SSL_connect fails, no attempt for handshake with server (observed in wireshark)

2014-04-15 Thread hhachem
Hello, I have a code cross compiled to 2 devices. On 1 device the code works flawlessly, on the other SSL_connect does nothing. Info about both devices: Device 1: (working) CPU: PowerPC @ 220MHz RAM: 128MB SD-RAM Device 2: (not working) CPU: PowerPC @ 133MHz RAM:32MB SD-RAM here's the code I'm

Re: SSL_connect fails, no attempt for handshake with server (observed in wireshark)

2014-04-15 Thread hhachem
Sorry file too large to upload. Here's a smaller version ssl_connect_small.pcap http://openssl.6102.n7.nabble.com/file/n49401/ssl_connect_small.pcap Set filter to : ip.addr==74.125.136.108 -- View this message in context:

Re: seems openssl version 1.0.1g also infected

2014-04-15 Thread Rainer M. Canavan
On Apr 14, 2014, at 13:13 , LOKESH JANGIR lk.jangi...@gmail.com wrote: Hi Fedor, Yes i did not move this file out. and i can see the output of ls -la /lib64/libcrypt.so.1 libcrypt.so - ../../lib64/libcrypt.so.1 I complied openssl and it created this library files, engines

Re: SSL_connect fails, no attempt for handshake with server (observed in wireshark)

2014-04-15 Thread hhachem
I modified my code a bit: *static SSL_CTX *ctx = NULL; static SSL *ssl = NULL; void CreateTLSSession(int sockfd) { int RetValue=0; printf(CREATING TLS SESSION...\n); SSL_library_init(); SSL_load_error_strings(); OpenSSL_add_all_algorithms();

Re: [openssl.org #3306] OpenSSL Enhancement: the binary library should contain the version strings found in the header opensslv.h

2014-04-15 Thread Tom Swirly
Thanks for a fast and clear reply! On Mon, Apr 14, 2014 at 1:58 PM, Kurt Roeckx via RT r...@openssl.org wrote: Then a program linking to this library can read either of these global variables at runtime and fail to start or emit a warning if the version isn't up-to-date. Please don't do

[openssl.org #3313] [PATCH] Uninitialized pointer dereference in pkey_ctrl_gost()

2014-04-15 Thread David Ramos via RT
Hello, I'm a researcher at Stanford working on the UC-KLEE bug-finding/verification tool. Our tool discovered a bug introduced in patch c0b31ccb87679783c355616aa7c6c6e97eeb9c5d (March 2012) that appears to still affect the latest 1.0.1 and 1.0.2 branches. The offending code from

OpenSSL should disable or remove heartbeat

2014-04-15 Thread Hanno Böck
Hi, I think this question needs to be asked. We have a TLS extension here that - as far as I can see - nobody uses. I have asked in different contexts recently if anyone is aware of real software that makes use of the heartbeat extension. I got often answerts like it could be used for X, but not

Re: OpenSSL should disable or remove heartbeat

2014-04-15 Thread Fedor Indutny
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello Hanno! Despite not a being an active community member, I'd like to share my thoughts on it, if you don't mind. I certainly agree that this extension has a quite faulty specification and very questionable use. But perhaps, instead of just

Re: OpenSSL should disable or remove heartbeat

2014-04-15 Thread Michael Tuexen
On 15 Apr 2014, at 14:26, Fedor Indutny fe...@indutny.com wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello Hanno! Despite not a being an active community member, I'd like to share my thoughts on it, if you don't mind. I certainly agree that this extension has a quite faulty

Re: OpenSSL should disable or remove heartbeat

2014-04-15 Thread Hanno Böck
On Tue, 15 Apr 2014 14:35:36 +0200 Michael Tuexen michael.tue...@lurchi.franken.de wrote: On 15 Apr 2014, at 14:26, Fedor Indutny fe...@indutny.com wrote: I certainly agree that this extension has a quite faulty specification and very questionable use. But perhaps, instead of just

[openssl.org #3314] BUG - CMS Decrypt returns wrong error message on mismatching private key after Bleichenbachers FIX

2014-04-15 Thread Harakiri via RT
This commit: http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=146b52edd122f55e2b2bfeb486dae8dbe96f739e   Introduced an error/new behavior, specifically this file

[openssl.org #3315] Why does the linker complain about undefined symbols?

2014-04-15 Thread janmus.chan via RT
Hello, My Request : *How does the openssl-1.0.1 support the **Beyond BA22 Embedded Processor ?* I still got a compiler error ~ Please help me, thank you!! *BR,janmus* __ OpenSSL Project

Re: OpenSSL should disable or remove heartbeat

2014-04-15 Thread Richard Könning
Am 15.04.2014 14:35, schrieb Michael Tuexen: On 15 Apr 2014, at 14:26, Fedor Indutny fe...@indutny.com wrote: Hello Hanno! Despite not a being an active community member, I'd like to share my thoughts on it, if you don't mind. I certainly agree that this extension has a quite faulty

Re: [openssl.org #3312] OpenSSL :: crypto/mem.c without memset() calls?

2014-04-15 Thread Vladimir Zatsepin
Hi! Some compilers might to optimize memset() call so it does nothing. That's why memset() is not a proper variant. Please take a look at OPENSSL_cleanse() function. 14.04.2014 23:57 пользователь Markus Grundmann via RT r...@openssl.org написал: Hi! I have checked the current source code of

[openssl.org #3314] BUG - CMS Decrypt returns wrong error message on mismatching private key after Bleichenbachers FIX

2014-04-15 Thread Stephen Henson via RT
On Tue Apr 15 17:28:47 2014, harakiri...@yahoo.com wrote: Please consider reverting/ or fixing this debug behavior - otherwise its hard to understand why automated smime gateways have issues decrypting messages. Otherwise update the documentation - that under no circumenstances the

AW: [openssl.org #3312] OpenSSL :: crypto/mem.c without memset() calls?

2014-04-15 Thread stefan.n...@t-online.de
Hi, I have checked the current source code of 'crpyto/mem.c' and I'm a little bit suprised that no memset()-calls are made before the free_*() functions are entered. I think a zeroing of the previous used memory is a good solutions to beware for accessing old memory content.

Re: OpenSSL should disable or remove heartbeat

2014-04-15 Thread Michael Tuexen
On 15 Apr 2014, at 16:43, Hanno Böck ha...@hboeck.de wrote: On Tue, 15 Apr 2014 14:35:36 +0200 Michael Tuexen michael.tue...@lurchi.franken.de wrote: On 15 Apr 2014, at 14:26, Fedor Indutny fe...@indutny.com wrote: I certainly agree that this extension has a quite faulty specification

Re: OpenSSL should disable or remove heartbeat

2014-04-15 Thread Michael Tuexen
On 15 Apr 2014, at 18:23, Richard Könning richard.koenn...@ts.fujitsu.com wrote: Am 15.04.2014 14:35, schrieb Michael Tuexen: On 15 Apr 2014, at 14:26, Fedor Indutny fe...@indutny.com wrote: Hello Hanno! Despite not a being an active community member, I'd like to share my thoughts

[openssl.org #3309] Bug: Missing critical flag for extended key usage not detected in time-stamp verification

2014-04-15 Thread Stephen Henson via RT
On Mon Apr 14 11:52:31 2014, s...@pdflib.com wrote: I was not able to find the root cause why X509_get_ext_by_NID() fails to retrieve the extension here, but the function check_purpose_timestamp_sign() should also not return 1 if the extended key usage extension cannot be retrieved, as the

[openssl.org #3308] Re: Return missed NULL-check in CMS_add0_cert back

2014-04-15 Thread Stephen Henson via RT
On Mon Apr 14 11:52:20 2014, amde...@gmail.com wrote: Well... With this check 'make test' fails with: CMS = PKCS#7 compatibility tests signed content DER format, RSA key: generation error make[1]: *** [test_cms] Error 1 Can't reproduce that here. Anyone else seeing this? On 14 April