Re: 1.1.1b crash (RUN_ONCE problem?)

2019-03-04 Thread Viktor Dukhovni
> On Mar 4, 2019, at 11:29 PM, Norm Green wrote: > > Yes I'm sure the build process is correct. > Turns out this problem was cause by one thread calling exit() while another > thread was doing SSL_write(). The SSL exit handler triggered by exit() was > causing the lock in question to be freed

Heads up, Inbuilt KORN Arithmetic & Test functions broken under Windows Subsystem for Linux

2019-03-04 Thread open...@foocrypt.net
Hi Not sure if any of the build / test process of OpenSSL utilise inbuilt KORN Arithmetic & Test functions. https://community.ubuntu.com/t/inbuilt-korn-arithmetic-test-functions-broken-under-windows-subsystem-for-linux/10089

Re: 1.1.1b crash (RUN_ONCE problem?)

2019-03-04 Thread Norm Green
Yes I'm sure the build process is correct. Turns out this problem was cause by one thread calling exit() while another thread was doing SSL_write().  The SSL exit handler triggered by exit() was causing the lock in question to be freed AFAIKT. So it would seem that threads either need to exit

version mismatch macro help

2019-03-04 Thread Michael Richardson
Last year I tried to provide a macro that would do version checks. (In fact, I got it wrong in a stupid way) Today I installed a pre 1.1.1c build in a VM for testing purposes. What does /usr/sbin/sshd says: # /usr/sbin/sshd OpenSSL version mismatch. Built against 1010101f, you have 10101030

Shouldn't no-pinshared be the default?

2019-03-04 Thread Yann Ylavic
Hi, after quite some time trying to convert Apache httpd (and libapr) to new the OPENSSL_init/cleanup() 1.1 API, and wondering why openssl libs would not unload with mod_ssl as before (1.0 and earlier), I found the ELF NODELETE flag (gcc's -znodelete) and the new (no-)pinshared config option

Re: AW: OpenVPNGui 2.4.7 fails: format error in certificate's notAfter field

2019-03-04 Thread Hubert Kario
On Monday, 4 March 2019 15:20:36 CET Jan Just Keijser wrote: > Hi Matt, > > On 04/03/19 14:24, Matt Caswell wrote: > > On 04/03/2019 13:16, Jan Just Keijser wrote: > >> On 04/03/19 10:21, Wolfgang Knauf wrote: > >>> Hi, > >>> > >>> the output is this: > >>> > >>> C:\Program

Re: AW: OpenVPNGui 2.4.7 fails: format error in certificate's notAfter field

2019-03-04 Thread Jan Just Keijser
Hi Matt, On 04/03/19 14:24, Matt Caswell wrote: On 04/03/2019 13:16, Jan Just Keijser wrote: On 04/03/19 10:21, Wolfgang Knauf wrote: Hi, the output is this: C:\Program Files\OpenVPN\bin>openssl.exe asn1parse -i -in

Re: 1.1.1: patches to compile on OpenBSD

2019-03-04 Thread Salz, Rich via openssl-users
Can we take OpenBSD code and put it under the Apache license?

AW: AW: OpenVPNGui 2.4.7 fails: format error in certificate's notAfter field

2019-03-04 Thread Wolfgang Knauf
Might the reason for this error be some server certificate that I don't have locally but that is downloaded/checked during the OpenVPNGui connection? Sorry is this is a dumb questions, but I am just a user of OpenVPNGui and don't have knowledge about the internals... Wolfgang

Re: AW: OpenVPNGui 2.4.7 fails: format error in certificate's notAfter field

2019-03-04 Thread Matt Caswell
On 04/03/2019 13:16, Jan Just Keijser wrote: > On 04/03/19 10:21, Wolfgang Knauf wrote: >> Hi, >> >> the output is this: >> >> C:\Program Files\OpenVPN\bin>openssl.exe asn1parse -i -in >> ..\config\ssl_h...@l1139218.vt-security.de\l1139218.vt-security.de.user.crt >> Error: offset too large >>

Re: OpenSSL 3.0 (or 4.0) API goals

2019-03-04 Thread Matt Caswell
On 04/03/2019 12:57, Hubert Kario wrote: > On Monday, 4 March 2019 12:59:26 CET Matt Caswell wrote: >> On 01/03/2019 22:26, Paul Smith wrote: >>> Hi all. >>> >>> I'm reading with interest the details coming out with respect to the >>> next release of OpenSSL. >>> >>> I'm curious if there's any

Re: AW: OpenVPNGui 2.4.7 fails: format error in certificate's notAfter field

2019-03-04 Thread Jan Just Keijser
On 04/03/19 10:21, Wolfgang Knauf wrote: Hi, the output is this: C:\Program Files\OpenVPN\bin>openssl.exe asn1parse -i -in ..\config\ssl_h...@l1139218.vt-security.de\l1139218.vt-security.de.user.crt Error: offset too large Would it be OK if I send the crt file to only your mail adress? I

Re: OpenSSL 3.0 (or 4.0) API goals

2019-03-04 Thread Hubert Kario
On Monday, 4 March 2019 12:59:26 CET Matt Caswell wrote: > On 01/03/2019 22:26, Paul Smith wrote: > > Hi all. > > > > I'm reading with interest the details coming out with respect to the > > next release of OpenSSL. > > > > I'm curious if there's any consideration being given to updating the > >

Re: OpenSSL 3.0 (or 4.0) API goals

2019-03-04 Thread Richard Levitte
Matt Caswell skrev: (4 mars 2019 12:59:26 CET) > > >On 01/03/2019 22:26, Paul Smith wrote: >> Hi all. >> >> I'm reading with interest the details coming out with respect to the >> next release of OpenSSL. >> >> I'm curious if there's any consideration being given to updating the >> API for

Re: OpenSSL 3.0 (or 4.0) API goals

2019-03-04 Thread Matt Caswell
On 01/03/2019 22:26, Paul Smith wrote: > Hi all. > > I'm reading with interest the details coming out with respect to the > next release of OpenSSL. > > I'm curious if there's any consideration being given to updating the > API for existing interfaces, and/or checking the APIs of any new >

Re: 1.1.1: patches to compile on OpenBSD

2019-03-04 Thread Claus Assmann
On Mon, Mar 04, 2019, Richard Levitte wrote: > So if I'm reading the patches correctly, > patch-Configurations_unix-Makefile_tmpl is all about that "e" stuff, Nope, seems you missed one change in all the text you quoted: - $generator = 'm4 -B 8192'.$generator_incs.' '.$generator.'

AW: OpenVPNGui 2.4.7 fails: format error in certificate's notAfter field

2019-03-04 Thread Wolfgang Knauf
Here is the output: C:\Program Files\OpenVPN\bin>openssl.exe verify -trusted ..\config\ssl_h...@l1139218.vt-security.de\l1139218.vt-security.de.ca.crt ..\config\ssl_h...@l1139218.vt-security.de\l1139218.vt-security.de.user.crt

Re: OpenVPNGui 2.4.7 fails: format error in certificate's notAfter field

2019-03-04 Thread Jan Just Keijser
Hi Richard, On 04/03/19 10:27, Richard Levitte wrote: On Mon, 04 Mar 2019 10:06:54 +0100, Jan Just Keijser wrote: ... Having said that, I just created a certificate set to expire on Mar 9 2037 and it passed the following command:   c:\program files\openvpn\bin\openssl x509 -dates -subject

Re: OpenVPNGui 2.4.7 fails: format error in certificate's notAfter field

2019-03-04 Thread Richard Levitte
On Mon, 04 Mar 2019 10:06:54 +0100, Jan Just Keijser wrote: ... > Having said that, I just created a certificate set to expire on Mar 9 2037 > and it passed the > following command: >   c:\program files\openvpn\bin\openssl x509 -dates -subject -noout -in > mycert.crt > > can you run the same

AW: OpenVPNGui 2.4.7 fails: format error in certificate's notAfter field

2019-03-04 Thread Wolfgang Knauf
Hi, this is the output of "-dates": C:\Program Files\OpenVPN\bin>openssl.exe x509 -dates -subject -noout -in ..\config\ssl_h...@l1139218.vt-security.de\l1139218.vt-security.de.ca.crt notBefore=Oct 22 13:28:29 2009 GMT notAfter=Mar 8 13:28:29 2037 GMT subject=C = de, L = Dortmund, O = Versatel,

AW: OpenVPNGui 2.4.7 fails: format error in certificate's notAfter field

2019-03-04 Thread Wolfgang Knauf
Hi, the output is this: C:\Program Files\OpenVPN\bin>openssl.exe asn1parse -i -in ..\config\ssl_h...@l1139218.vt-security.de\l1139218.vt-security.de.user.crt Error: offset too large Would it be OK if I send the crt file to only your mail adress? I don't feel save by posting it to the mailing

Re: OpenVPNGui 2.4.7 fails: format error in certificate's notAfter field

2019-03-04 Thread Jan Just Keijser
Hi, On 04/03/19 09:08, Wolfgang Knauf wrote: Hi, I first asked this question in the OpenVPNGui forum, and they redirected me to here: OpenVPNGui 2.4.6 works with a customers server certificate, but it fails when using 2.4.7. Here is the thread in the OpenVPNGui forum:

Re: OpenVPNGui 2.4.7 fails: format error in certificate's notAfter field

2019-03-04 Thread Richard Levitte
The format error refers to how the numbers are encoded in the certificate. The best way to see for ourselves is if you can run 'openssl asn1parse' on the certificate and show us the sequence that contains the notBefore and notAfter time-stamps. The are seen together between the issuer name and

Re: bn_sqr8x_internal function consumes a lot of CPU time

2019-03-04 Thread Patrick Steuer
Its an x86_64 assembly subroutine of bn_mul_mont which implements montgomery modular multiplication. Its heavily used in rsa comutations. Just set a breakpoint in the debugger and have a look at the callstack.

bn_sqr8x_internal function consumes a lot of CPU time

2019-03-04 Thread Thang Pham
Dear all, I do not know if it is legitimate to ask this question here, but maybe you guys can help. We have a service running behind nginx that using HTTPS. Recently the CPU utilization has raised to 100%, and using perf we see that nginx's using ~69% of CPU time. Inside nginx,

OpenVPNGui 2.4.7 fails: format error in certificate's notAfter field

2019-03-04 Thread Wolfgang Knauf
Hi, I first asked this question in the OpenVPNGui forum, and they redirected me to here: OpenVPNGui 2.4.6 works with a customers server certificate, but it fails when using 2.4.7. Here is the thread in the OpenVPNGui forum: https://forums.openvpn.net/viewtopic.php?f=24=27976 The error is: