RE: OpenSSL and kernel __read_nocancel() blocking under heavy network congestion

Mark Laubach wrote: > Hi David, > > Thanks and yes, these are the conundrums I'm curious about: > 1) why does the process get hung on __read_nocancel (), when the > connection is set to non-blocking, and only under heavy congestion?, My bet is the connection is not actually being set non-blockin

Re: OpenSSL and kernel __read_nocancel() blocking under heavy network congestion

Hi Mark, Mark Laubach wrote: > Hi David, > > Thanks and yes, these are the conundrums I'm curious about: > 1) why does the process get hung on __read_nocancel (), when the > connection is set to non-blocking, and only under heavy congestion?, > and 2) if the connection did turn blocking, why aren

Re: OpenSSL and kernel __read_nocancel() blocking under heavy network congestion

Hi David, Thanks and yes, these are the conundrums I'm curious about: 1) why does the process get hung on __read_nocancel (), when the connection is set to non-blocking, and only under heavy congestion?, and 2) if the connection did turn blocking, why aren't the added timeouts working? I'll keep

Integration of 0.9.8k into Apache 2.2.10

I've recently upgraded my Apache HTTP Server to Apache 2.2.10 with OpenSSL 0.9.8i bundled in.  Because of the 25-Mar-2009 Security Advisory(http://www.openssl.org/news/secadv_20090325.txt) I need to upgrade to OpenSSL 0.9.8k but I am having difficulties finding instructions on integrating this into

RE: nonblocking implementation question

> Basically, I don't really want any calls to require more than a > context that needs to be maintained - I don't want to hand my data off > to the API and have to come back to it at some arbitrary later time, > having it buffered and/or queued by mechanisms built into the openssl > api. I expect

problem with client certificate authentication using s_server Verify command

Hello list I have been experimenting on client certificate authentication using openssl s_server command but i have a problem in this case: i am running ssl server using the command: openssl s_server -accept 443 -cert sslcert/cacert.pem -key sslcert/private/cakey.pem -Verify 1 -CAfile ca-bundle.c

specific cert extensions needed for smartcards?

Hi there I'm evaluating eTokens for secure cert storage and along with other aspects was looking at the ability for Windows domains to use smartcards to control login access. Aladdin eToken documentation explicitly states you have to use a Microsoft CA to generate certs that can be used for smartc

Re: nonblocking implementation question

On Tue, May 26, 2009 at 05:02:59PM -0400, Aaron Wiebe wrote: > >> You're looking for a BIO_s_mem. > > > > No, he is looking for BIO_new_bio_pair(3) and SSL_set_bio(3). > > And this is where I'm running into confusing bits of information. > Bluntly, the documentation that I can find is nearly usel

Re: nonblocking implementation question

On Tue, May 26, 2009 at 4:46 PM, Victor Duchovni wrote: > On Tue, May 26, 2009 at 01:13:33PM -0700, Kyle Hamilton wrote: > >> You're looking for a BIO_s_mem. > > No, he is looking for BIO_new_bio_pair(3) and SSL_set_bio(3). And this is where I'm running into confusing bits of information. Bluntly

Re: nonblocking implementation question

On Tue, May 26, 2009 at 01:13:33PM -0700, Kyle Hamilton wrote: > You're looking for a BIO_s_mem. No, he is looking for BIO_new_bio_pair(3) and SSL_set_bio(3). > > In short, I don't really want SSL doing my writing or buffering. ??I > > just want the library to do my negotiation and encryption -

Re: nonblocking implementation question

You're looking for a BIO_s_mem. -Kyle H On Tue, May 26, 2009 at 7:33 AM, Aaron Wiebe wrote: > Greetings All, > > I've gone through various levels of documentation to see if there is a > method available to implement SSL as I have envisioned, but I haven't > been able to find what I'm looking for

using rsa-oaep with encoding parameters

Hello, I am using openssl library for crypto operations in implementation of W3C XML Encryption specifications - http://www.w3.org/TR/xmlenc-core/. The specification requires supporting the RSA-OAEP public-key algorithm with encoding-parameters - http://www.w3.org/TR/xmlenc-core/#sec-RSA-OAEP. I h

Re: TLS compatibility problem -- can connect to server with NSS but not OpenSSL.

On Mon, May 25, 2009 at 08:41:29PM -0400, Dave Thompson wrote: > > From: owner-openssl-us...@openssl.org On Behalf Of David Woodhouse > > Sent: Friday, 22 May, 2009 05:49 > > To: openssl-users@openssl.org > > Subject: Re: TLS compatibility problem -- can connect to > > server with NSS but not Ope

nonblocking implementation question

Greetings All, I've gone through various levels of documentation to see if there is a method available to implement SSL as I have envisioned, but I haven't been able to find what I'm looking for. Perhaps someone here could point me in a good direction... I'm developing a nonblocking application

Re: nonblocking implementation question

On Tue, May 26, 2009 at 10:33:11AM -0400, Aaron Wiebe wrote: > Greetings All, > > I've gone through various levels of documentation to see if there is a > method available to implement SSL as I have envisioned, but I haven't > been able to find what I'm looking for. Perhaps someone here could >

Re: Handshake fails on HPUX IA64 Release bits

More investigation shows that the issue is seen with ssl3 and tls1 , ssl2 works fine ... > ../util/shlib_wrap.sh ./ssltest -ssl2 Available compression methods: NONE SSLv2, cipher SSLv2 DES-CBC3-MD5, 512 bit RSA 1 handshakes of 256 bytes done > ../util/shlib_wrap.sh ./ssltest -ssl3 Available compres

Handshake fails on HPUX IA64 Release bits

hi, Openssl Veriosn :: openssl 0.9.8g Platform :: HP-UX 11 23 IA64 SSL Handshake fails with Release variants , works fine with the Debug variants. Any Comments ? Can this be related to optimization ? Any thoughts why it works for Debug and fails with release ? Handshake fails with Release v