Re: {hash}-x86_64.pl assembly scripts just too fragile

2012-03-10 Thread Andy Polyakov
Also from win32's asm build, all of the script invocations forgot to include the nasm/masm(ml64) command line arg... What does it mean exactly? I'll get you a patch shortly, but in short, it meant that do_amd64 was emitting an ntdll.mak line to invoke sha1-x86_64.pl but didn't add the nasm

Re: FINGERPRINT_premain not called?

2012-03-10 Thread Andy Polyakov
While investigating this I realized I did not really know when FINGERPRINT_premain is supposed to be called. With my small app I see it get called when I execute the app (because I stuck some debug printfs in fips_premain.c). But with the main app - which is called by some system startup

Re: [openssl.org #2751] [ENHANCEMENT] Request moving static get_issuer_sk before X509_verify_cert

2012-03-10 Thread Kevin Vargo
- Original Message - From: Stephen Henson via RT r...@openssl.org To: var...@yahoo.com Cc: openssl-dev@openssl.org Sent: Saturday, March 3, 2012 8:31 AM Subject: [openssl.org #2751] [ENHANCEMENT] Request moving static get_issuer_sk before X509_verify_cert   [var...@yahoo.com -

[openssl.org #2757] iana tls extension types

2012-03-10 Thread Peter Sylvester via RT
apps/s_cb.c does not list all known tls extension types when tlsextdebug is used (not even all supported one). this patch adds missing extension types currently defined by iana to ssl/tls1 and sapps/s_cb.c the definitions are reordered. the patch work for 1.0.1-beta3 and the two snapshots of

[openssl.org #2758] Bug in use of CRYPTO_ex_data

2012-03-10 Thread Kenny Root via RT
In crypto/ex_data.c there is a function called int_dup_ex_data which calls the ex_data's dup_func. However, the prototype for the dup_func only has void* ptr instead of void** ptr It appears that the for loop should either continue if the ex_data has a dup_func (without the subsequent call to

Re: FINGERPRINT_premain not called?

2012-03-10 Thread Kevin Fowler
Thanks Andy, helpful as always. Is incore part of the validation, or is it like fipsld - allowed to be modified as needed without invalidating FIPS certification? Kevin On Sat, Mar 10, 2012 at 3:44 AM, Andy Polyakov ap...@openssl.org wrote: While investigating this I realized I did not really