[openssl.org #1795] [ bug report + tentative patch ] SSL_CTX thread safety issue

2008-11-28 Thread Peter Edwards via RT
Hi, I previously reported this issue with the subject "ssl3_get_server_hello not threadsafe(?)" to -dev. Rephrased a bit and reposted to -bugs. This is definitely relevant for 0.9.8i, but seems to be so for current snapshots too. I've a simple program (used as a stress tool) that creates a numb

Re: [openssl.org #1795] [ bug report + tentative patch ] SSL_CTX thread safety issue

2008-11-28 Thread Ger Hobbelt
Wow. This may explain a once-in-a-million anomaly going on here. Hm... Checked this and yes, same story in 0.9.9 HEAD. Note that this is a particular wicked insect, because, as it is the stack/stack.c internal_find() function who exhibits the _side effect_ of sorting a yet unsorted stack, _any

Re: [openssl.org #1795] [ bug report + tentative patch ] SSL_CTX thread safety issue

2008-11-28 Thread Ger Hobbelt
Whoops, missed a spot: When you've processed the stuff reported in this thread before now, recall that line about the lock only having to surround the sort() to make the stuff threadsafe... ASSUMING a repeatable sort. (As in parallel access fringe cases the 'sorted' flag can be read and found to b

Re: [openssl.org #1795] [ bug report + tentative patch ] SSL_CTX thread safety issue

2008-11-28 Thread Maarten Litmaath
Ger Hobbelt wrote: lock(l); if ( ! is_locked()) { sort(); sorted=1; } unlock(l); I suspect is_locked() needs to be is_sorted()? I suggest this instead: -- if ( ! is_sorted()) { lock(l); if ( ! is_sorted()) { sort(); sorted=1; }

Re: [openssl.org #1753] snapshot 20081003 broke mingw build

2008-11-28 Thread Alon Bar-Lev via RT
Please merge. On 11/23/08, Alon Bar-Lev <[EMAIL PROTECTED]> wrote: > > I finish the tests with native build (MSYS environment): > > > > The source tree contain recent version (2008-11-23) plus patches: > > > > from ticket 1747: > > - openssl-cvs-mingw-capi.patch.gz > > last from this t

Re: [openssl.org #1795] [ bug report + tentative patch ] SSL_CTX thread safety issue

2008-11-28 Thread Ger Hobbelt
is_sorted() indeed. Mis-wrote that. Sequencing multiple is_sorted() calls like you suggest may be done; the race condition recurs as you allow access to the 'sorted' flag outside the critical section, yet this time the inner is_sorted() check prevents repeating the sort in case of race. Nice idea

Patch: Generate salt when giving key and iv on the command line

2008-11-28 Thread Kosta Welke
Hi! from enc.c: /* Note that str is NULL if a key was passed on the command * line, so we get no salt in that case. Is this a bug? */ I say yes and have a fix. Cheers! Kosta salt.patch Description: Binary data

[openssl.org #1796] Bug in openssl 0.9.8?

2008-11-28 Thread Krüger, Michael via RT
I use openssl 0.9.8 on SPARC Solaris 10 and try to send a text message to a server running on Windows XP Professional SP3 with activated firewall using a non-blocking socket with BIO_puts(). The write to the socket returns with ENOTCONN which is a non-fatal error because BIO_should_retry() retu

Re: [openssl.org #1795] [ bug report + tentative patch ] SSL_CTX

2008-11-28 Thread Peter Edwards
[ Not subscribed to -dev, so replying out-of-band from reading web archives - apologies for formatting foul-ups] There are two ways about this: a) either forego on the side effect and resort to a linear (slow) search/scan when the stack is unsorted (which can happen, for instance, after an ele

Hi error at compilition

2008-11-28 Thread Rustam Rakhimov
Hi for all I wrote simple example from book "Network Security with OpenSSL" when I want compile, I take error: undefined reference to `BIO_read` and not only BIO_read, all other functions which of located in header files. my environment is: CentOS 5 of course I know for some body this question