Re: [CVS] OpenSSL: openssl/crypto/aes/asm/ aes-586.pl aesni-x86.pl openssl...

Hi,

> this patch solve the problem of Program terminated with signal 4,
> Illegal instruction on cpu amd geode-lx and VIA Nehemiah?

Is it question or statement?

> root <at> gatto:/tmp# openssl version
> Illegal instruction (core dumped)

Is it crash before of after?

> root <at> gatto:/tmp# gdb -c core /usr/bin/openssl
> GNU gdb (GDB) 7.4
> Program terminated with signal 4, Illegal instruction.
> #0  0xb76bc1f3 in _init () from /usr/lib/libcrypto.so.0
> (gdb) disassemble
> Dump of assembler code for function _init:
>    0xb76bc1d0 <+0>:     push   %ebx
>    0xb76bc1d1 <+1>:     sub    $0x8,%esp
>    0xb76bc1d4 <+4>:     call   0xb76bc840
>    0xb76bc1d9 <+9>:     add    $0x12c697,%ebx
>    0xb76bc1df <+15>:    mov    -0x220(%ebx),%eax
>    0xb76bc1e5 <+21>:    test   %eax,%eax
>    0xb76bc1e7 <+23>:    je     0xb76bc1ee <_init+30>
>    0xb76bc1e9 <+25>:    call   0xb76bc4d0 <__gmon_start__ <at> plt>
>    0xb76bc1ee <+30>:    call   0xb76bc970
> => 0xb76bc1f3 <+35>:    nopw   %cs:0x0(%eax,%eax,1)

Obviously CPUs in question can't handle this kind of nop. Formally it's

Which headers do we use ? openssl-fips or openssl-1.0.1b ?

Re: Which headers do we use ? openssl-fips or openssl-1.0.1b ?

On Tue, May 01, 2012, Simon Convey wrote:

> Dear openssl developers,
>         I suspect that this may have been asked before, but I have looked,
> and can't find an answer to this ......
> 
> We are downloading openssl-fips-2.0-test-201204XX and configuring ...
> 
> #./config  && make && make install
> 
> and then
> 
> # cd ../openssl-1.0.1b
> #./config fips shared
> #make && make install
> 
> 
> My question is, which set of headers do I include in application
> development ?
> /usr/local/ssl/fips-2.0/include/openssl, or
> /usr/include/ssl/include/openssl ?
> 

Those in /usr/include/ssl/include/openssl as they belong to OpenSSL 1.0.1.

Steve.
--
Dr Stephen N. Henson. OpenSSL project core developer.
Commercial tech support now available see: http://www.openssl.org
______________________________________________________________________
OpenSSL Project                                 http://www.openssl.org
Development Mailing List                       openssl-dev <at> openssl.org
Automated List Manager                           majordomo <at> openssl.org

Minor Bug in 1.0.1b

RSA key size for FIPS 140-2

OCSP question

Hi! In our project we want to perform a complete global switch to OCSP
certificate verification (for a number of reasons we don't want CRL's
anymore) to make openldap, openvpn and others use OCSP.

Unfortunately I didn't find any implemented way to perform such a switch
in OpenSSL. There is only one check_revocation() function, which checks
a chain against CRL's. I think that check_revocation() can be altered to
use OCSP instead just like ocsp-app does. Or shall I use any other place
to perform OCSP verification?

Thanks!
--

-- 
Best wishes,
Alexander Komyagin

______________________________________________________________________
OpenSSL Project                                 http://www.openssl.org
Development Mailing List                       openssl-dev <at> openssl.org
Automated List Manager                           majordomo <at> openssl.org

Re:OCSP question

Re: Re:OCSP question

Thank you, Ziyu! However, these three are no use without actual query
building and querying OCSP responder.

On Thu, 2012-05-03 at 16:06 +0800, Ziyu Liu wrote:
> You can use these functions to do the OCSP verification during the ssl
> handshaking.
> 
> #define SSL_set_tlsext_status_ids(ssl, arg) \
> SSL_ctrl(ssl,SSL_CTRL_SET_TLSEXT_STATUS_REQ_IDS,0, (void *)arg)
> 
> #define SSL_get_tlsext_status_ocsp_resp(ssl, arg) \
> SSL_ctrl(ssl,SSL_CTRL_GET_TLSEXT_STATUS_REQ_OCSP_RESP,0, (void *)arg)
> 
> #define SSL_set_tlsext_status_ocsp_resp(ssl, arg, arglen) \
> SSL_ctrl(ssl,SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP,arglen, (void
> *)arg)
> 
> 
> 
> 
> 
> At 2012-05-03 15:23:49,"Alexander Komyagin" <komyagin <at> altell.ru> wrote:
> >Hi! In our project we want to perform a complete global switch to OCSP
> >certificate verification (for a number of reasons we don't want CRL's
> >anymore) to make openldap, openvpn and others use OCSP.
> >
> >Unfortunately I didn't find any implemented way to perform such a switch
> >in OpenSSL. There is only one check_revocation() function, which checks
> >a chain against CRL's. I think that check_revocation() can be altered to
> >use OCSP instead just like ocsp-app does. Or shall I use any other place
> >to perform OCSP verification?
> >
> >Thanks!
> >-- 
> >Best wishes,
> >Alexander Komyagin
> >
> >
> >______________________________________________________________________
> >OpenSSL Project                                 http://www.openssl.org
> >Development Mailing List                       openssl-dev <at> openssl.org
> >Automated List Manager                           majordomo <at> openssl.org
> 
> 

--

-- 
Best wishes,
Alexander Komyagin

______________________________________________________________________
OpenSSL Project                                 http://www.openssl.org
Development Mailing List                       openssl-dev <at> openssl.org
Automated List Manager                           majordomo <at> openssl.org

Re: OCSP question

On Thu, May 03, 2012, Alexander Komyagin wrote:

> Hi! In our project we want to perform a complete global switch to OCSP
> certificate verification (for a number of reasons we don't want CRL's
> anymore) to make openldap, openvpn and others use OCSP.
> 

You should note there is a side effect of doing this: it can't work properly
with non-blocking I/O without application modification.

The reason is that non-blocking I/O checks a single socket associated with the
SSL/TLS connection while if you want to handle OCSP properly it would need to
check a second completely different socket used by the OCSP connection. No
existing application does that and no framework currently exists in OpenSSL to 
support this.

As a result an unmodified application would block waiting for the OCSP
response and if it would be unable to handle any other connections during this
time.

Steve.
--
Dr Stephen N. Henson. OpenSSL project core developer.
Commercial tech support now available see: http://www.openssl.org
______________________________________________________________________
OpenSSL Project                                 http://www.openssl.org
Development Mailing List                       openssl-dev <at> openssl.org
Automated List Manager                           majordomo <at> openssl.org

Re: OCSP question

Thanks for the note, Stephen! I'll certainly take this into account.
If I incorporate OCSP check in check_revoked() function, which is called
during SSL connect/handshake it would just block during connect op for a
while, and I believe that no single service shall expect connection
establishment to be fast. Good service will handle other connections in
a separate thread for the sake of availability, won't it?

On Thu, 2012-05-03 at 13:11 +0200, Dr. Stephen Henson wrote:
> On Thu, May 03, 2012, Alexander Komyagin wrote:
> 
> > Hi! In our project we want to perform a complete global switch to OCSP
> > certificate verification (for a number of reasons we don't want CRL's
> > anymore) to make openldap, openvpn and others use OCSP.
> > 
> 
> You should note there is a side effect of doing this: it can't work properly
> with non-blocking I/O without application modification.
> 
> The reason is that non-blocking I/O checks a single socket associated with the
> SSL/TLS connection while if you want to handle OCSP properly it would need to
> check a second completely different socket used by the OCSP connection. No
> existing application does that and no framework currently exists in OpenSSL to 
> support this.
> 
> As a result an unmodified application would block waiting for the OCSP
> response and if it would be unable to handle any other connections during this
> time.
> 
> Steve.
> --
> Dr Stephen N. Henson. OpenSSL project core developer.
> Commercial tech support now available see: http://www.openssl.org
> ______________________________________________________________________
> OpenSSL Project                                 http://www.openssl.org
> Development Mailing List                       openssl-dev <at> openssl.org
> Automated List Manager                           majordomo <at> openssl.org

--

-- 
Best wishes,
Alexander Komyagin

______________________________________________________________________
OpenSSL Project                                 http://www.openssl.org
Development Mailing List                       openssl-dev <at> openssl.org
Automated List Manager                           majordomo <at> openssl.org