[openssl.org #291] race condition in *get_cipher_by_char

2002-09-25 Thread
s2_lib.c:ssl2_get_cipher_by_char s3_lib.c:ssl3_get_cipher_by_char has this code: if (init) { CRYPTO_w_lock(CRYPTO_LOCK_SSL); ...[qsort and stuff]... CRYPTO_w_unlock(CRYPTO_LOCK_SSL); init=0; } There needs to be a if (init) after the lock is acquired

Re: [openssl.org #262] bug: init race in SSLv3_client_method

2002-09-25 Thread Patrick McCormick
I wrote that the next snapshots should solve the problem. Functions SSLv23_client_method(), SSLv23_server_method(), SSLv2_client_method(),SSLv2_server_method(), SSLv3_client_method(),SSLv3_server_method(), TLSv1_client_method(),

[PATCH] Adding Certicom licensing info

2002-09-25 Thread John O Goyo
Greetings: Certicom has intellectual property rights relating to safe primes in DH and point compression in elliptic-curve cryptography. I ask that the following patches be implemented to inform people of these facts. Sincerely, john -- john o goyo

Re: [openssl.org #262] bug: init race in SSLv3_client_method

2002-09-25 Thread Rich Salz
Yes, the if (test) lock() if (test) construct is very important (although I thought I saw a bug about JVM implementations getting this wrong). Anyone doing threads programming should read Andrew Birrell's 1989 tutorial.

Re: [openssl.org #262] bug: init race in SSLv3_client_method

2002-09-25 Thread Bodo Moeller
On Tue, Sep 24, 2002 at 03:47:14PM -0700, Patrick McCormick wrote: Many thanks for putting in a lock. However, the race condition has not been eliminated. [...]init must be checked after the lock is entered in order to prevent the client_data setup from happening twice. So,

Re: [openssl.org #262] bug: init race in SSLv3_client_method

2002-09-25 Thread Bodo Moeller via RT
On Tue, Sep 24, 2002 at 03:47:14PM -0700, Patrick McCormick wrote: Many thanks for putting in a lock. However, the race condition has not been eliminated. [...]init must be checked after the lock is entered in order to prevent the client_data setup from happening twice. So,

Disabling the crypt() macro.

2002-09-25 Thread Richard Levitte - VMS Whacker
I get reports again that the crypt() macro gets in the way for some applications. I'm strongly thinking of disabling it entirely. Anyone against? If I don't hear any complaints about the thought before the weekend, I'll carry on with it, in 0.9.7 and 0.9.7-dev. -- Richard Levitte \

[openssl.org #291] race condition in *get_cipher_by_char

2002-09-25 Thread Bodo Moeller via RT
__ OpenSSL Project http://www.openssl.org Development Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]

Re: Disabling the crypt() macro.

2002-09-25 Thread Sam Leffler
0.9.7 caused massive havoc compiling kerberos 4 (and to some extent 5) when I integrated beta 3 into the freebsd tree. The crypt() macro was a minor annoyance. The bigger problem was the redefinition of the DES key state block (from array to struct). openbsd apparently has workarounds that

Re: [openssl.org #291] race condition in *get_cipher_by_char

2002-09-25 Thread Bodo Moeller
On Wed, Sep 25, 2002 at 05:31:08PM +0200, Bodo Moeller via RT wrote: As usual, I really wrote that the bug will be fixed in the next snapshot (but RT2 still does not believe me :-). -- Bodo Möller [EMAIL PROTECTED] PGP

Re: [PATCH] Adding Certicom licensing info

2002-09-25 Thread Bodo Moeller
On Wed, Sep 25, 2002 at 08:49:47AM -0400, John O Goyo wrote: Certicom has intellectual property rights relating to safe primes in DH [...] + Certicom has intellectual property rights relating to the use of safe primes + in the DH key-exchange, including US patent 5,933,504 and pending US +

Re: [PATCH] Adding Certicom licensing info

2002-09-25 Thread Ben Laurie
John O Goyo wrote: Greetings: Certicom has intellectual property rights relating to safe primes in DH and point compression in elliptic-curve cryptography. Really? Has that been tested? I ask that the following patches be implemented to inform people of these facts. Why would we want to

Re: [openssl.org #262] bug: init race in SSLv3_client_method

2002-09-25 Thread
You are absolutely right, of course. I got similar constructs right in the past, but I guess this time I was too busy with various other things to really think about what I was writing ... The next snapshot should really fix the problem. I looked at the changes in CVS and everything seems

ssltest.c

2002-09-25 Thread Chris Brook
In 0.9.7-stable ssltest.c, lines 408 416 need terminating brackets. Chris Brook __ OpenSSL Project http://www.openssl.org Development Mailing List [EMAIL PROTECTED]

Re: ssltest.c

2002-09-25 Thread Lutz Jaenicke
On Wed, Sep 25, 2002 at 03:43:09PM -0400, Chris Brook wrote: In 0.9.7-stable ssltest.c, lines 408 416 need terminating brackets. Chris Brook Thanks, fixed, Lutz -- Lutz Jaenicke [EMAIL PROTECTED] http://www.aet.TU-Cottbus.DE/personen/jaenicke/ BTU Cottbus,

[openssl.org #290] OpenSSL make problems

2002-09-25 Thread Lutz Jaenicke via RT
[[EMAIL PROTECTED] - Tue Sep 24 10:23:50 2002]: Hi, I am trying to install openssl on AIX using gcc GCC version - 2.95.3 20010315 (release) AIX version - 4.3.2.0 OpenSSL version - 0.9.7-dev The output of config -t is attached. The make is not sucessful. The following is the error

Re: [openssl.org #262] bug: init race in SSLv3_client_method

2002-09-25 Thread Lutz Jaenicke
On Mon, Sep 23, 2002 at 06:43:21PM +0200, Bodo Moeller wrote: On Mon, Sep 23, 2002 at 04:26:00PM +0200, Bodo Moeller via RT wrote: Somehow the RT2 system doesn't like the comments I enter at the website when resolving a ticket ... I am not yet sure (would need to do a test), but it

Re: [openssl.org #262] bug: init race in SSLv3_client_method

2002-09-25 Thread Patrick McCormick
You are absolutely right, of course. I got similar constructs right in the past, but I guess this time I was too busy with various other things to really think about what I was writing ... The next snapshot should really fix the problem. I looked at the changes in CVS and everything seems