are OK. But under Ubuntu 8.04 LTS with gcc 4.2.4, I have the same error. I don't see anything OS specific in the changes introduced in t1_lib.c or s3_srvr.c. Could it be a gcc bug? No,

Openssl 1.0.0b make test fails

2010-11-16 Thread Carter Browne
I have now tried building Openssl 1.0.0b with and without -shared and on SuSE 11.3 as well as two CentOS 5.5 systems. All fail at the same point. I verified the MD5 and SHA1 checksums? Any ideas? Carter Browne CBCS cbro...@cbcs-usa.com

Re: OpenSSL 1.0.0b testssl fails

2010-11-16 Thread Victor Duchovni
On Tue, Nov 16, 2010 at 11:36:50PM +0100, Mounir IDRASSI wrote: Under Windows (32bit and 64bit) with VC++ 2008, all tests are OK. But under Ubuntu 8.04 LTS with gcc 4.2.4, I have the same error. I don't see anything OS specific in the changes introduced in t1_lib.c or s3_srvr.c. Could it

RE: How to get the Serial Number

2010-11-16 Thread Dave Thompson
From: owner-openssl-us...@openssl.org On Behalf Of bhaarat pachori Sent: Saturday, 13 November, 2010 08:23 Actually I am trying to get the Serial number of the der encoded certificate AOL_Member_CA.der. For the better understanding I am attaching my code

Re: Question regarding OpenSSL Security Advisory

2010-11-16 Thread Nivedita Melinkeri
Hi, I had some questions about the latest security advisory. I understand that this applies to multi-threaded application while using ssl sessions. If the application is written thread safe using CRYPTO_set_locking_callback functions will the vulnerability still apply ? If the ssl code calls

X509_get_ext_d2i : makes a copy that needs to be freed, or not?

2010-11-16 Thread Rene Hollan
I'm retrieving the Subject Alternate Name, by NID using X509_get_ext_d2i(x, NID_subject_alt_name, NULL, NULL). Of course, for NID_subject_alt_name, it returns a GENERAL_NAMES pointer. Is this an alias, or does it need to get freed with sk_GENERAL_NAMES_free() when I'm done with