Re: [openssl-users] OpenSSL Dragino Yun Issues
On 31/08/16 23:16, Nikola Milev wrote: > In other words the function that is failing is doing this: > > socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) It would be interesting to know whether a minimalist program that just does the above successfully creates a socket or not. If it does succeed then this might suggest my analysis is wrong, and the socket call doesn't send the parameters that I think it does. If that's the case then it would be interesting to try and figure out what it actually sends. If it fails then you have a non-OpenSSL issue to try and figure out. Matt -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
[openssl-users] OpenSSL Dragino Yun Issues
To whom it may concern,
I have been experiencing issues with OpenSSL and DraginoYun. If you are not
the person I should have contacted, please redirect me. Thank you!
Recently, I have tried using OpenSSL to establish a simple server
application on Dragino Yun version 2.4. First, I tested the code on my Acer
Aspire 5750ZG running Ubuntu 14.04 and it worked fine. Afterwards, I used
OpenWrt SDK to cross-compile the application. However, the application is
unable to bind the socket; the BIO_do_accept function fails. Here is the
error stack the code provided:
"2006783048:error:0200407C:lib(2):func(4):reason(124):NA:0:port='5354'
2006783048:error:20069076:lib(32):func(105):reason(118):NA:0:"
errstr returned these as answers:
"$ openssl errstr 0200407C
error:0200407C:system library:socket:Wrong medium type
$ openssl errstr 20069076
error:20069076:BIO routines:BIO_get_accept_socket:unable to create socket
"
I suppose that the second one is a product of the first one.
I have checked iptables and I have checked ports that are currently in use,
all seems to be in order.
However, the OpenSSL s_server (in combination with s_client on the other
side) works fine.
May this be an OpenSSL bug? If not, do you have any suggestions?
OpenSSL version on Acer is 1.0.1f 6 Jan 2014 and on Dragino 1.0.1h 5 Jun
2014.
In the attachment, I am providing the code(though I am not sure if it is
available on the list), mostly taken from O'Reilly "Network Security with
OpenSSL".
All the passkeys are "raspberry". (these certificates and keys were
generated for testing purposes)
Of course, should you need any additional information, I'd be happy to
provide it.
I originally addressed Matt Caswell regarding the issue and I am pasting
his response to my question and my response to that.
His response:
"Hello,
I'm not really the best person to ask about such low level stuff. The
best place to raise these questions is on the openssl-users email list.
It also means any questions/answers are publicly archived and available
for other users. Details are here:
https://mta.openssl.org
However, I did have a quick look and discovered the following. The code
that raises this error looks like this:
s = socket(server.sa.sa_family, SOCK_STREAM, SOCKET_PROTOCOL);
if (s == INVALID_SOCKET) {
SYSerr(SYS_F_SOCKET, get_last_socket_error());
ERR_add_error_data(3, "port='", host, "'");
BIOerr(BIO_F_BIO_GET_ACCEPT_SOCKET, BIO_R_UNABLE_TO_CREATE_SOCKET);
goto err;
}
So this is a call to the non-OpenSSL networking function "socket". In
this context "server.sa.sa_family" has been set to AF_INET a few lines
above, and "SOCKET_PROTOCOL" is a macro defined at the beginning of the
file as follows:
# define SOCKET_PROTOCOL IPPROTO_TCP
In other words the function that is failing is doing this:
socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)
This seems like a fairly fundamental failure, and might suggest that the
platform in question has no TCP/IP support available for some reason?"
My response to his:
"
Hi Matt,
The platform supports TCP/IP, if I deduced correctly. I have programmed an
application similar to the example in Unix Network Programming (a basic
TCP/IP echo server) and it works without any issues. Also, openssl s_server
works correctly; I tried using it with openssl s_client on the other
machine.
I will forward my question to the email list, including both of our
responses.
I am grateful for your quick response.
Best regards,
Nikola Milev
"
My original mail to him is almost the same as the first part of this mail.
I am thankful for you support!
Best regards,
Nikola Milev
src.tar.gz
Description: GNU Zip compressed data
--
openssl-users mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
[openssl-users] fips_premain.c bitcode for iOS
We ran into an issue where we were selecting 'Include bitcode' when submitting to apple and when doing ad-hoc builds. It seems doing this with the fips_premain.c file included in the xcode compile sources phase causes an instant crash on start up. What is the proper way to get past this bitcode issue? If we select to NOT 'Include bitcode' the app doesn't crash. I have narrowed this down to the fips_premain.c file by Including bitcode but removing fips from the project and it working. -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
[openssl-users] Working with s_time and nginx
Dear all, I have turned to /s_time/ to evaluate the performance of a local Nginx server setup, but seems to immediately run into problems that do not appear when using /s_client/. Server setup is largely based on recommendations from bettercrypto.org, which also demonstrate the same problems with their setup as I currently do: "openssl s_time -connect bettercrypto.org:443 -cipher AES128-GCM-SHA256 -time 2" returns * "140373676381952:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:ssl/record/rec_layer_s3.c:1362:SSL alert number 40" in OpenSSL 1.1.0 * "140416684930936:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure:s23_clnt.c:769:" in version 1.0.2h. This problem has been found when running from Fedora 24, and also with other ciphers than just the one mentioned above, as ECDHE-ECDSA-AES256-GCM-SHA384, ECDHE-ECDSA-AES128-SHA, AES256-SHA, but not with AES128-SHA. (Looking at the error message, there seems to be ssl3 involved. Though I believe that only TLS connections are allowed on the servers mentioned.) I am greatful for insight that would make it possible to use /s_time/ properly. best regards, Kjetil Birkeland Moe -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
Re: [openssl-users] RSA sign using SHA256 with mgf1 padding
Hi, I have written a sample few years ago that performs PSS signature using SHA256 like what you need. You can get it from https://www.idrix.fr/Root/Samples/openssl_pss_signature.c It uses the maximum salt length. You should check that the server expects this as well. Cheers, -- Mounir IDRASSI Le 29/08/2016 à 10:59, Moshe Wiener (mowiener) a écrit : > > Hello, > > I’m running an application which runs an authentication session with a > server. The server provides some random data, and my application needs > to sign it with its private key, and send back the signature. The > server which knows the public key verifies the signature, and it good > then the client which runs my application is authenticated. > > This session used to run OK, until the server was changed so instead > of using PKCS#1_v1.5 now it uses PKCS#1_v2.1 > > Now, the server uses signature algorithm of SHA256 WITH RSA AN DMGF1. > > In my application I use OpenSSL. > > I think that I need to use ‘RSA_padding_add_PKCS1_OAEP_mgf1’ but > couldn’t figure out what to put in each of its arguments. > > Is there somewhere a sample code which implements RSA signature with > mgf1 padding and a SHA256 hash? > > Many thanks, > > Moshe > > > > > > > -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
Re: [openssl-users] Sequential / parallel OpenSSL sessions with Async
On 31/08/16 13:17, Nicolas Brunie wrote: > Hi All,I have been playing around with OpenSSL ASYNC JOB and an > asynchronous offloading engine and a stupid question came to mind: > It is not possible to make several parallel/pending calls to SSL_read > (or SSL_write) on a single SSL* object (with different output/input > buffers) so that multiple offloading operation can be done in parallel > (on a single SSL object). > I am quite new to TLS but it may seem that you can not enqueue > multiple calls to the same SSL_ until the first one called has > returned (in the sens completely finished and not just return an > SSL_ERROR_WANT_ASYNC), it that so ? You can use the new 1.1.0 "pipelining" feature to achieve something like what you want - although it works slightly differently to the approach you describe. >From CHANGES: Added support for "pipelining". Ciphers that have the EVP_CIPH_FLAG_PIPELINE flag set have a capability to process multiple encryptions/decryptions simultaneously. There are currently no built-in ciphers with this property but the expectation is that engines will be able to offer it to significantly improve throughput. Support has been extended into libssl so that multiple records for a single connection can be processed in one go (for >=TLS 1.1). See the dasync engine for an example implementation of this. At the SSL layer see this page for a description of how pipelining works: https://www.openssl.org/docs/man1.1.0/ssl/SSL_CTX_set_split_send_fragment.html Essentially when you call SSL_write() you should send through a large chunk of data in one go. You also configure OpenSSL to split this up into multiple records (as described in the above man page). The encryption for all records can then occur in a single call through to the pipeline capable engine which can then process them in parallel. It works in a similar way for SSL_read(), although it does depend on having received multiple records in one go in order to benefit from any possible parallelisation. Pipelining and async are two different features which can be used independently. However you can also combine them, so that a pipeline capable engine could choose to work on multiple parallel encryptions/decryptions simultaneously and return control to the application in the meantime until the processing has been completed. Matt -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
[openssl-users] Sequential / parallel OpenSSL sessions with Async
Hi All,I have been playing around with OpenSSL ASYNC JOB and an
asynchronous offloading engine and a stupid question came to mind:
It is not possible to make several parallel/pending calls to SSL_read
(or SSL_write) on a single SSL* object (with different output/input
buffers) so that multiple offloading operation can be done in parallel
(on a single SSL object).
I am quite new to TLS but it may seem that you can not enqueue
multiple calls to the same SSL_ until the first one called has
returned (in the sens completely finished and not just return an
SSL_ERROR_WANT_ASYNC), it that so ?
best regards,
Nicolas Brunie
P.S:
SSL* obj = ... /* accept and init */ int err = SSL_read(obj, buf0,
READ_SIZE);
if (err < 0 && SSL_get_error(obj, err) == SSL_ERROR_WANT_ASYNC) {...}/*
pending buf0 crypto but go on */
/* the following is illegal if I have not called back SSL_read(obj,
buf0, READ_SIZE) and it
* has returned with completion (no want async error), right ? */
SSL_read(obj, buf1, READ_SIZE);
--
openssl-users mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
