Re: [openssl-dev] cert_cb and TLS tickets

2016-12-10 Thread Fedor Indutny
This totally makes sense. Unfortunately, adding a new API method for this means that I'll have to re-introduce ClientHello parser in bud, and make a wider use of it in Node.js again. On Sat, Dec 10, 2016 at 3:07 AM, Salz, Rich wrote: > > Oh, just to restate it. I'm willing to submit the patch if

Re: [openssl-dev] cert_cb and TLS tickets

2016-12-10 Thread Fedor Indutny
Thank you for feedback, though! On Sat, Dec 10, 2016 at 11:13 AM, Fedor Indutny wrote: > This totally makes sense. Unfortunately, adding a new API method for this > means that I'll have to re-introduce ClientHello parser in bud, and make a > wider use of it in Node.js again. > > On Sat, Dec 10,

Re: [openssl-dev] cert_cb and TLS tickets

2016-12-10 Thread Alessandro Ghedini
On Sat, Dec 10, 2016 at 11:13:48AM +0100, Fedor Indutny wrote: > This totally makes sense. Unfortunately, adding a new API method for this > means that I'll have to re-introduce ClientHello parser in bud, and make a > wider use of it in Node.js again. FWIW, BoringSSL offers an early callback that

Re: [openssl-dev] cert_cb and TLS tickets

2016-12-10 Thread Salz, Rich
> Thank you for feedback, though! Thanks for your expertise and continued interest in pushing OpenSSL into new(er) areas! -- openssl-dev mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev

Re: [openssl-dev] cert_cb and TLS tickets

2016-12-10 Thread Fedor Indutny
Alessandro, Indeed I just checked BoringSSL's source and it calls cert_cb before resuming the session. Inviting David Benjamin into this conversation. David, Do you have any insights or motivation to share with us? The way BoringSSL handles session resumption + cert_cb is a correct one in my opi

Re: [openssl-dev] cert_cb and TLS tickets

2016-12-10 Thread David Benjamin via openssl-dev
(Resending from an address which is actually subscribed. Apologies if this causes anyone to receive this twice.) Here's the patch series which flipped it: https://boringssl.googlesource.com/boringssl/+/4eb95ccfd64d46fad23f36238690594d02518467 https://boringssl.googlesource.com/boringssl/+/34202b93