Re: [PATCH] BUILD: ssl: Build with new cryptographic library AWS-LC

2023-07-17 Thread Илья Шипицин
сб, 15 июл. 2023 г. в 10:44, Willy Tarreau : > Hi Alex, Andrew, > > On Thu, Jul 13, 2023 at 11:54:44AM +0200, Aleksandar Lazic wrote: > > On 2023-07-13 (Do.) 08:22, Hopkins, Andrew wrote: > > > * Do you plan to add quic (Server part) faster then OpenSSL? > > > > > > I have not looked into quic

Re: [PATCH] BUILD: ssl: Build with new cryptographic library AWS-LC

2023-07-17 Thread Hopkins, Andrew
I have good news and bad news. The good news is I figured out why some of the HAProxy tests in AWS-LC’s CI were getting a different result than the HAProxy tests in your CI, I’ve fixed that in this PR [1] by installing more test dependencies (socat and lua). The bad news is I need to skip

Re: Old style OCSP not working anymore?

2023-07-17 Thread Sander Klein
On 2023-07-17 15:17, William Lallemand wrote: On Thu, Jul 13, 2023 at 05:01:06PM +0200, Sander Klein wrote: Hi, I tried upgrading from 2.6.14 to 2.8.1, but after the upgrade I couldn't connect to any of the sites behind it. While looking at the error it seems like OCSP is not working

Re: [PATCH] BUILD: ssl: Build with new cryptographic library AWS-LC

2023-07-17 Thread William Lallemand
On Mon, Jul 17, 2023 at 05:56:15PM +0200, Илья Шипицин wrote: > also, if "aws-lc" is somewhat very similar to openssl-1.1.1, we do not > expect we'll catch a lot of build errors daily because we already run > builds against openssl-1.1.1, maybe weekly CI would be enough. a Weekly CI is good

Re: [PATCH] BUILD: ssl: Build with new cryptographic library AWS-LC

2023-07-17 Thread Илья Шипицин
пн, 17 июл. 2023 г. в 11:58, William Lallemand : > On Wed, Jul 12, 2023 at 12:26:06AM +, Hopkins, Andrew wrote: > > Hello HAProxy maintainers, I work on the AWS libcrypto (AWS-LC) > > project [1]. Our goal is to improve the cryptography we use internally > > at AWS and help our customers

Re: [PATCH 0/2] improve CI friendliness

2023-07-17 Thread William Lallemand
On Sat, Jul 15, 2023 at 12:00:47AM +0200, Ilya Shipitsin wrote: > thanks to Andrew Hopkins from Amazon, we've learned that CI is already easy > to learn, > however few things can be improved. > > let us add naming convention inline comment, also if VTest fails, let is > highlight that. > >

Re: [PATCH 0/1] Implement new sample fetch method to get the curve name used in key agreement

2023-07-17 Thread William Lallemand
On Mon, Jul 17, 2023 at 08:22:58AM -0500, Mariam John wrote: > This is an implementation of feature request > [#2165](https://github.com/haproxy/haproxy/issues/2165), > to get the EC curve name used during the key agreement in OpenSSL. This patch > includes the following > changes: > - new

Re: Wierd issue with OCSP updating

2023-07-17 Thread William Lallemand
On Thu, Jul 13, 2023 at 07:10:29PM -0600, Shawn Heisey wrote: > On 7/13/23 15:00, Cyril Bonté wrote: > > Hi Shawn, > > > > Le 13/07/2023 à 18:48, Shawn Heisey a écrit : > >> Looks like on my last edit I deleted it and didn't add it to > >> defaults, so I was wrong in what I said.  It throws a

Re: Wierd issue with OCSP updating

2023-07-17 Thread William Lallemand
On Thu, Jul 13, 2023 at 10:48:41AM -0600, Shawn Heisey wrote: > On 7/12/23 04:13, Remi Tricot-Le Breton wrote: > > On 11/07/2023 22:22, Shawn Heisey wrote: > >> On 7/11/23 01:30, Remi Tricot-Le Breton wrote: > >> That directive didn't work in "global" but it was accepted when I > >> moved it to

[PATCH 1/1] MEDIUM: ssl: new sample fetch method to get curve name

2023-07-17 Thread Mariam John
Adds a new sample fetch method to get the curve name used in the key agreement to enable better observability. In OpenSSLv3, the function `SSL_get_negotiated_group` returns the NID of the curve and from the NID, we get the curve name by passing the NID to OBJ_nid2sn. This was not available in

[PATCH 0/1] Implement new sample fetch method to get the curve name used in key agreement

2023-07-17 Thread Mariam John
This is an implementation of feature request [#2165](https://github.com/haproxy/haproxy/issues/2165), to get the EC curve name used during the key agreement in OpenSSL. This patch includes the following changes: - new sample fetch methods `ssl_fc_curve` and `ssl_bc_curve`, to get the curve name

RE: [PATCH 0/1] Implement new sample fetch method to get the curve name used in key agreement

2023-07-17 Thread Mariam John
Indeed I did. I send the patch from the old folder. I apologize for the mistake on my part. I am sending the right one now. Thank you for your patience. Regards, Mariam. From: William Lallemand Date: Monday, July 17, 2023 at 4:28 AM To: Mariam John Cc: haproxy@formilux.org ,

Re: Old style OCSP not working anymore?

2023-07-17 Thread William Lallemand
On Thu, Jul 13, 2023 at 05:01:06PM +0200, Sander Klein wrote: > Hi, > > I tried upgrading from 2.6.14 to 2.8.1, but after the upgrade I couldn't > connect to any of the sites behind it. > > While looking at the error it seems like OCSP is not working anymore. > Right now I have a setup in

Re: Compiling HAProxy 2.8.1 with WolfSSL 5.6.3 yields errors about OCSP

2023-07-17 Thread William Lallemand
On Fri, Jul 14, 2023 at 11:01:16PM +0200, Marcel Menzel wrote: > Hello List, > > Trying to compile HAProxy version 2.8.1 with WolfSSL 5.6.3 results in > the following error: > > src/ssl_sock.c: In function ‘ssl_sock_load_ocsp’: > src/ssl_sock.c:1117:9: error: unknown type name ‘tlsextStatusCb’

RE: School Districts Contacts 2023

2023-07-17 Thread Natalie Harper
Hi there, We are excited to offer you a comprehensive email list of school districts that includes key contact information such as phone numbers, email addresses, mailing addresses, company revenue, size, and web addresses. Our databases also cover related industries such as: * K-12

Re: [PATCH] BUILD: ssl: Build with new cryptographic library AWS-LC

2023-07-17 Thread William Lallemand
On Wed, Jul 12, 2023 at 12:26:06AM +, Hopkins, Andrew wrote: > Hello HAProxy maintainers, I work on the AWS libcrypto (AWS-LC) > project [1]. Our goal is to improve the cryptography we use internally > at AWS and help our customers externally. In the spirit of helping > people use good crypto

Re: [PATCH 0/1] Implement new sample fetch method to get the curve name used in key agreement

2023-07-17 Thread William Lallemand
On Fri, Jul 14, 2023 at 02:59:52AM -0500, Mariam John wrote: > This is an implementation of feature request > [#2165](https://github.com/haproxy/haproxy/issues/2165), > to get the EC curve name used during the key agreement in OpenSSL. This patch > includes the following > changes: > - new