Re: How to help OpenSSL

2014-04-25 Thread Matt Caswell
On 25 April 2014 01:14, Viktor Dukhovni openssl-us...@dukhovni.org wrote: On Thu, Apr 24, 2014 at 04:56:09PM -0700, Quanah Gibson-Mount wrote: The problem with this approach are significant requests that have languished for years. One such example would be

Re: How to help OpenSSL

2014-04-25 Thread Matt Caswell
On 25 April 2014 01:58, Daniel Reynolds daniel.reyno...@providenceday.org wrote: I am not totally sure how many people would be working on this project, but is seems to me like it would make sense to split up into 3 groups. I would be concerned about spreading ourselves too thinly. I hope that

Re: How to help OpenSSL

2014-04-25 Thread Jeff Trawick
On Thu, Apr 24, 2014 at 7:08 PM, Matt Caswell fr...@baggins.org wrote: On 24 April 2014 18:31, Ben Laurie b...@links.org wrote: Note that this is just how to help me, not a consensus view from the whole team, though I have no doubt much of it will be helpful to the team, too. 1. Triage

Re: How to help OpenSSL

2014-04-25 Thread Jeff Trawick
On Fri, Apr 25, 2014 at 10:03 AM, Jeff Trawick traw...@gmail.com wrote: On Thu, Apr 24, 2014 at 7:08 PM, Matt Caswell fr...@baggins.org wrote: On 24 April 2014 18:31, Ben Laurie b...@links.org wrote: Note that this is just how to help me, not a consensus view from the whole team, though I

How to help OpenSSL

2014-04-25 Thread Ben Laurie
Note that this is just how to help me, not a consensus view from the whole team, though I have no doubt much of it will be helpful to the team, too. 1. Triage RT (https://rt.openssl.org/). RT has been neglected for a long time. People could usefully go through it and identify: a) Tickets that

Re: The Future of OpenSSL

2014-04-25 Thread Reini Urban
On 04/23/2014 03:08 PM, Dr. Stephen Henson wrote: On Wed, Apr 23, 2014, Steve Marquess wrote: On 04/23/2014 01:30 PM, Hanno Böck wrote: Hi, ... Basically, what bothers me most is that right now it seems to me the openssl project is unresponsive. There are people out there who want to improve

RE: openssl -CAfile patch

2014-04-25 Thread Salz, Rich
I think a general mechanism that allowed you to set default command-line flags would be useful. (And of course you'd need a new flag to skip that.) For example, a new [commandline] section, where command-flag is the key or command-flag.1, command-flag.2 for repeated instances. /r$ --

Re: openssl -CAfile patch

2014-04-25 Thread Viktor Dukhovni
On Wed, Apr 23, 2014 at 11:09:59PM -0400, Helmut Tessarek wrote: Every time I run openssl s_client -connect example.com:443, I get a Verify return code: 20 (unable to get local issuer certificate). It works, if I specify a -CAfile. The problem is I have to specify this _every_ time I run

Fwd: How to help OpenSSL

2014-04-25 Thread Jeff Trawick
On Fri, Apr 25, 2014 at 10:03 AM, Jeff Trawick traw...@gmail.com wrote: On Thu, Apr 24, 2014 at 7:08 PM, Matt Caswell fr...@baggins.org wrote: On 24 April 2014 18:31, Ben Laurie b...@links.org wrote: Note that this is just how to help me, not a consensus view from the whole team, though I

[openssl.org #3286] [PATCH] fixed the DTLS crash bug

2014-04-25 Thread zhu qun-ying
In dtsl1_cler_queues() , the data field of the item in s-d1-buffered_app_data.q is incorrectly treated as hm_fragment *, it should be DTLS1_RECORD_DATA * -- qun-yingdiff --git a/ssl/d1_lib.c b/ssl/d1_lib.c index 2287ba6..7d9d91f 100644 --- a/ssl/d1_lib.c +++ b/ssl/d1_lib.c @@ -202,9 +202,12 @@

[openssl.org #3286] [PATCH] fixed the DTLS crash bug

2014-04-25 Thread zhu qun-ying via RT
In dtsl1_cler_queues() , the data field of the item in s-d1-buffered_app_data.q is incorrectly treated as hm_fragment *, it should be DTLS1_RECORD_DATA * -- qun-ying diff --git a/ssl/d1_lib.c b/ssl/d1_lib.c index 2287ba6..7d9d91f 100644 --- a/ssl/d1_lib.c +++ b/ssl/d1_lib.c @@ -202,9 +202,12 @@

Which of HOW TO CONTRIBUTE TO OpenSSL in README is still relevant?

2014-04-25 Thread Jeff Trawick
Note: Glance at http://wiki.openssl.org/index.php/Main_Page#Feedback_and_Contributions for some context. Anyway, about that section in README: openssl-bugs is dead, right? (instead: https://www.openssl.org/support/rt.html) Patches seem to be better covered at

Re: [openssl.org #3191] [BUG] OpenSSL-1.0.2 segfaulting on sha1_block_data_order asm

2014-04-25 Thread Andy Polyakov via RT
after moving from OpenSSL-1.0.1e to OpenSSL-1.0.2-5ff68e8 our nginx instances started crashing (very rarely, but still...) with backtraces pointing to either sha1_block_data_order_avx or sha1_block_data_order_ssse3, depending on machine. This is happening when nginx is acting as a client, as

Re: [openssl.org #3191] [BUG] OpenSSL-1.0.2 segfaulting on sha1_block_data_order asm

2014-04-25 Thread Piotr Sikora via RT
Hey Andy, Some kind of deja vu here. I remember I was looking at this and drew some conclusion... I think it was addressed and commit b77b58a398c8b9b4113f3fb6b48e162a3b8d4527 actually mentions this ticket. Can you confirm? Yes, it's been fixed by this commit. Best regards, Piotr Sikora