[openssl.org #2799] [PATCH] Elliptic Curve Library documentation

2012-04-21 Thread Matt Caswell via RT
Hello

The openssl EC library is a fantastic resource which provides an 
extensive set of functions for performing work with elliptic curves. 
Unfortunately the documentation available is somewhat "minimalistic". 
The documentation is not in the standard openssl "pod" format (it is 
instead in doxygen format embedded in the code), is limited to very 
basic descriptions of functions, and does not cover all functions available.

This patch provides a complete set of pod documentation for the EC 
library. It has been created against the CVS HEAD, although I anticipate 
it could be applied to other branches if required.

I hope this will be of some use to other users.


Regards

Matt


diff -ur -x CVS -x '*~' -N openssl-orig/doc/crypto/crypto.pod openssl-ecdocs/doc/crypto/crypto.pod
--- openssl-orig/doc/crypto/crypto.pod	2002-10-06 13:59:25.0 +0100
+++ openssl-ecdocs/doc/crypto/crypto.pod	2012-04-21 12:15:48.626403887 +0100
@@ -56,7 +56,7 @@
 
 =item INTERNAL FUNCTIONS
 
-L, L, L,
+L, L, L, L,
 L, L,
 L 
 
diff -ur -x CVS -x '*~' -N openssl-orig/doc/crypto/d2i_ECPKParameters.pod openssl-ecdocs/doc/crypto/d2i_ECPKParameters.pod
--- openssl-orig/doc/crypto/d2i_ECPKParameters.pod	1970-01-01 01:00:00.0 +0100
+++ openssl-ecdocs/doc/crypto/d2i_ECPKParameters.pod	2012-04-21 12:42:05.774425891 +0100
@@ -0,0 +1,85 @@
+=pod
+
+=head1 NAME
+
+d2i_ECPKParameters and related functions - Functions for decoding and encoding ASN1 representations of elliptic curve entities
+
+=head1 SYNOPSIS
+
+ #include 
+
+ EC_GROUP *d2i_ECPKParameters(EC_GROUP **px, const unsigned char **in, long len);
+ int i2d_ECPKParameters(const EC_GROUP *x, unsigned char **out);
+ #define d2i_ECPKParameters_bio(bp,x) ASN1_d2i_bio_of(EC_GROUP,NULL,d2i_ECPKParameters,bp,x)
+ #define i2d_ECPKParameters_bio(bp,x) ASN1_i2d_bio_of_const(EC_GROUP,i2d_ECPKParameters,bp,x)
+ #define d2i_ECPKParameters_fp(fp,x) (EC_GROUP *)ASN1_d2i_fp(NULL, \
+(char *(*)())d2i_ECPKParameters,(fp),(unsigned char **)(x))
+ #define i2d_ECPKParameters_fp(fp,x) ASN1_i2d_fp(i2d_ECPKParameters,(fp), \
+		(unsigned char *)(x))
+ int ECPKParameters_print(BIO *bp, const EC_GROUP *x, int off);
+ int ECPKParameters_print_fp(FILE *fp, const EC_GROUP *x, int off);
+
+
+=head1 DESCRIPTION
+
+The ECPKParameters encode and decode routines encode and parse the public parameters for an
+B structure, which represents a curve.
+
+d2i_ECPKParameters() attempts to decode B bytes at B<*in>. If 
+successful a pointer to the B structure is returned. If an error
+occurred then B is returned. If B is not B then the
+returned structure is written to B<*px>. If B<*px> is not B
+then it is assumed that B<*px> contains a valid B
+structure and an attempt is made to reuse it. If the call is
+successful B<*in> is incremented to the byte following the
+parsed data.
+
+i2d_ECPKParameters() encodes the structure pointed to by B into DER format.
+If B is not B is writes the DER encoded data to the buffer
+at B<*out>, and increments it to point after the data just written.
+If the return value is negative an error occurred, otherwise it
+returns the length of the encoded data. 
+
+If B<*out> is B memory will be allocated for a buffer and the encoded
+data written to it. In this case B<*out> is not incremented and it points to
+the start of the data just written.
+
+d2i_ECPKParameters_bio() is similar to d2i_ECPKParameters() except it attempts
+to parse data from BIO B.
+
+d2i_ECPKParameters_fp() is similar to d2i_ECPKParameters() except it attempts
+to parse data from FILE pointer B.
+
+i2d_ECPKParameters_bio() is similar to i2d_ECPKParameters() except it writes
+the encoding of the structure B to BIO B and it
+returns 1 for success and 0 for failure.
+
+i2d_ECPKParameters_fp() is similar to i2d_ECPKParameters() except it writes
+the encoding of the structure B to BIO B and it
+returns 1 for success and 0 for failure.
+
+These functions are very similar to the X509 functions described in L,
+where further notes and examples are available.
+
+The ECPKParameters_print and ECPKParameters_print_fp functions print a human-readable output
+of the public parameters of the EC_GROUP to B or B. The output lines are indented by B spaces.
+
+=head1 RETURN VALUES
+
+d2i_ECPKParameters(), d2i_ECPKParameters_bio() and d2i_ECPKParameters_fp() return a valid B structure
+or B if an error occurs.
+
+i2d_ECPKParameters() returns the number of bytes successfully encoded or a negative
+value if an error occurs.
+
+i2d_ECPKParameters_bio(), i2d_ECPKParameters_fp(), ECPKParameters_print and ECPKParameters_print_fp
+return 1 for success and 0 if an error occurs. 
+
+=head1 SEE ALSO
+
+L, L, L, L,
+L, L, L,
+L, L
+
+=cut
+
diff -ur -x CVS -x '*~' -N openssl-orig/doc/crypto/EC_GFp_simple_method.pod openssl-ecdocs/doc/crypto/EC_GFp_simple_method.pod
--- openssl-orig/doc/crypto/EC_GFp_simple_method.pod	1970-01-01 01:00:00.0 +0100
+++ openssl-ecdocs/doc/crypto/EC_GFp_simple_method.pod	2012-04-21 12

Re: [openssl.org #2771] [BUG] Openssl 1.0.1 times out when connecting to Outlook Exchange 2007

2012-04-21 Thread Kurt Roeckx
On Thu, Mar 29, 2012 at 09:46:34PM +0200, Kurt Roeckx wrote:
> On Sun, Mar 25, 2012 at 01:52:22PM +0200, Stephen Henson via RT wrote:
> > > [steve - Sun Mar 25 13:11:30 2012]:
> > > 
> > > I've done some more tests and it seems that the size of the client hello
> > > message is significant: all the options that work reduce the size of
> > > client hello. If you use the -debug option and check out the first
> > > message bytes 4 and 5 it seems those servers hang if the length exceeds
> > > 0xFF (using two bytes instead of one).
> > > 
> > 
> > If you use the option "-servername " you can precisely
> > control the size of the client hello. If you use that to make client
> > hello long enough you get the hang with OpenSSL 1.0.0h and earlier as well.
> 
> So I'm getting more and more reports of sites that have a problem
> since 1.0.1.  They basicly fall in 2 categories:
> - They don't tolerate versions higher than TLS 1.0
> - They don't like big packets.
> 
> Of the 2nd case I have at least found people complain about those
> sites:
> - www.facebook.com
> - www.paypal.com

Those seem to work with the 1.0.1a version, even when the packets
are still bigger than 256.  It's sending a TLS 1.2 ClientHello
in a TLS 1.0 packet now.

> - sourceforge.net

This one still fails, but I believe that that was caused by the
load balancer of F5 Networks (Big IP).


Kurt

__
OpenSSL Project http://www.openssl.org
Development Mailing List   openssl-dev@openssl.org
Automated List Manager   majord...@openssl.org