[openssl.org #2477] openssl-1.0.0d build ... make test fail

[Rich Salz via RT]

old release, old report, not enough information to reproduce, closing ticket.
--
Rich Salz, OpenSSL dev team; rs...@openssl.org

__
OpenSSL Project http://www.openssl.org
Development Mailing List   openssl-dev@openssl.org
Automated List Manager   majord...@openssl.org

[openssl.org #2511] OpenSSL.org HTTPS version is broken

[Rich Salz via RT]

Most likely browser caching issue.
--
Rich Salz, OpenSSL dev team; rs...@openssl.org

__
OpenSSL Project http://www.openssl.org
Development Mailing List   openssl-dev@openssl.org
Automated List Manager   majord...@openssl.org

[openssl.org #2363] bug: memory allocated by DH_new() may never be free()ed

[Rich Salz via RT]

Code taht does DH_free(DH_new()) leaks memory when in a DLL on Solaris?
Doesn't seem like an OpenSSL bug.
Closing ticket.
--
Rich Salz, OpenSSL dev team; rs...@openssl.org

__
OpenSSL Project http://www.openssl.org
Development Mailing List   openssl-dev@openssl.org
Automated List Manager   majord...@openssl.org

Re: [openssl.org #2665] s_client support for starttls ldap

[Viktor Dukhovni]

On Mon, Sep 01, 2014 at 10:02:16AM -0400, Salz, Rich wrote:

> My point is that since stunnel has a different goal of wrapping
> almost any protocol, that might be a better place for it, rather
> than going down the slippery slope of putting a binary hack into
> s_client which wouldn't let you actually USE the protocol.

Yes, of course.  The s_client command is not netcat.  Of course if
the goal is troubleshoot connection problems, rather than use the
connections, then a command-line client is helpful.  For that, new
or existing debugging options in ldapsearch(1) or similar may be
more appropriate.

-- 
Viktor.
__
OpenSSL Project http://www.openssl.org
Development Mailing List   openssl-dev@openssl.org
Automated List Manager   majord...@openssl.org

[openssl.org #2293] OpenSSL dependence on external threading functions is a critical design flaw

[Rich Salz via RT]

We're going to try to clean up the threads situation post-1.0.2, but closing
this particular ticket.
--
Rich Salz, OpenSSL dev team; rs...@openssl.org

__
OpenSSL Project http://www.openssl.org
Development Mailing List   openssl-dev@openssl.org
Automated List Manager   majord...@openssl.org

[openssl.org #2320] enhancement request

[Rich Salz via RT]

That program supports the special-purpose hashing use by unix and APR.
For generic hashing the "digest" program should work.
Closing ticket.
--
Rich Salz, OpenSSL dev team; rs...@openssl.org

__
OpenSSL Project http://www.openssl.org
Development Mailing List   openssl-dev@openssl.org
Automated List Manager   majord...@openssl.org

[openssl.org #1911] Please add 'rsa3072' to openssl speed

[Rich Salz via RT]

commit 7e6a01bdd42e2e5087c9093f1648f1449499f027
Author: Oscar Jacobsson 
Date: Sun Jun 29 21:38:09 2014 +0100

Add 3072, 7680 and 15360 bit RSA tests to openssl speed

PR#3412

--
Rich Salz, OpenSSL dev team; rs...@openssl.org

__
OpenSSL Project http://www.openssl.org
Development Mailing List   openssl-dev@openssl.org
Automated List Manager   majord...@openssl.org

[openssl.org #1756] PATCH: v3_addr_canonize() needs to set comparision function

[Rich Salz via RT]

Done some time ago, not quite clear who the mystery dev was :)
--
Rich Salz, OpenSSL dev team; rs...@openssl.org

__
OpenSSL Project http://www.openssl.org
Development Mailing List   openssl-dev@openssl.org
Automated List Manager   majord...@openssl.org

[openssl.org #1820] mem leak BN_mpi2bn

[Rich Salz via RT]

BN_bin2bn free's its value on error, so there doesn't appear to be a leak.
Closing ticket.
--
Rich Salz, OpenSSL dev team; rs...@openssl.org

__
OpenSSL Project http://www.openssl.org
Development Mailing List   openssl-dev@openssl.org
Automated List Manager   majord...@openssl.org

[openssl.org #1615] [PATCH] Using uninitialized value "(c).q"

[Rich Salz via RT]

commit 23b973e600550541fc942eee3030f124862dcc68
Author: Ben Laurie 
Date: Thu Jan 1 18:30:51 2009 +

Calculate offset correctly. (Coverity ID 233)

--
Rich Salz, OpenSSL dev team; rs...@openssl.org

__
OpenSSL Project http://www.openssl.org
Development Mailing List   openssl-dev@openssl.org
Automated List Manager   majord...@openssl.org

[openssl.org #1523] Re: how to extract signature from public key using openssl?

[Rich Salz via RT]

5da66dd26f943701f6a27e261355eea7a9f6c0ee
Author: Rich Salz 
Date: Wed Sep 3 16:06:39 2014 -0400

RT1523: Add -nocert to fix output in x509 app

Add -nocert flag to suppress printing cert (useful when you
do another output like -fingerprint). Make all output go
to whatever the output file is.

__
OpenSSL Project http://www.openssl.org
Development Mailing List   openssl-dev@openssl.org
Automated List Manager   majord...@openssl.org

[openssl.org #3334] Win32, SSL_add_dir_cert_subjects_to_stack() does not work.

[Richard Levitte via RT]

Fix committed in master branch, revision id
6a14fe7576e7a14a46ba14df8be8fe478536b4fb. Soon to trickle down into the other
branches.

On Tue Sep 02 15:00:30 2014, levitte wrote:
> Hi!
>
> I've taken on this task recently, and you definitely raise a good
> point.
> However, to be consistent with the other supported platforms,
> LP_find_file
> should NOT skip over directories. Its up to the application to check
> them and
> handle them appropriately. I'm working on making the appropriate
> changes.
>
> On Tue Apr 29 08:35:06 2014, mesnie...@ociweb.com wrote:
> > OpenSSL 1.0.1f 6 Jan 2014
> > built on: Tue Jan 21 21:28:48 2014
> > platform: VC-WIN32
> > options: bn(64,32) rc4(8x,mmx) des(idx,cisc,2,long) idea(int)
> > blowfish(idx)
> > compiler: cl /MDd /Od -DDEBUG -D_DEBUG -DOPENSSL_THREADS -DDSO_WIN32
> > -W3 -WX -Gs0 -GF -Gy -Zi -nologo -DOPENSSL_SYSNAME_WIN32
> > -DWIN32_LEAN_AND_MEAN -DL_ENDIAN -D_CRT_SECURE_NO_DEPRECATE
> > -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2
> > -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM
> > -DSHA512_ASM -DMD5_ASM -DRMD160_ASM -DAES_ASM -DVPAES_ASM
> > -DWHIRLPOOL_ASM -DGHASH_ASM -DOPENSSL_USE_APPLINK -I.
> > -DOPENSSL_NO_RC5 -DOPENSSL_NO_MD2 -DOPENSSL_NO_KRB5
> > -DOPENSSL_NO_JPAKE -DOPENSSL_NO_STATIC_ENGINE
> > OPENSSLDIR: "C:\openssl-vc-32-dbg/ssl"
> >
> > OS: Windows 7
> >
> > CC: Microsoft (R) 32-bit C/C++ Optimizing Compiler Version
> > 16.00.40219.01 for 80x86
> >
> > Problem description:
> > On windows systems, SSL_add_dir_cert_subjects_to_stack() does not
> > work.
> >
> > This problem exists in all releases of 1.0.0, 1.0.1, and 1.0.2.
> >
> > The implementation LP_find_file () incorrectly assumes that the
> win32
> > api
> > call FindFirstFile () works the same as opendir. It does not, rather
> > it is
> > more like grep in that it treats the argument as a regular
> expression.
> > Given
> > a path such as "./certs" in which there are 1 or more *.pem files
> that
> > are
> > valid certificate files, LP_find_file () will return a single entry
> > "./certs"
> > which of course is not a valid certificate file. When provided an
> > expression
> > such as "./certs/*", FindFirstFile () and its companion
> FindNextFile()
> > step
> > through all entries. Since the returned name may be a directory, it
> is
> > necessary to verify the entry type and skip over directories.
> >
> > Attached is a patch for LPdir_win.c which does just that - first it
> > ensures
> > the supplied directory name is suitable to be searchable, then it
> > skips
> > entries that are directories by recursing.
> >
> > Best regards,
> > Phil
> >
> > --
> > Phil Mesnier
> > Principal Software Engineer and Partner, http://www.ociweb.com
> > Object Computing, Inc. +01.314.579.0066 x225
> >
>
>
> --
> Richard Levitte
> levi...@openssl.org


--
Richard Levitte
levi...@openssl.org

__
OpenSSL Project http://www.openssl.org
Development Mailing List   openssl-dev@openssl.org
Automated List Manager   majord...@openssl.org

[openssl.org #1412] [BUG] race/leak in X509_PUBKEY_get

[Rich Salz via RT]

Fixed with commitdc4f678cdc12beeef9d501f32468681ac775fd76 in Feb 2012. Thanks.

--
Rich Salz, OpenSSL dev team; rs...@openssl.org

__
OpenSSL Project http://www.openssl.org
Development Mailing List   openssl-dev@openssl.org
Automated List Manager   majord...@openssl.org

[openssl.org #721] BUG: Short passwords not allowed 0.9.7c

[Rich Salz via RT]

You can always change PW_MIN_LENGTH in apps.h. Or specify the password on the
command-line as mentioned in the ticket. We could have a separate callback for
'decrypt' vs 'encrypt' but have no plans to do so. Closing ticket.
--
Rich Salz, OpenSSL dev team; rs...@openssl.org

__
OpenSSL Project http://www.openssl.org
Development Mailing List   openssl-dev@openssl.org
Automated List Manager   majord...@openssl.org

Re: [openssl.org #3510] AutoReply: Clang warning/error fixes

[Mike Bland via RT]

Withdrawn. Commits b0426a0f8c6ce7656411b037e0c45465320cb325 and
86f50b36e63275a916b147f9d8764e3c0c060fdb are identical to those in the
original pull request.

Mike

On Sun, Aug 31, 2014 at 8:19 AM, The default queue via RT
 wrote:
>
> Greetings,
>
> This message has been automatically generated in response to the
> creation of a trouble ticket regarding:
> "Clang warning/error fixes",
> a summary of which appears below.
>
> There is no need to reply to this message right now.  Your ticket has been
> assigned an ID of [openssl.org #3510].
>
> Please include the string:
>
>  [openssl.org #3510]
>
> in the subject line of all future correspondence about this issue. To do so,
> you may reply to this message.
>
> Thank you,
> r...@openssl.org
>
> -
> Pull request #145 [openssl.org #3447] contains the commit
> "{,darwin64-}debug-test-64-clang Configure targets". A couple of
> recent commits on openssl:master cause builds configured for these
> targets to fail. The commits in this pull request contain fixes for
> these issues:
>
> https://github.com/openssl/openssl/pull/167
>
> Mike
>


__
OpenSSL Project http://www.openssl.org
Development Mailing List   openssl-dev@openssl.org
Automated List Manager   majord...@openssl.org

[openssl.org #953] PKCS7: sign data without keeping it in the memory

[Rich Salz via RT]

Addressed in OpenSSL1.0 (finally) via PKCS7_PARTIAL and PKCS7_STREAM flags.
--
Rich Salz, OpenSSL dev team; rs...@openssl.org

__
OpenSSL Project http://www.openssl.org
Development Mailing List   openssl-dev@openssl.org
Automated List Manager   majord...@openssl.org

The no-stdio and NO_FP_API options

[Salz, Rich]

These configuration options do not build. I started to try and fix them, but 
after fixing the first few problems, things got really sticky.

We hear that OpenSSL on embedded devices is important. Is anyone using this, 
willing to share their fixes, and help maintain it?  If not, it will be removed 
post-1.0.2

Thanks.

--
Principal Security Engineer
Akamai Technologies, Cambridge MA
IM: rs...@jabber.me Twitter: RichSalz

[openssl.org #2548] [Enhancement Request / Linux / openssl 0.9.8k-7ubuntu8.6] openssl s_client and SNI

[Rich Salz via RT]

Explicitly adding the -sni XXX flag doesn't seem to onerous and is 'safer' than
adding a default SNI based on the -connect param. We'd have to add another flag
to disable that behavior, which makes things more complicated. Closing ticket.
--
Rich Salz, OpenSSL dev team; rs...@openssl.org

__
OpenSSL Project http://www.openssl.org
Development Mailing List   openssl-dev@openssl.org
Automated List Manager   majord...@openssl.org

Re: Openssl build errors on zLinux and HP-ita

[Andy Polyakov]

> In the ld man page, I could find help for option +nosectionmerge.
>+nosectionmerge
>   With the -r option, allow procedures to be
>   positioned independently.  The default is to merge
>   all procedures into a single section.
> [This is what I have in my man page]
> 
> If default is merge, do we really need to use option +sectionmerge in
> the LD flags?

Yes. Despite what manual page says, it didn't do the sectionmerge (which
was resulting in crash upon startup). So do patch.

> has the behavior changed in any patch recently?
> What is the impact if i remove it?

Who can possibly answer these questions? Only HP, so talk to them. The
only thing known experimentally is that B.12.56 (see with ld -V) works,
while B.12.49 doesn't.

> I could not find any help for zlinux. Any help is much appreciated.

zLinux is not explicitly validated, it should be possible to resort for
./config no-asm.
__
OpenSSL Project http://www.openssl.org
Development Mailing List   openssl-dev@openssl.org
Automated List Manager   majord...@openssl.org

[openssl.org #2206] [PATCH] Implicitly support non-delegated OCSP response signing

[Rich Salz via RT]

Fixed here, to be merged into post-1.0.2. Thanks:
https://github.com/akamai/openssl/tree/rsalz-monolith/apps

commit 3e3a94bcf03ab5251d95e028dffc14c8a369f2c1
Author: Rob Stradling 
Date: Wed Sep 3 10:42:02 2014 -0400

RT2206: Support issuer in OCSP response signing

The -issuer is trusted to sign OCSP responses.
This is non-delegated, as per RFC 2560.

I also fixed a signed/unsigned cast warning that I
missed when doing the last rebase/merge.

--
Rich Salz, OpenSSL dev team; rs...@openssl.org

__
OpenSSL Project http://www.openssl.org
Development Mailing List   openssl-dev@openssl.org
Automated List Manager   majord...@openssl.org

[openssl.org #3514] BUG: openssl fails to downgrade tls protocol version during SSL handshake, when client tries to resume tls1.2 session

[Sergey Budnevitch via RT]

When client sends ClientHello with TLS 1.2 in ClientHello.client_version,
server may respond with a ServerHello containing an older version number,
if it does not support version, suggested by client. If client agrees,
the negotiation will proceed as appropriate for the negotiated protocol
(according to http://tools.ietf.org/html/rfc5246#appendix-E.1).

But openssl client fails to downgrade tls protocol, if it tries to resume
tls1.2 session, even when server responds with new session id and
switches to the full handshake. Handshake terminated by client with
“protocol_version” alert. Expected behaviour is downgrading to
the version suggested by server and continuing with full handshake.

How to reproduce:

a) create and save tls1.2 session parameters:

openssl s_server -cert ./srv.crt -key ./srv.key -no_ssl2 -no_ssl3 -accept 1
openssl s_client -connect 127.0.0.1:1 -no_ssl2 -no_ssl3 -debug -sess_out 
sess.txt -no_ticket

b) try to resume saved session with server that does not support tls1.2:

openssl s_server -cert ./srv.crt -key ./srv.key -no_ssl2 -no_ssl3 -no_tls1_2 
-no_tls1_1 -accept 1
openssl s_client -connect 127.0.0.1:1 -no_ssl2 -no_ssl3 -debug -sess_in 
sees.txt -no_ticket

Handshake will fail with:
"139874422396744:error:1409442E:SSL routines:SSL3_READ_BYTES:tlsv1 alert 
protocol version:s3_pkt.c:1257:SSL alert number 70"


% openssl version -a
OpenSSL 1.0.1e-fips 11 Feb 2013
built on: Wed Aug 13 19:13:02 UTC 2014
platform: linux-x86_64
options:  bn(64,64) md2(int) rc4(16x,int) des(idx,cisc,16,int) idea(int) 
blowfish(idx) 
compiler: gcc -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT 
-DDSO_DLFCN -DHAVE_DLFCN_H -DKRB5_MIT -m64 -DL_ENDIAN -DTERMIO -Wall -O2 -g 
-pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector 
--param=ssp-buffer-size=4 -m64 -mtune=generic -Wa,--noexecstack -DPURIFY 
-DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 
-DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM 
-DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM
OPENSSLDIR: "/etc/pki/tls"
engines:  dynamic 

__
OpenSSL Project http://www.openssl.org
Development Mailing List   openssl-dev@openssl.org
Automated List Manager   majord...@openssl.org

Re: Openssl build errors on zLinux and HP-ita

[Mrunal Nerpawar]

Thanks Tom,

In the ld man page, I could find help for option +nosectionmerge.
   +nosectionmerge
  With the -r option, allow procedures to be
  positioned independently.  The default is to merge
  all procedures into a single section.
[This is what I have in my man page]

If default is merge, do we really need to use option +sectionmerge in the
LD flags?
has the behavior changed in any patch recently?
What is the impact if i remove it?

I could not find any help for zlinux. Any help is much appreciated.

Regards,
Mrunal



On Tue, Sep 2, 2014 at 7:39 PM, Tom Francis  wrote:

> For HP-UX, be sure to install the latest linker patches.  +sectionmerge
> has been around for a long while, so you’ve probably got a lot of patches
> to install. :)
>
> TOM
>
> On Sep 2, 2014, at 5:45 AM, Mrunal Nerpawar  wrote:
>
> > Hi
> >
> > zLinux:
> > 1) ./config
> > Configured for linux64-s390x.
> > 2) make
> > Error:
> > making fips in crypto...
> > make[1]: Entering directory
> `/builds/openssl/openssl-fips-ecp-2.0.5/crypto'
> > gcc -I. -I.. -I../include  -DOPENSSL_FIPSCANISTER -fPIC -DOPENSSL_PIC
> -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -Wa,--noexecstack
> -m64 -DB_ENDIAN -DTERMIO -O3 -Wall -DOPENSSL_BN_ASM_MONT -DSHA1_ASM
> -DSHA256_ASM -DSHA512_ASM -DAES_ASM -DAES_CTR_ASM -DGHASH_ASM   -c -o
> cryptlib.o cryptlib.c
> > gcc -I. -I.. -I../include  -DOPENSSL_FIPSCANISTER -fPIC -DOPENSSL_PIC
> -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -Wa,--noexecstack
> -m64 -DB_ENDIAN -DTERMIO -O3 -Wall -DOPENSSL_BN_ASM_MONT -DSHA1_ASM
> -DSHA256_ASM -DSHA512_ASM -DAES_ASM -DAES_CTR_ASM -DGHASH_ASM   -c -o
> thr_id.o thr_id.c
> > gcc -I. -I.. -I../include  -DOPENSSL_FIPSCANISTER -fPIC -DOPENSSL_PIC
> -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -Wa,--noexecstack
> -m64 -DB_ENDIAN -DTERMIO -O3 -Wall -DOPENSSL_BN_ASM_MONT -DSHA1_ASM
> -DSHA256_ASM -DSHA512_ASM -DAES_ASM -DAES_CTR_ASM -DGHASH_ASM   -c -o uid.o
> uid.c
> > make[1]: *** No rule to make target `s390xcap.o', needed by `fips'.
> Stop.
> > make[1]: Leaving directory
> `/builds/openssl/openssl-fips-ecp-2.0.5/crypto'
> > make: *** [build_crypto] Error 1
> >
> > [test2@zvmrh37 openssl-fips-ecp-2.0.5]$ uname -na
> > Linux zvmrh37 2.6.9-22.EL #1 SMP Mon Sep 19 17:50:50 EDT 2005 s390x
> s390x s390x GNU/Linux
> >
> > [test2@zvmrh37 openssl-fips-ecp-2.0.5]$ cat /etc/redhat-release
> > Red Hat Enterprise Linux AS release 4 (Nahant Update 2)
> >
> >
> > HP-ITA
> > 1) ./config
> > Configured for hpux64-ia64-cc.
> > 2) make
> > Error:
> > ld: Unrecognized argument: +sectionmerge
> >
> > bash-2.05$ uname -na
> > HP-UX unknown B.11.23 U ia64 3818806770 unlimited-user license
> >
> >
> > I could not find any help regarding this on net.
> > Please let me know if anything is missing in this.
> >
> > Thanks & Regards,
> > Mrunal
> __
> OpenSSL Project http://www.openssl.org
> Development Mailing List   openssl-dev@openssl.org
> Automated List Manager   majord...@openssl.org
>