Re: SSL_peek vs. SSL_pending...

2007-08-24 Thread Thomas J. Hruska
David Schwartz wrote: David Schwartz wrote: Which part of "For other sockets, readability means that queued data is available for reading such that a call to recv, WSARecv, WSARecvFrom, or recvfrom is _guaranteed not to block_." do you not understand? It means a hypothetical concurrent call

Re: SSL_peek vs. SSL_pending...

2007-08-24 Thread David Schwartz
> David Schwartz wrote: > >> Which part of "For other sockets, readability means that queued data > >> is > >> available for reading such that a call to recv, WSARecv, > >> WSARecvFrom, or > >> recvfrom is _guaranteed not to block_." do you not understand? > > It means a hypothetical concurrent

Re: SSL_peek vs. SSL_pending...

2007-08-24 Thread Thomas J. Hruska
David Schwartz wrote: Which part of "For other sockets, readability means that queued data is available for reading such that a call to recv, WSARecv, WSARecvFrom, or recvfrom is _guaranteed not to block_." do you not understand? It means a hypothetical concurrent call, not a future actual call

RE: SSL_peek vs. SSL_pending...

2007-08-24 Thread David Schwartz
> Which part of "For other sockets, readability means that queued data is > available for reading such that a call to recv, WSARecv, WSARecvFrom, or > recvfrom is _guaranteed not to block_." do you not understand? It means a hypothetical concurrent call, not a future actual call. There is simply

Re: SSL_peek vs. SSL_pending...

2007-08-24 Thread Thomas J. Hruska
David Schwartz wrote: MSDN Library documents select() as being exactly as I describe: http://msdn2.microsoft.com/en-us/library/ms740141.aspx (See the description of when readfds returns). So now that the matter you describe has been cleared up, answer the question. You misunderstand the docu

RE: SSL_peek vs. SSL_pending...

2007-08-24 Thread David Schwartz
> MSDN Library documents select() as being exactly as I describe: > > http://msdn2.microsoft.com/en-us/library/ms740141.aspx > > (See the description of when readfds returns). > > So now that the matter you describe has been cleared up, answer the > question. You misunderstand the documentation.

Re: SSL_peek vs. SSL_pending...

2007-08-24 Thread Thomas J. Hruska
David Schwartz wrote: What I want to know is how do I tell OpenSSL that it is okay to do some processing of socket data but not block even with blocking sockets? You are asking for the impossible. There is no way to be sure a socket operation will not block other than to set the socket non-bloc

RE: SSL_peek vs. SSL_pending...

2007-08-24 Thread David Schwartz
> What I want to know is how do I tell OpenSSL that it is okay to do some > processing of socket data but not block even with blocking sockets? You are asking for the impossible. There is no way to be sure a socket operation will not block other than to set the socket non-blocking. Much code has

SSL_peek vs. SSL_pending...

2007-08-24 Thread Thomas J. Hruska
Here's what I want to do: select() on the underlying socket. IF select() says data is available to be read, let OpenSSL "manage processing that data but not block even if the socket is blocking". Check to see if SSL_read() will succeed instantly by calling SSL_pending(). IF SSL_pending() retu

Re: Regarding OpenSSL communication

2007-08-24 Thread jimmy bahuleyan
Suchindra Chandrahas wrote: > Thanks a lot Marek! > > I was making mistake at: > > 16 - SSL3/TLS1 handshake packet (was not including this) > > Now i understood the whole process completely, thanks to your guidance!. > If there is any document or any such thing that has such details, > it woul

Re: Regarding OpenSSL communication

2007-08-24 Thread Suchindra Chandrahas
Thanks a lot Marek! I was making mistake at: 16 - SSL3/TLS1 handshake packet (was not including this) Now i understood the whole process completely, thanks to your guidance!. If there is any document or any such thing that has such details, it would be great if you could forward it to me. Tha

Re: amount of data written in EVP_EncryptUpdate

2007-08-24 Thread Marek Marcola
Hello, > Documentation says that, for EVP_EncryptUpdate, buffer of length (input > length + cipher block size - 1) should be passed to output parameter. > > Suppose if we take AES-128, if the input length is 33, output written by > EVP_EncryptUpdate will be 32. So, possible size could be > ((in

UserPrincipalName

2007-08-24 Thread Eric Johnson
Hi. Does anybody have an example of parsing an X509 certificate structure to pull out the UserPrincipalName from the Subject Alternative Name attribute? If I understand correctly I would need to make some calls to V3_alt.c (???). I could use some assistance on how to make the necessary calls to

amount of data written in EVP_EncryptUpdate

2007-08-24 Thread durgaprasad jammula
Hi all, Documentation says that, for EVP_EncryptUpdate, buffer of length (input length + cipher block size - 1) should be passed to output parameter. Suppose if we take AES-128, if the input length is 33, output written by EVP_EncryptUpdate will be 32. So, possible size could be ((input_length

RE: SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER

2007-08-24 Thread David Schwartz
> There is no need for the data buffer to stay constant between calls to > SSL_write. > > Arne Did you see my post proving that this must be false? Here's the scenario again: 1) You try to write 16 bytes on a non-blocking SSL connection. 2) This results in a 24 byte record after encryption. 3)

Stephen Kitchener is out of the office.

2007-08-24 Thread stephen . kitchener
I will be out of the office starting 24/08/2007 and will not return until 01/09/2007. I will respond to your message when I return. __ OpenSSL Project http://www.openssl.org User Support Mailing

eapol_test failed, please help

2007-08-24 Thread jinlu8591
I ran the following test on my Radhat (Fodora 6) server to test eap-tls (after I started radiusd): ./eapol_test -c ../network -a 127.0.0.1 -p1812 -s secret -r 1 It failed after some handshake with the server: ... EAP: EAP entering state RECEIVED EAP: Received EAP-Request id=3

Re: Friendly Name in CA cert

2007-08-24 Thread Dr. Stephen Henson
On Fri, Aug 24, 2007, Bynum, Don wrote: > So, when I see a Friendly Name in the CA certs in a Trusted Root Store > (in any browser for example), how did the friendly name get there? A > PKCS#12 file always includes the private key, right? The private keys > of Trusted Root CA certs are certainl

RE: Friendly Name in CA cert

2007-08-24 Thread Bynum, Don
So, when I see a Friendly Name in the CA certs in a Trusted Root Store (in any browser for example), how did the friendly name get there? A PKCS#12 file always includes the private key, right? The private keys of Trusted Root CA certs are certainly not submitted to the browser vendor. Regards,

Re: Friendly Name in CA cert

2007-08-24 Thread Dr. Stephen Henson
On Fri, Aug 24, 2007, Bynum, Don wrote: > I want to embed a friendly name in a self signed Root CA cert. I cannot > seem to find the correct element in the config file to set this. Anyone > know how to do this? There isn't a DN component or extension called "friendly name". It is only an attrib

RE: Problem building Windows 64-bit

2007-08-24 Thread Shaw Graham George
I forgot to mention. 0.9.8e. G. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Shaw Graham George Sent: 24 August 2007 13:40 To: openssl-users@openssl.org Subject: Problem building Windows 64-bit Hi, I've tried to follow the instructions in INSTALL

Friendly Name in CA cert

2007-08-24 Thread Bynum, Don
I want to embed a friendly name in a self signed Root CA cert. I cannot seem to find the correct element in the config file to set this. Anyone know how to do this? Don Bynum

Problem building Windows 64-bit

2007-08-24 Thread Shaw Graham George
Hi, I've tried to follow the instructions in INSTALL.W64 for building OpenSSL for 64-bit Windows, but while C programs are compiling OK, the link of the dlls is failing: link /nologo /subsystem:console /opt:ref /dll /out:out32dll\libeay32.dll /def:ms/LIBEAY32.def @"C:\Documents and Settings\gshaw

Re: [SPAM] Re: SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER

2007-08-24 Thread Bodo Moeller
On Fri, Aug 24, 2007 at 01:33:17PM +0300, Arne Ansper wrote: > On Mon, 26 Jun 2006, Darryl Miles wrote: >> Bodo Moeller wrote: >>> When using SSL_write() over a non-blocking transport channel, you may >>> have to call SSL_write() multiple times until all your data has been >>> transferred. In thi

Re: SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER

2007-08-24 Thread Arne Ansper
On Mon, 26 Jun 2006, Darryl Miles wrote: Bodo Moeller wrote: When using SSL_write() over a non-blocking transport channel, you may have to call SSL_write() multiple times until all your data has been transferred. In this case, the data buffer needs to stay constant between calls until SSL_