[openssl-dev] [openssl.org #4348] SSL3_GET_MESSAGE:excessive message size
Hi I am getting the following error when trying to connect to stream-api.betfair.com:443 Error connecting with SSL. error:1408E098:SSL routines:SSL3_GET_MESSAGE:excessive message size using OpenSSL. However using code I wrote using SChannel it works fine. I looked around and it looks like this has happened before and there is something in the code that needs to be tweaked, I am using 1.0.1r which I have build myself, if someone could point me at the code that needs to change to fix this I would be happy to do so. Regards Bruce -- Ticket here: http://rt.openssl.org/Ticket/Display.html?id=4348 Please log in as guest with password guest if prompted -- openssl-dev mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
[openssl-dev] [openssl.org #4347] Fix GCC unused-value warnings with HOST_c2l()
The HOST_c2l() macro assigns the value to the specified variable, but also
evaluates to the same value. Which we ignore, triggering a warning.
To fix this, just cast it to void — like we did in commit 08e553644
("Fix some clang warnings.") for a bunch of other instances.
---
crypto/md5/md5_dgst.c | 32
crypto/sha/sha256.c | 34 +-
crypto/sha/sha_locl.h | 2 +-
3 files changed, 34 insertions(+), 34 deletions(-)
diff --git a/crypto/md5/md5_dgst.c b/crypto/md5/md5_dgst.c
index 18a3262..37b0d31 100644
--- a/crypto/md5/md5_dgst.c
+++ b/crypto/md5/md5_dgst.c
@@ -102,52 +102,52 @@ void md5_block_data_order(MD5_CTX *c, const void *data_,
size_t num)
D = c->D;
for (; num--;) {
-HOST_c2l(data, l);
+(void)HOST_c2l(data, l);
X(0) = l;
-HOST_c2l(data, l);
+(void)HOST_c2l(data, l);
X(1) = l;
/* Round 0 */
R0(A, B, C, D, X(0), 7, 0xd76aa478L);
-HOST_c2l(data, l);
+(void)HOST_c2l(data, l);
X(2) = l;
R0(D, A, B, C, X(1), 12, 0xe8c7b756L);
-HOST_c2l(data, l);
+(void)HOST_c2l(data, l);
X(3) = l;
R0(C, D, A, B, X(2), 17, 0x242070dbL);
-HOST_c2l(data, l);
+(void)HOST_c2l(data, l);
X(4) = l;
R0(B, C, D, A, X(3), 22, 0xc1bdceeeL);
-HOST_c2l(data, l);
+(void)HOST_c2l(data, l);
X(5) = l;
R0(A, B, C, D, X(4), 7, 0xf57c0fafL);
-HOST_c2l(data, l);
+(void)HOST_c2l(data, l);
X(6) = l;
R0(D, A, B, C, X(5), 12, 0x4787c62aL);
-HOST_c2l(data, l);
+(void)HOST_c2l(data, l);
X(7) = l;
R0(C, D, A, B, X(6), 17, 0xa8304613L);
-HOST_c2l(data, l);
+(void)HOST_c2l(data, l);
X(8) = l;
R0(B, C, D, A, X(7), 22, 0xfd469501L);
-HOST_c2l(data, l);
+(void)HOST_c2l(data, l);
X(9) = l;
R0(A, B, C, D, X(8), 7, 0x698098d8L);
-HOST_c2l(data, l);
+(void)HOST_c2l(data, l);
X(10) = l;
R0(D, A, B, C, X(9), 12, 0x8b44f7afL);
-HOST_c2l(data, l);
+(void)HOST_c2l(data, l);
X(11) = l;
R0(C, D, A, B, X(10), 17, 0x5bb1L);
-HOST_c2l(data, l);
+(void)HOST_c2l(data, l);
X(12) = l;
R0(B, C, D, A, X(11), 22, 0x895cd7beL);
-HOST_c2l(data, l);
+(void)HOST_c2l(data, l);
X(13) = l;
R0(A, B, C, D, X(12), 7, 0x6b901122L);
-HOST_c2l(data, l);
+(void)HOST_c2l(data, l);
X(14) = l;
R0(D, A, B, C, X(13), 12, 0xfd987193L);
-HOST_c2l(data, l);
+(void)HOST_c2l(data, l);
X(15) = l;
R0(C, D, A, B, X(14), 17, 0xa679438eL);
R0(B, C, D, A, X(15), 22, 0x49b40821L);
diff --git a/crypto/sha/sha256.c b/crypto/sha/sha256.c
index d7d33d5..53b6054 100644
--- a/crypto/sha/sha256.c
+++ b/crypto/sha/sha256.c
@@ -181,7 +181,7 @@ static void sha256_block_data_order(SHA256_CTX *ctx, const
void *in,
h = ctx->h[7];
for (i = 0; i < 16; i++) {
-HOST_c2l(data, l);
+(void)HOST_c2l(data, l);
T1 = X[i] = l;
T1 += h + Sigma1(e) + Ch(e, f, g) + K256[i];
T2 = Sigma0(a) + Maj(a, b, c);
@@ -305,52 +305,52 @@ static void sha256_block_data_order(SHA256_CTX *ctx,
const void *in,
} else {
SHA_LONG l;
-HOST_c2l(data, l);
+(void)HOST_c2l(data, l);
T1 = X[0] = l;
ROUND_00_15(0, a, b, c, d, e, f, g, h);
-HOST_c2l(data, l);
+(void)HOST_c2l(data, l);
T1 = X[1] = l;
ROUND_00_15(1, h, a, b, c, d, e, f, g);
-HOST_c2l(data, l);
+(void)HOST_c2l(data, l);
T1 = X[2] = l;
ROUND_00_15(2, g, h, a, b, c, d, e, f);
-HOST_c2l(data, l);
+(void)HOST_c2l(data, l);
T1 = X[3] = l;
ROUND_00_15(3, f, g, h, a, b, c, d, e);
-HOST_c2l(data, l);
+(void)HOST_c2l(data, l);
T1 = X[4] = l;
ROUND_00_15(4, e, f, g, h, a, b, c, d);
-HOST_c2l(data, l);
+(void)HOST_c2l(data, l);
T1 = X[5] = l;
ROUND_00_15(5, d, e, f, g, h, a, b, c);
-HOST_c2l(data, l);
+(void)HOST_c2l(data, l);
T1 = X[6] = l;
ROUND_00_15(6, c, d, e, f, g, h, a, b);
-HOST_c2l(data, l);
+(void)HOST_c2l(data, l);
T1 = X[7] = l;
ROUND_00_15(7, b, c, d, e, f, g, h, a);
-HOST_c2l(data, l);
+(void)HOST_c2l(data, l);
T1 = X[8] = l;
ROUND_00_15(8, a, b, c, d, e, f, g, h);
-HOST_c2l(data, l);
+(void)HOST_c2l(data, l);
T1 = X[9] = l;
ROUND_00_15(9, h, a, b, c, d, e, f, g);
-
[openssl-dev] [openssl.org #4346] poly1305-x86.pl's AVX2 code
There seems to be a bug in the AVX2 codepath in poly1305-x86.pl. I have not
attempted to debug this, but I have attached a test file which produces
different output in normal and AVX2 codepaths. Our existing poly1305
implementation agrees with the former.
$ OPENSSL_ia32cap=0 ./poly1305_test
PASS
$ ./poly1305_test
Poly1305 test failed.
got: 2e65f0054e36505687d937ff5e8ed112
expected: 69d28f73dd09d39a92aa179da354b7ea
You may wish to generalize that Poly1305_Update pattern into your own
tests. This is what I did to catch this:
https://boringssl-review.googlesource.com/#/c/7223/
>From looking at valgrind, this pattern seems to give good coverage. I
used valgrind --tool=callgrind --dump-instr=yes --collect-jumps=yes and
then kcachegrind to inspect the output. (kcachegrind is a bit heavy for
this. I'm hoping I can find or write a better annotator here. Something
which looks like, say, LCOV would be ideal.)
By the way, this assembly code is quite complicated. I wasn't able to find
problems in the others (I tested armv4, armv8, x86, and x86_64), but I'm
far from confident I've covered all the cases.
With the caveat that I'm no assembly programmer, much of the complexity
seems to come the SIMD code needing a multiple of 2 or 4 blocks and the
implementation converting internal state back and forth from base 2^26 and
2^64 and handling excess blocks slightly differently in different cases. (I
counted nine distinct codepaths to test in the x86_64 AVX codepath alone.)
The C code already buffers up to 16-byte blocks. Did you consider buffering
up to 32 or 64 bytes in C when the SIMD code called for it? I think it
could be simpler. You'd only need to handle excess blocks at the end. This
would also simplify the SIMD upgrade on long inputs, so long as the buffer
exceeds the cutoff. (You'll never process input before the upgrade.)
I haven't tried this, so perhaps the performance costs are prohibitive, but
if the costs are modest, the simplifications may be worth it.
David
--
Ticket here: http://rt.openssl.org/Ticket/Display.html?id=4346
Please log in as guest with password guest if prompted
/* Place in openssl checkout (for access to poly1305.h) and build with:
*
* gcc -m32 ./poly1305_test.c ./libcrypto.a -Iinclude/ -ldl -pthread -o poly1305_test */
#include
#include
#include
#include
#include
#include "crypto/include/internal/poly1305.h"
/* Copy over the poly1305_context definition, so as not to fuss with sizes. */
typedef void (*poly1305_blocks_f)(void *ctx, const unsigned char *inp,
size_t len, unsigned int padbit);
typedef void (*poly1305_emit_f)(void *ctx, unsigned char mac[16],
const unsigned int nonce[4]);
struct poly1305_context {
double opaque[24];
unsigned int nonce[4];
unsigned char data[POLY1305_BLOCK_SIZE];
size_t num;
struct {
poly1305_blocks_f blocks;
poly1305_emit_f emit;
} func;
};
/* Adapted from poly1305.c's SELFTEST codepath. */
static uint8_t hex_digit(char h) {
if (h >= '0' && h <= '9') {
return h - '0';
} else if (h >= 'a' && h <= 'f') {
return h - 'a' + 10;
} else if (h >= 'A' && h <= 'F') {
return h - 'A' + 10;
} else {
abort();
}
}
static void hex_decode(uint8_t *out, const char *hex) {
size_t j = 0;
while (*hex != 0) {
uint8_t v = hex_digit(*hex++);
v <<= 4;
v |= hex_digit(*hex++);
out[j++] = v;
}
}
static void hexdump(uint8_t *a, size_t len) {
size_t i;
for (i = 0; i < len; i++) {
printf("%02x", a[i]);
}
}
static const char kKey[] =
"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f";
static const char kInput[] =
"248ac31085b6c2adaaa38259a0d7192c5c35d1bb4ef39ad94c38d1c82479e2dd2159a07702"
"4b0589bc8a20101b506f0a1ad0bbab76e83a83f1b94be6beae74e874cab692c5963a75436b"
"776121ec9f62399a3e66b2d22707dae81933b6277f3c8516bcbe26dbbd86f373103d7cf4ca"
"d1888c952118fbfbd0d7b4bedc4ae4936aff91157e7aa47c54442ea78d6ac251d324a0fbe4"
"9d89cc3521b66d16e9c66a3709894e4eb0a4eedc4ae19468e66b81f271351b1d921ea55104"
"7abcc6b87a901fde7db79fa1818c11336dbc07244a40eb14cf77bde35e78ae9ad7d3f57ed7"
"e7f23926c9172f82d77684ea5ed7d74ebc6f142b997036bcb7cce8df1bbc0d5b35a46509c9"
"54fc9469d214d6238f166cbf872156b4c41d7aac5942cffb175023078252a3f36e315c5d4c"
"e0e39928a018252862becacef96a19f03bdcf46d75584299d1f8b03c0169e9e407d937145b"
"5e5024139e7022a1978f114f24cdfa23780a119735c41da8fb759bbb3f025c6ec30e6c6e9b"
"ce8615be68e392fce59fd26a8e6a6cc5c606e3848116e4d01d29565a1facfb524b6d29643b"
"826eee1e42869fc76df229dd79b39a2b1df28bb335c3a5f15a855d0121e4a6da34b5e4d5b7"
"b5d5746a03ecff70811e1516fcec1bf7462e8876a2d21710aa168c78f45a6a15015950e221"
"da85d3ec822ad6d0a6931b25a06b7bb5f3c10bb36cd4d647f9561982fde9818de5d4bf8db7"
"f86c53b4ff14928ac15f79023b61861e73e44216540bb302153770da2533de9795252ab5fb"
"77ad924c9338c8144c23d4c90dab9a18feac1a1574d4545e1435eb405e6c4c439fc724fce9"
[openssl-dev] [openssl.org #4116] [PATCH] Reimplement non-asm OPENSSL_cleanse()
closed with commit 104ce8a thanks. -- Rich Salz, OpenSSL dev team; rs...@openssl.org -- Ticket here: http://rt.openssl.org/Ticket/Display.html?id=4116 Please log in as guest with password guest if prompted -- openssl-dev mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
[openssl-dev] [openssl.org #4324] openssl-1.1.0-pre3 with solaris-x86-cc & solaris64-x86_64-cc make fails
With the following patch,
% ./Configure --unified solaris-x86-cc
% make
% make test
passed.
% ./Configure --unifiedsolaris64-x86_64-cc; make; make test
also passed.
This patch was written comparing to openssl-1.0.2f.
It has side effect for other configurations.
Please add some conditions.
diff -cr ../openssl-1.1.0-pre3.orig/Makefile.shared ./Makefile.shared
*** ../openssl-1.1.0-pre3.orig/Makefile.shared 2016-02-16 03:08:07.0
+0900
--- ./Makefile.shared 2016-02-25 22:57:23.347187336 +0900
***
*** 398,409
($(CC) -v 2>&1 | grep gcc) > /dev/null && MINUSZ='-Wl,-z,'; \
SHLIB=lib$(LIBNAME).so; \
SHLIB_SUFFIX=;\
! if [ $(LIBNAME) != "crypto" -a $(LIBNAME) != "ssl" ]; then \
ALLSYMSFLAGS="$${MINUSZ}allextract"; \
! else \
! $(PERL) $(SRCDIR)/util/mkdef.pl $(LIBNAME) linux >$(LIBNAME).map; \
! ALLSYMSFLAGS="$${MINUSZ}allextract,-M,$(LIBNAME).map"; \
! fi; \
NOALLSYMSFLAGS="$${MINUSZ}defaultextract"; \
SHAREDFLAGS="$(CFLAGS) $(SHARED_LDFLAGS) -h
$$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX -Wl,-Bsymbolic"; \
fi; \
--- 398,409
($(CC) -v 2>&1 | grep gcc) > /dev/null && MINUSZ='-Wl,-z,'; \
SHLIB=lib$(LIBNAME).so; \
SHLIB_SUFFIX=;\
! # if [ $(LIBNAME) != "crypto" -a $(LIBNAME) != "ssl" ]; then \
ALLSYMSFLAGS="$${MINUSZ}allextract"; \
! # else \
! # $(PERL) $(SRCDIR)/util/mkdef.pl $(LIBNAME) linux >$(LIBNAME).map; \
! # ALLSYMSFLAGS="$${MINUSZ}allextract,-M,$(LIBNAME).map"; \
! # fi; \
NOALLSYMSFLAGS="$${MINUSZ}defaultextract"; \
SHAREDFLAGS="$(CFLAGS) $(SHARED_LDFLAGS) -h
$$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX -Wl,-Bsymbolic"; \
fi; \
--
Ticket here: http://rt.openssl.org/Ticket/Display.html?id=4324
Please log in as guest with password guest if prompted
--
openssl-dev mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
[openssl-dev] [openssl.org #4345] Bug - Cannot build openssl-1.1.0-pre4-dev on NetBSD 6_Stable
The first parts of this report are the actual build bug I think I am encountering, but also, at the end, I am asking for additional help with enabling the crypto-mdebug and crypto-mdebug-backtrace as I am trying to to diagnose a compatibility issue between tor and the openssl 1.1.0_dev branch. config and output: *Config command and output* # ./config --unified --debug --api=1.1.0 no-shared Operating system: i686-whatever-netbsd Configuring for BSD-x86-elf Configuring OpenSSL version 1.1.0-pre4-dev (0x0x1014L) no-crypto-mdebug [default] OPENSSL_NO_CRYPTO_MDEBUG (skip dir) no-crypto-mdebug-backtrace [forced] OPENSSL_NO_CRYPTO_MDEBUG_BACKTRACE (skip dir) no-ec_nistp_64_gcc_128 [default] OPENSSL_NO_EC_NISTP_64_GCC_128 (skip dir) no-egd [default] OPENSSL_NO_EGD (skip dir) no-heartbeats [default] OPENSSL_NO_HEARTBEATS (skip dir) no-md2 [default] OPENSSL_NO_MD2 (skip dir) no-rc5 [default] OPENSSL_NO_RC5 (skip dir) no-sctp [default] OPENSSL_NO_SCTP (skip dir) no-shared [option] no-ssl-trace[default] OPENSSL_NO_SSL_TRACE (skip dir) no-static-engine [default] OPENSSL_NO_STATIC_ENGINE (skip dir) no-unit-test[default] OPENSSL_NO_UNIT_TEST (skip dir) no-zlib [default] no-zlib-dynamic [forced] Configuring for BSD-x86-elf IsMK1MF =no CC=cc CFLAG = -pthread -D_THREAD_SAFE -D_REENTRANT -DL_ENDIAN -Wall -O0 -g -DWHIRLPOOL_ASM -Wa,--noexecstack DEFINES =DSO_DLFCN HAVE_DLFCN_H OPENSSL_THREADS OPENSSL_NO_STATIC_ENGINE OPENSSL_PIC OPENSSL_BN_ASM_PART_WORDS OPENSSL_IA32_SSE2 OPENSSL_BN_ASM_MONT OPENSSL_BN_ASM_GF2m SHA1_ASM SHA256_ASM SHA512_ASM MD5_ASM RMD160_ASM AES_ASM VPAES_ASM GHASH_ASM ECP_NISTZ256_ASM POLY1305_ASM OPENSSL_API_COMPAT=0x1010L LFLAG = PLIB_LFLAG= EX_LIBS = CPUID_OBJ =x86cpuid.o BN_ASM=bn-586.o co-586.o x86-mont.o x86-gf2m.o EC_ASM=ecp_nistz256.o ecp_nistz256-x86.o DES_ENC =des-586.o crypt586.o AES_ENC =aes-586.o vpaes-x86.o aesni-x86.o BF_ENC=bf-586.o CAST_ENC =c_enc.o RC4_ENC =rc4-586.o RC5_ENC =rc5-586.o MD5_OBJ_ASM =md5-586.o SHA1_OBJ_ASM =sha1-586.o sha256-586.o sha512-586.o RMD160_OBJ_ASM=rmd-586.o CMLL_ENC =cmll-x86.o MODES_OBJ =ghash-x86.o PADLOCK_OBJ =e_padlock-x86.o CHACHA_ENC=chacha-x86.o POLY1305_OBJ =poly1305-x86.o PROCESSOR = RANLIB=/usr/bin/ranlib ARFLAGS = PERL =/usr/pkg/bin/perl THIRTY_TWO_BIT mode BN_LLONG mode Configured for BSD-x86-elf. *** if I gmake at the top level, the build proceeds for a while and appears to exit cleanly, but if I run gmake again, I get the following message: # gmake gmake: *** No rule to make target 'usr/include/stdio.husr/include/sys/cdefs.h', needed by 'apps/openssl'. Stop. *** I have problems even if I turn off debug. I really want debug AND I think I need to enable crypto-mdebug and crypto-mdebug-backtrace so I can determine the calling line from tor that is crashing in openssl. The tor dev's think they have coded for compatibility with openssl 1.1.0_dev, but I cannot confirm this on my builds. I built tor with debug symbols, but so far, even if I set breakpoints at main() in tor, running tor in gdb appears to crash in openssl somewhere but I cannot execute a backtrace to see what line in tor is calling the openssl function that is failing. At the moment I cannot even build openssl. I've had this issue for a week or two... -- Ticket here: http://rt.openssl.org/Ticket/Display.html?id=4345 Please log in as guest with password guest if prompted -- openssl-dev mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
[openssl-dev] Forthcoming OpenSSL releases
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Forthcoming OpenSSL releases The OpenSSL project team would like to announce the forthcoming release of OpenSSL versions 1.0.2g, 1.0.1s. These releases will be made available on 1st March 2016 between approximately 1300-1700 UTC. They will fix several security defects with maximum severity "high". Please see the following page for further details of severity levels: https://www.openssl.org/policies/secpolicy.html Please also note that, as per our previous announcements, support for 1.0.1 will end on 31st December 2016. Yours The OpenSSL Project Team -BEGIN PGP SIGNATURE- Version: GnuPG v1 iQEcBAEBCAAGBQJWzsjbAAoJEAEKUEB8TIy9ukoH/A+KQh0TPuC5CulMeFd4OiGy 7HV9bX/nCe4sKmW5IGYt6GDPFRnhup9WR9Dvz0C/sBjwttsnF+UZOUUfYbDw2liO YG46kiS95zbeU4yYFQwHr9Sf01o89ogEGrxCIlKQiA4aXSZwn9liI0a51y7izWUC xdj2GEgQ/fnVnlN/AyToVmoQxlrphXJx9FigLxTuXi1X6nvSNdEYB1VtOuqjanRu 8sR4UDCWYRZNT0L3as0IEU49X7ncwm5a85NR02SkVimevdbJw0mBT1ru4Zjddo88 oO5xpgSKy2a56xC8yQXURkVPvuFqUpfvyojLwOULUnWHCpnDhzn+ygdko2Pii3o= =XURc -END PGP SIGNATURE- -- openssl-dev mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
Re: [openssl-dev] SSL_library_init
On 24/02/16 15:50, The Doctor wrote: > As of 2106-20-24 SSL_librbary_init may not be avialable in the libssl.so . > > Is their a workaround for this? > SSL_library_init is still available in ssl.h as a compatibility macro: #if OPENSSL_API_COMPAT < 0x1010L # define SSL_library_init() OPENSSL_init_ssl(0, NULL) #endif Matt -- openssl-dev mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
