Re: [PATCH: CVE-2011-1473]: Fight against DoS in openssl

2012-02-20 Thread Guan Jun He
Hi Tomas and All, On 1/16/2012 at 11:31 PM, in message 20120116163148.4f325...@redhat.com, Tomas Hoger tho...@redhat.com wrote: On Wed, 11 Jan 2012 21:04:33 -0700 Guan Jun He wrote: It seems you're trying to address more than just CVE-2011-1473 via this patch, which results in a fairly

Re: [PATCH: CVE-2011-1473]: Fight against DoS in openssl

2012-02-10 Thread Guan Jun He
On 1/16/2012 at 11:31 PM, in message 20120116163148.4f325...@redhat.com, Tomas Hoger tho...@redhat.com wrote: On Wed, 11 Jan 2012 21:04:33 -0700 Guan Jun He wrote: It seems you're trying to address more than just CVE-2011-1473 via this patch, which results in a fairly large patch. Why

Re: [PATCH: CVE-2011-1473]: Fight against DoS in openssl

2012-01-13 Thread Guan Jun He
Hi Tomas, Thanks for your reply! On 1/10/2012 at 08:12 PM, in message 20120110131229.7ede5...@redhat.com, Tomas Hoger tho...@redhat.com wrote: Hi Guanjun! On Sun, 11 Dec 2011 20:35:02 -0700 Guan Jun He wrote: I have just produced a patch against the upstream HEAD version, to seek

Re: [PATCH: CVE-2011-1473]: Fight against DoS in openssl

2011-12-19 Thread Guan Jun He
On 12/12/2011 at 11:35 AM, in message 4ee5e6e60216b...@novprvlin0050.provo.novell.com, Guan Jun He g...@suse.com wrote: Hi, I have just produced a patch against the upstream HEAD version, to seek a way to fight against DoS attack in openssl itself, the logic is simple, get client's

[PATCH: CVE-2011-1473]: Fight against DoS in openssl

2011-12-12 Thread Guan Jun He
Hi, I have just produced a patch against the upstream HEAD version, to seek a way to fight against DoS attack in openssl itself, the logic is simple, get client's ip address in BIO layer, and send this info to upper SSL layer; In SSL layer, according to the client ip and control policy to do

Re: A possible way to against DoS in openssl

2011-12-02 Thread Guan Jun He
! Guanjun On 11/21/2011 at 05:49 PM, in message 4ECA1E9C.19D : 22 : 21801, Guan Jun He wrote: Hi, I have just produced a patch against the upstream HEAD version, to seek a way to against DoS attack in openssl itself, the logic is simple, get client's ip addressin BIO layer

Re: patch to add a switch for renegotiation (finding a solution against DoS)

2011-11-16 Thread Guan Jun He
On 11/15/2011 at 10:42 PM, in message 2015154237.7dca96f4@laverne, Hanno Böckha...@hboeck.de wrote: Am Tue, 15 Nov 2011 02:48:28 -0700 schrieb Guan Jun He g...@suse.com: Add a switch to renegotiation, so that renegotiation can be controled by program. And it provides a way

patch to add a switch for renegotiation

2011-11-15 Thread Guan Jun He
Hello, Add a switch to renegotiation, so that renegotiation can be controled by program. And it provides a way to programmer to implement some sort of custom throttling. Basically, this patch is produced with the background of CVE-2011-1473, the DoS against renegotiation.You guys must have

Re: We want to add a switch to openssl's zlib compression methord

2011-06-14 Thread Guan Jun He
On 6/10/2011 at 09:35 PM, in message 20110610133552.ga26...@panix.com, Thor Lancelot Simon t...@panix.com wrote: On Fri, Jun 10, 2011 at 01:01:49PM +0200, Dr. Stephen Henson wrote: There is SSL_OP_NO_COMPRESSION. In that case, the suggestion to provide a config file setting for

Re: We want to add a switch to openssl's zlib compression methord

2011-06-09 Thread Guan Jun He
Thanks a lot for your reply! On 6/8/2011 at 09:42 PM, in message 20110608134254.ga6...@panix.com, Thor Lancelot Simon t...@panix.com wrote: On Tue, Jun 07, 2011 at 10:58:20PM -0600, Guan Jun He wrote: Hi, Openssl Developpers: We have a platform with cryptographic hardware,and we try

We want to add a switch to openssl's zlib compression methord

2011-06-08 Thread Guan Jun He
Hi, Openssl Developpers: We have a platform with cryptographic hardware,and we try to take advantage of the platform's hardware cryptographic features.But openSSL compresses data before the encryption, having a massive performance impact(throughput decrease, CPU load increase) on platforms

答复: Re: ??? Re: [PATCH] to add a switch to openssl's compression methords

2011-05-26 Thread Guan Jun He
在 11:15 下午 的 5/25/2011 上,在讯息 20110525151556.ga5...@panix.com 中,Thor Lancelot Simon t...@panix.com 写入: On Tue, May 24, 2011 at 07:45:34PM -0600, Guan Jun He wrote: ? 10:23 ?? ? 5/24/2011 ? 20110524142324.ga29...@panix.com ??Thor Lancelot Simon t...@panix.com ??? On Tue, May 24, 2011

答复: Re: [PATCH] to add a switch to openssl's compression methords

2011-05-25 Thread Guan Jun He
在 10:23 下午 的 5/24/2011 上,在讯息 20110524142324.ga29...@panix.com 中,Thor Lancelot Simon t...@panix.com 写入: On Tue, May 24, 2011 at 05:10:03PM +0800, GuanJun He wrote: Hi, This is a patch to add a switch to openssl's compression methords(if compression methords are configured to compile in,

openssl-0.9.8k ./Configure --test-sanity got failed

2009-06-17 Thread Guan Jun He
Dear everyone I got the openssl-0.9.8k package from openssl.org, then I run the command './Configure --test-sanity',and I got the following error, g...@macintyre:~/project/stable/openssl-0.9.8k ./Configure --test-sanity ==