[openssl.org #3140] clang warning about possibly unitialized variable

2014-09-02 Thread Rich Salz via RT
OpenSSL_1_0_2-stable fa2ae04 RT3140: Possibly-unit variable in pem_lib.c HEAD 0ff3687 RT3140: Possibly-unit variable in pem_lib.c Author: Clang via Jeffrey Walton Date: Tue Sep 2 17:04:53 2014 -0400 RT3140: Possibly-unit variable in pem_lib.c Can't really happen, but the flow of control isn't o

Re: [openssl.org #3203] Normalize PFS key exchange labels

2014-09-02 Thread Daniel Kahn Gillmor
On 09/02/2014 03:34 PM, Salz, Rich wrote: > I think there's interest for 1.0.1 and beyond. > > But I thought we already had a similar alias mechanism? With the version of openssl 1.0.1i that i have in front of me, "openssl ciphers EDH" succeeds, but "openssl ciphers DHE" fails. So i don't think

RE: [openssl.org #3203] Normalize PFS key exchange labels

2014-09-02 Thread Salz, Rich
I think there's interest for 1.0.1 and beyond. But I thought we already had a similar alias mechanism?

Re: Openssl build errors on zLinux and HP-ita

2014-09-02 Thread Tom Francis
For HP-UX, be sure to install the latest linker patches. +sectionmerge has been around for a long while, so you’ve probably got a lot of patches to install. :) TOM On Sep 2, 2014, at 5:45 AM, Mrunal Nerpawar wrote: > Hi > > zLinux: > 1) ./config > Configured for linux64-s390x. > 2) make

Re: [openssl.org #3203] Normalize PFS key exchange labels

2014-09-02 Thread Daniel Kahn Gillmor via RT
On Mon 2014-05-12 15:18:35 -0400, Daniel Kahn Gillmor via RT wrote: > I'm happy that the PFS key exchange normalization changesets have been > merged into master. > > I've submitted https://github.com/openssl/openssl/pull/106 for the 1.0.2 > stable branch to add similar aliasing for the library inp

RE: apps/ts.c patch - engine support

2014-09-02 Thread Salz, Rich
> You are right - it should not break anything as the patch only affects the ts > app. I put this on my dev branch for post-1.0.2 release: https://github.com/akamai/openssl/tree/rsalz-monolith -- Principal Security Engineer Akamai Technologies, Cambridge MA IM: rs...@jabber.me Twitter: RichSa

Re: [openssl.org #3470] [BUG] DTLS abort

2014-09-02 Thread Michael Tüxen via RT
On 02 Sep 2014, at 14:42, Brian Hassink via RT wrote: > Sorry, I see there were some earlier posts on this very subject. > > Also, I found the following in RFC 6083 (section 1.1)... > > o The maximum user message size is 2^14 bytes, which is the DTLS limit. > > I wonder if the authors o

RE: apps/ts.c patch - engine support

2014-09-02 Thread Damir Dzeko Antic
> > Of no less importance is to emphasise that it adds additional "keyform" > > parameter to functions defined in ts.c and utilized by "-reply" > > function, that will *break* compatibility with any previously existing code. > How does it break? We don't care about source-level compatibility wit

[openssl.org #3334] Win32, SSL_add_dir_cert_subjects_to_stack() does not work.

2014-09-02 Thread Richard Levitte via RT
Hi! I've taken on this task recently, and you definitely raise a good point. However, to be consistent with the other supported platforms, LP_find_file should NOT skip over directories. Its up to the application to check them and handle them appropriately. I'm working on making the appropriate cha

RE: [openssl.org #3470] [BUG] DTLS abort

2014-09-02 Thread Brian Hassink via RT
Sorry, I see there were some earlier posts on this very subject. Also, I found the following in RFC 6083 (section 1.1)... o The maximum user message size is 2^14 bytes, which is the DTLS limit. I wonder if the authors of RFC 6733 (section 13.1) were aware of this limitation when they s

RE: [openssl.org #3470] [BUG] DTLS abort

2014-09-02 Thread Salz, Rich
Partial writes do not work over UDP; by design. As to whether or not you can use a packet as big as 16K, in depends on the "path MTU" -- what's the maximum transmission size between you and the destination, along the communication path. You'll have to make your packets smaller then that. This

RE: [openssl.org #3470] [BUG] DTLS abort

2014-09-02 Thread Brian Hassink via RT
We do have an open question in regards to DTLS/SCTP, and that is whether it is possible to send messages larger than 16K? In our application, such large messages are not uncommon. We've tried setting the SSL_MODE_ENABLE_PARTIAL_WRITE flag with no success. Thanks, Brian -Original Message---

RE: [openssl.org #3494] Possible sign bit bug in openssl 1.0.1i handling of 128-bit serial numbers

2014-09-02 Thread Salz, Rich
> RFC 5280 requires that serial numbers MUST be positive, negative serial > numbers do not conform with RFC (see 4.1.2.2). Yes, thanks for the clarification. -- Principal Security Engineer Akamai Technologies, Cambridge MA IM: rs...@jabber.me Twitter: RichSalz _

Openssl build errors on zLinux and HP-ita

2014-09-02 Thread Mrunal Nerpawar
Hi zLinux: 1) ./config Configured for linux64-s390x. 2) make Error: making fips in crypto... make[1]: Entering directory `/builds/openssl/openssl-fips-ecp-2.0.5/crypto' gcc -I. -I.. -I../include -DOPENSSL_FIPSCANISTER -fPIC -DOPENSSL_PIC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -

Re: [openssl.org #3494] Possible sign bit bug in openssl 1.0.1i handling of 128-bit serial numbers

2014-09-02 Thread Annie Yousar
Rich, your reply is wrong, but your answer is OK. Serial Numbers are not at all unsigned, since the type of serial numbers is INTEGER in ASN.1, which are signed. RFC 5280 requires that serial numbers MUST be positive, negative serial numbers do not conform with RFC (see 4.1.2.2). The serialNumbe