openssl-users Digest, Vol 95, Issue 27

rsbecker rsbecker at nexbridge.com
Sun Oct 23 13:56:37 UTC 2022


--Randall S. BeckerNexbridge Inc.
-------- Original message --------From: רונן לוי <levyron77 at gmail.com> Date: 2022-10-23  09:26  (GMT-05:00) To: openssl-users at openssl.org, Michael Wojcik <Michael.Wojcik at microfocus.com> Subject: Re: openssl-users Digest, Vol 95, Issue 27 Subject: Porting OpenSSL to vxWorks (using cygwin)Hi Michael,- Why are you trying to build OpenSSL?My objective is to sign an 'image.bin' with RSA2048 and verify the signature.I managed to build OpenSSL on linux and test the signature and verification with RSA2048 (private & public keys).Now, I would like to port it to vxWorks 7. -
 Why did you clone the GitHub repository rather than downloading one of 
the released source tarballs? Did you read the instructions on www.openssl.org on how to download OpenSSL source releases?git clone https://github.com/openssl/openssl.gitA: If there an l'ibOpenssl.a'  static library for vxWorks, then there would be no reason to build the OpenSSL. Is there? A:
 If there was on option to use Only the verify signature module, then I 
would just compile this module and not the entire OpenSSL. Is there an 
option?- What platform do you want to build OpenSSL for?A: vxWorks-7, the toolchain is windows exe files (gcc,ar,ld), thus the only option I had in mind to build the OpenSSL is cygwin.-
 What toolchain do you want to use, and if that's not the default 
toolchain for that platform, why aren't you using the default?A: I have vxWorks toolchain, on windows platform. (It definitely be easier if I had the vxWorks toochain on Linux, but I don't)- Have you read the text files in the top-level directory of the OpenSSL source distribution?Please
 direct me to the relevant README on "how to build OpenSSL on vxWorks" 
(or similar platform, in which all is needed is to inject the relevant 
toochaini.e. perl Configure VxWorks)There
 may well be an easier way to accomplish whatever your goal is. OpenSSL 
may not even be a particularly good solution for you. You haven't given 
us enough information to go on.A: For the long run, I consider to use OpenSSL features on Linux and VxWorks‫בתאריך יום ה׳, 20 באוק׳ 2022 ב-8:27 מאת <‪openssl-users-request at openssl.org‬‏>:‬Send openssl-users mailing list submissions to
        openssl-users at openssl.org

To subscribe or unsubscribe via the World Wide Web, visit
        https://mta.openssl.org/mailman/listinfo/openssl-users
or, via email, send a message with subject or body 'help' to
        openssl-users-request at openssl.org

You can reach the person managing the list at
        openssl-users-owner at openssl.org

When replying, please edit your Subject line so it is more specific
than "Re: Contents of openssl-users digest..."


Today's Topics:

   1. RE: openssl-users Digest, Vol 95, Issue 24 (Michael Wojcik)
   2. OpenSSL 1.1.1 Windows dependencies (David Harris)
   3. libproviders.so file not found (Gahlot, Ashish Kumar)


----------------------------------------------------------------------

Message: 1
Date: Wed, 19 Oct 2022 20:30:07 +0000
From: Michael Wojcik <Michael.Wojcik at microfocus.com>
To: "openssl-users at openssl.org" <openssl-users at openssl.org>
Subject: RE: openssl-users Digest, Vol 95, Issue 24
Message-ID:
        <DM6PR18MB2700C12C0C4C8A7778312669F92B9 at DM6PR18MB2700.namprd18.prod.outlook.com>

Content-Type: text/plain; charset="utf-8"

> From: openssl-users <openssl-users-bounces at openssl.org> On Behalf Of ???? ???
> Sent: Tuesday, 18 October, 2022 11:58

> I have downloaded perl strawberry, but I have no clue how to get rid of the
> built-in perl that comes in cygwin, and point cygwin to use the strawberry perl.

You don't have to remove the Cygwin version of perl, just change your PATH. This is basic both to the various shells available under Cygwin and to the Windows command line, so I'm getting the impression that you're not very familiar with your operating environment. That's not an ideal place to start from when trying to build, much less use, OpenSSL.

I can't be more detailed because at this point I frankly don't understand what you're trying to do. I suggest you try asking the right question, in a useful manner. (See https://catb.org/esr/faqs/smart-questions for advice in how to ask the right question.)

In particular:

- Why are you trying to build OpenSSL?
- Why did you clone the GitHub repository rather than downloading one of the released source tarballs? Did you read the instructions on www.openssl.org on how to download OpenSSL source releases?
- What platform do you want to build OpenSSL for?
- What toolchain do you want to use, and if that's not the default toolchain for that platform, why aren't you using the default?
- Have you read the text files in the top-level directory of the OpenSSL source distribution?

There may well be an easier way to accomplish whatever your goal is. OpenSSL may not even be a particularly good solution for you. You haven't given us enough information to go on.

-- 
Michael Wojcik

------------------------------

Message: 2
Date: Thu, 20 Oct 2022 13:54:19 +1300
From: "David Harris" <openssl at pmail.gen.nz>
To: Openssl-users at openssl.org
Subject: OpenSSL 1.1.1 Windows dependencies
Message-ID: <63509C3B.16160.7FF0516A at openssl.pmail.gen.nz>
Content-Type: text/plain; charset=US-ASCII

Up front, I'd like to apologize if this is an FAQ or has been answered elsewhere 
on this list: my workload means that I simply can't keep as up-to-date as I would 
like.

I have a situation where my application fails to accept an incoming SSL 
handshake on Windows Server 2012, but the identical software running on 
Server 2019 accepts the same connection from the same remote client without 
a problem. Other types of client software (such as Thunderbird) connect to 
either system without any problems. The connecting client is a Windows Cash 
Register using Window's built-in crypto facilities. If I downgrade my app to 
OpenSSL 1.1.1g or earlier, the problem doesn't happen. With 1.1.1k or 1.1.1q, I 
get the error (I haven't built any versions of OpenSSL between k and q). In case 
it helps, the connection is an incoming SMTP connection on port 587, and 
STARTTLS is used to begin SSL negotiation.

SSL_accept returns -1, with an extended error of "SSL_ERROR_SYSCALL" (5), 
which I understand to be largely what it returns when it doesn't have a clear idea 
of what's gone wrong. The error queue is completely empty in this situation. The 
cert is a LetsEncrypt cert that loads without errors and works fine with other 
clients.

Do recent versions of OpenSSL 1.1.1 have dependencies on some Windows 
facility (winsock and wincrypt seem likely candidates) that might work on Server 
2019 but fail on Server 2012?

The version of my application that is in public release uses 1.1.1g, so isn't 
affected by this issue, but I'm slightly worried that I'm going to see an uptick in 
this type of problem if I release builds based on later versions of 1.1.1.

Does this ring any bells with anyone? Again, apologies if this is answered 
elsewhere - I *did* spend some time in Google but couldn't find anything that 
seemed relevant.

Thanks in advance for any advice.

Cheers!

-- David --



------------------------------

Message: 3
Date: Thu, 20 Oct 2022 05:26:44 +0000
From: "Gahlot, Ashish Kumar" <Ashish-Kumar.Gahlot at rbbn.com>
To: "openssl-users at openssl.org" <openssl-users at openssl.org>
Subject: libproviders.so file not found
Message-ID:
        <PH0PR03MB635059BBC134956637C23831DB2A9 at PH0PR03MB6350.namprd03.prod.outlook.com>

Content-Type: text/plain; charset="iso-8859-1"

Hi everyone,

I'm trying to enable fips provider in openssl3 by writing the following lines into openssl.cnf file:

openssl_conf = openssl_init

.include fipsmodule.cnf

[openssl_init]
providers = provider_sect

[provider_sect]
fips = fips_sect
base = base_sect

[base_sect]
activate = 1

Now when it is enabled, there is an error in syslog that libproviders.so file not found:

DSO support routines:dlfcn_load:could not load the shared library:crypto/dso/dso_dlfcn.c:118:filename(libproviders.so): libproviders.so: cannot open shared object file: No such file or directory
140666570000192:error:25070067:DSO support routines:DSO_load:could not load the shared library:crypto/dso/dso_lib.c:162:
140666570000192:error:0E07506E:configuration file routines:module_load_dso:error loading dso:crypto/conf/conf_mod.c:224:module=providers, path=providers
140666570000192:error:0E076071:configuration file routines:module_run:unknown module name:crypto/conf/conf_mod.c:165:module=providers

And this seems to be a common issue in openssl3. I have seen solutions like commenting out provider_sect but I think I would need it to enable fips provider. Is there any working solution for this?

Thank you,
Ashish

Notice: This e-mail together with any attachments may contain information of Ribbon Communications Inc. and its Affiliates that is confidential and/or proprietary for the sole use of the intended recipient. Any review, disclosure, reliance or distribution by others or forwarding without express permission is strictly prohibited. If you are not the intended recipient, please notify the sender immediately and then delete all copies, including any attachments.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mta.openssl.org/pipermail/openssl-users/attachments/20221020/7e2aa763/attachment.htm>

------------------------------

Subject: Digest Footer

_______________________________________________
openssl-users mailing list
openssl-users at openssl.org
https://mta.openssl.org/mailman/listinfo/openssl-users


------------------------------

End of openssl-users Digest, Vol 95, Issue 27
*********************************************

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mta.openssl.org/pipermail/openssl-users/attachments/20221023/173a027b/attachment-0001.htm>


More information about the openssl-users mailing list