Re: [openssl-users] API SSL_Connect fails and always returns SSL_ERROR_WANT_READ causes infinite loop in application

2017-11-21 Thread mahesh gs
; Matt > > > On 21/11/17 08:53, mahesh gs wrote: > > Hi, > > > > We were able to further localize this problem and found the problem is > > with the function "BIO_dgram_sctp_wait_for_dry". In this function after > > enabling the "sctp_sender_dry_e

Re: [openssl-users] API SSL_Connect fails and always returns SSL_ERROR_WANT_READ causes infinite loop in application

2017-11-21 Thread mahesh gs
Current version of openssl we are using is 01.01.00g. We have tested and able to reproduce this issue with the OPENSSL 01.00.02k version that is packaged with RHEL 7.4 as well. Thanks, Mahesh G S On Mon, Nov 20, 2017 at 4:42 PM, mahesh gs wrote: > Hi Matt, > > Thanks for the response.

Re: [openssl-users] API SSL_Connect fails and always returns SSL_ERROR_WANT_READ causes infinite loop in application

2017-11-20 Thread mahesh gs
rs "read_state_machine" where alert is to be red.This causes SSL_Connect to be in infinite loop. Thanks, Mahesh G S On Fri, Nov 17, 2017 at 3:36 PM, Matt Caswell wrote: > > > On 17/11/17 06:42, mahesh gs wrote: > > Why > > does client respond with "Client key exc

Re: [openssl-users] API SSL_Connect fails and always returns SSL_ERROR_WANT_READ causes infinite loop in application

2017-11-16 Thread mahesh gs
the the handshake failure alert is sent from server? Openssl version used is 01.01.00g. I am also attaching the latest pcap file for your reference. On Tue, Nov 14, 2017 at 4:35 PM, Matt Caswell wrote: > > > On 14/11/17 10:44, mahesh gs wrote: > > > case SSL_ERROR_SYSCALL: > >

Re: [openssl-users] API SSL_Connect fails and always returns SSL_ERROR_WANT_READ causes infinite loop in application

2017-11-14 Thread mahesh gs
elect(nfds + 1, NULL, &writeFds, NULL, &timeout); if (retValue <= 0) { // Timeout or error just return failure return false; } } return true; } Thanks, Mahesh G S On Tue, Nov 14, 2017 at 4:01 PM, Graham Leggett wrote: > On 14 Nov 2017, at 12:00 PM, mahesh gs wrote: > >

[openssl-users] API SSL_Connect fails and always returns SSL_ERROR_WANT_READ causes infinite loop in application

2017-11-14 Thread mahesh gs
Hi All, We have application that provide DTLS security for SCTP connections. During our testing we found that API "*SSL_connect* " fail and always returns SSL_ERROR_WANT_READ which causes infinite loop in the application. Scenario: 1) On Server side "Client Certificate Request" is enabled by set

[openssl-users] Graceful shutdown of TLS connection for blocking sockets

2017-10-05 Thread mahesh gs
Hi All, I have query regarding the SSL_read on blocking socket. How to come out of blocking SSL_read when we have to close the connection ? As per the documentation SSL_read will only return if there is any data or an error occurred. "If the underlying BIO is *blocking*, SSL_read() will only re

[openssl-users] Query regarding the SCTP events for DTLS connections

2017-09-28 Thread mahesh gs
Hi, We have an application which has SCTP connections we have secured the SCTP connections using the openssl DTLS. DTLS is working as expected other than the SCTP events. We use the API "BIO_new_dgram_sctp" to create a BIO objects and we register a callback function to openssl using API "BIO_dgra

[openssl-users] SSL_CTX_set_cipher_list returns failure for DHE-DSS-AES256-GCM-SHA384

2017-09-05 Thread mahesh gs
Hi All, I am using openssl version 01.01.00f for providing TLS and DTLS security for TCP and SCTP connection for our application. I have query regarding the "Ciphers" that are accepted by the SSL_CTX_set_cpiher_list API. The list of ciphers that are supported by openssl version 01.01.00f that is o

[openssl-users] Existing connections on certification expires

2017-08-27 Thread mahesh gs
Hello All, We are using openssl for providing the secured communication for our application. I have some basic queries about the openssl behaviour. 1) What happens to the existing SSL connections on certification expiry? Does the openssl disconnects the existing connection? 2) How can i get the

Re: [openssl-users] Query regarding MSG_NOSIGNAL with SSL_Write

2017-05-02 Thread mahesh gs
On Tue, May 2, 2017 at 2:36 PM, Matt Caswell wrote: > > > On 02/05/17 06:59, mahesh gs wrote: > > Hi Matt, > > > > Sorry for delayed response. I was on leave. > > > > Yes, ours is a library and we do not wish to ignore the signal process > > wide bec

Re: [openssl-users] Query regarding DTLS handshake

2017-05-01 Thread mahesh gs
On Sun, Apr 30, 2017 at 11:11 PM, Michael Tuexen < michael.tue...@lurchi.franken.de> wrote: > > On 20. Apr 2017, at 20:01, mahesh gs wrote: > > > > Hi, > > > > This issue occur purely based on the time (sequence of events) at which > SSL read_sta

Re: [openssl-users] Query regarding MSG_NOSIGNAL with SSL_Write

2017-05-01 Thread mahesh gs
, Matt Caswell wrote: > > > On 27/04/17 11:56, mahesh gs wrote: > > Hi, > > > > We are using Openssl for establish a secure communications for both > > TCP/SCTP connections. > > > > In our application it is possible that remote end forceful

[openssl-users] Query regarding MSG_NOSIGNAL with SSL_Write

2017-04-27 Thread mahesh gs
Hi, We are using Openssl for establish a secure communications for both TCP/SCTP connections. In our application it is possible that remote end forcefully disconnect the connection due to which SSL_Write raises a SIGPIPE which we want to suppress. Does openssl provide any way to set MSG_NOSIGNA

Re: [openssl-users] Query regarding DTLS handshake

2017-04-20 Thread mahesh gs
(at least I am assuming this is the same issue): > > https://github.com/openssl/openssl/issues/3251 > > Matt > > > On 18/04/17 21:17, Michael Tuexen wrote: > >> On 13. Apr 2017, at 11:11, mahesh gs wrote: > >> > >> Hi, > >> > >> We are

[openssl-users] Query regarding DTLS handshake

2017-04-13 Thread mahesh gs
Hi, We are running SCTP connections with DTLS enabled in our application. We have adapted openssl version (openssl-1.1.0e) to achieve the same. We have generated the self signed root and node certificates for testing. We have a strange problem with the incomplete DTLS handshake if we run the DTLS

Re: [openssl-users] DTLS for SCTP connections

2017-02-24 Thread mahesh gs
support. On Thu, Feb 23, 2017 at 10:43 AM, mahesh gs wrote: > Hi Michael, > > I am using "Red Hat Enterprise Linux Server release 6.4 (Santiago)" and > openssl version is 1.1.0. > > SCTP version : > > [root@localhost DIAMETER]# rpm -qa | grep -i "sc

Re: [openssl-users] DTLS for SCTP connections

2017-02-22 Thread mahesh gs
Thanks, Mahesh G S On Wed, Feb 22, 2017 at 8:33 PM, Michael Tuexen < michael.tue...@lurchi.franken.de> wrote: > > On 22 Feb 2017, at 07:47, mahesh gs wrote: > > > > Hi, > > > > Thank you for sharing the sample code. > > > > I tried running SCTP DTLS

Re: [openssl-users] DTLS for SCTP connections

2017-02-21 Thread mahesh gs
echo -L 16.181.38.161 -p 4443 -l 50 -n 5 16.181.38.161 Thanks in advance for your valuable input Regards, Mahesh G S On Tue, Feb 21, 2017 at 2:28 PM, Michael Tuexen < michael.tue...@lurchi.franken.de> wrote: > > On 21 Feb 2017, at 09:53, mahesh gs wrote: > > > > Hi, > > >

[openssl-users] DTLS for SCTP connections

2017-02-21 Thread mahesh gs
Hi, We have a client, server applications that is using SCTP as a transport protocol. We have to secure the connections using DTLS. I am using openssl version 1.0.2 which supports DTLS. But the problem i am facing is usage of DTLS SCTP related API's. Openssl documentation does not clearly explain