Re: valgrind and openssl
John Parker, 2008-05-15: It is already possible to use openssl and valgrind - just build OpenSSL with -DPURIFY, and it is quite clean. Actually on my system, just -DPURIFY doesn't satisfy valgrind. What I'm asking for is something that both satisfies valgrind and doesn't reduce the keyspace. Valgrind can be told to ignore specific errors, using a suppressions file. Never used this with OpenSSL, though. http://valgrind.org/docs/manual/manual-core.html#manual-core.suppress Leandro __ OpenSSL Project http://www.openssl.org Development Mailing List openssl-dev@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: Static global - bug? (Re: Two valgrind warnings in OpenSSL -possible bug???)
Paul Sheer, 2008-01-29: Let's say you have 1600 clients. Let's say that you have 40 threads, and each thread handles 40 connections. Now let's say that each thread initializes it's own SSL_CTX structure. The SSL_CTX structure contains most of the data required for SSL functionality. Because each SSL_CTX structure has one-and-only-one thread accessing it, there can be no contention within the SSL_CTX structure's data. ... This behavior, by itself, does not necessary guarantee that your OpenSSL library code won't race against itself, won't corrupt its own data, or crash (hint: learn about the MySQL case, search the archives). IMHO, your approach is clearly wrong: your app's fate is relying on undocumented behavior. It could work with a few OpenSSL library versions; but internal, sentitive behavior could change in future versions. Hence, I don't consider this a good engineering practice. I won't argue with you about using the library in an undocumented manner; but I *do* think it'd be interesting to get some real quantitative data: we could use it as a basis to discuss possible future library modifications, more compatible with your requests. Leandro __ OpenSSL Project http://www.openssl.org Development Mailing List openssl-dev@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: Static global - bug? (Re: Two valgrind warnings in OpenSSL -possible bug???)
Leandro Santi, 2008-01-29: I won't argue with you about using the library in an undocumented manner; but I *do* think it'd be interesting to get some real quantitative data: we could use it as a basis to discuss possible future library modifications, more compatible with your requests. One more thing, I think library usage questions don't belong to this list, so perhaps you should redirect your questions somewhere else. Library developement questions, however, are on-topic. Leandro __ OpenSSL Project http://www.openssl.org Development Mailing List openssl-dev@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: Static global - bug? (Re: Two valgrind warnings in OpenSSL -possible bug???)
Tomas Mraz, 2008-01-24: So IMO what Paul Sheer is doing - disabling all locking in OpenSSL given that there won't be any static and/or global variables in the OpenSSL code called is 100% safe thing if the threads do not share any data manipulated within the OpenSSL library. As mentioned in the docs, multithreaded OpenSSL needs special application support, period. Not providing this means you'll get undefined/undesirable results. Old MySQL versios did try this approach (i.e. using the library in an undocumented way). Perhaps it sort-of worked for them while they developed the SSL support for the database engine, but newer MySQL/OpenSSL combinations didn't work at all (for example, MySQL-4.0.23a+OpenSSL-0.9.7c). They fixed it, albeit a few years down the road. Separately, I'd suggest a different development approach: first, implement OpenSSL locking support. Do some measurements, with and without locking. I'd be interested to get some quantitative evidence before proceeding with this thread. Leandro __ OpenSSL Project http://www.openssl.org Development Mailing List openssl-dev@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: getpid() not unique for threads on Linux 2.6 + NPTL
Balazs Scheidler, 2006-03-31: The problem with the current situation is that everything _seems_ to work well, but whenever load hits the application it crashes and it is not easy to debug especially when one is looking for an error in his own code :) IMHO, the sooner the problem is detected, the better. Even if this implies a brutal crash of the application. On Linux, the current CRYPTO_thread_id() behavior with multithreaded applications hides the fact that the application is *broken*. For example, MySQL with OpenSSL has been broken *for years*. The problem was much more harder to trigger on Linux, because of the default CRYPTO_thread_id() behavior. Platforms without the getpid() - pthread_self() bijection (Solaris, NetBSD = 2, ...) happily crashed sooner, and more importantly: the problem gets fixed sooner, as well. Leandro __ OpenSSL Project http://www.openssl.org Development Mailing List openssl-dev@openssl.org Automated List Manager [EMAIL PROTECTED]
Re: [OT] library has no ciphers
Christopher P. Masone, 2005-11-02: So, I've recently upgraded to 0.9.8a. Before this, I was using 0.9.7h, and things were working fine. Now, I'm getting a library has no ciphers error the first time I call SSL_CTX_new...despite the fact that I have called OpenSSL_add_all_algorithms() before I try to do any SSL stuff. I changed it to a pair of calls, one to OpenSSL_add_all_ciphers() and one to OpenSSL_add_all_digests() to see if I could get a better handle on what's happening, and it seems that whichever of those two that I call second sticks. This didn't used to happen with the older version of the library. I need to use 0.9.8 for other features...can anyone tell me what's going on and how to fix it? I had a similar problem with MySQL while upgrading to 0.9.8a. In the end, it was just a matter of calling SSL_library_init() early, at database startup time. Leandro __ OpenSSL Project http://www.openssl.org Development Mailing List openssl-dev@openssl.org Automated List Manager [EMAIL PROTECTED]
patch: mt_blinding race on multithreaded programs.
Hi,
I think that there's a race with OpenSSL-0.9.8 updating the
new, post-0.9.7 shared mt_blinding object on a multithreaded
(MySQL-4.1 for instance) environment.
The proposed solution is to use an exclusive write lock while
invert()ing the blinding process. This guarrantees that the
update of the blinding object doesn't affect other concurrent
threads, because the inverting factor is being saved with the
read lock held on the forward direction.
diff -r -u openssl-0.9.8.orig/crypto/rsa/rsa_eay.c
openssl-0.9.8.patched/crypto/rsa/rsa_eay.c
--- openssl-0.9.8.orig/crypto/rsa/rsa_eay.c 2005-05-28 17:49:09.0
-0300
+++ openssl-0.9.8.patched/crypto/rsa/rsa_eay.c 2005-09-21 18:33:20.57312
-0300
@@ -283,9 +283,9 @@
else
{
int ret;
- CRYPTO_w_lock(CRYPTO_LOCK_RSA_BLINDING);
+ CRYPTO_r_lock(CRYPTO_LOCK_RSA_BLINDING);
ret = BN_BLINDING_convert_ex(f, r, b, ctx);
- CRYPTO_w_unlock(CRYPTO_LOCK_RSA_BLINDING);
+ CRYPTO_r_unlock(CRYPTO_LOCK_RSA_BLINDING);
return ret;
}
}
@@ -298,9 +298,9 @@
else
{
int ret;
- CRYPTO_r_lock(CRYPTO_LOCK_RSA_BLINDING);
+ CRYPTO_w_lock(CRYPTO_LOCK_RSA_BLINDING);
ret = BN_BLINDING_invert_ex(f, r, b, ctx);
- CRYPTO_r_unlock(CRYPTO_LOCK_RSA_BLINDING);
+ CRYPTO_w_unlock(CRYPTO_LOCK_RSA_BLINDING);
return ret;
}
}
Leandro.
ps: tested on Solaris 9 sparc.
__
OpenSSL Project http://www.openssl.org
Development Mailing List openssl-dev@openssl.org
Automated List Manager [EMAIL PROTECTED]
