<html><head></head><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:14px"><div id="yui_3_16_0_1_1490689226812_3057"><span id="yui_3_16_0_1_1490689226812_3442">Dear friends,</span></div><div id="yui_3_16_0_1_1490689226812_3296"><br><span></span></div><div id="yui_3_16_0_1_1490689226812_3322"><span id="yui_3_16_0_1_1490689226812_3486">Someone can tell me what function is called for retrieve public key from x509 cert? in the case of EC public key? <br></span></div><div id="yui_3_16_0_1_1490689226812_3522"><br><span id="yui_3_16_0_1_1490689226812_3486"></span></div><div id="yui_3_16_0_1_1490689226812_3561"><span id="yui_3_16_0_1_1490689226812_3486">Best regards.</span></div> <div class="qtdSeparateBR"><br><br></div><div style="display: block;" class="yahoo_quoted"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 14px;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div dir="ltr"><font face="Arial" size="2"> Il Lunedì 27 Marzo 2017 10:26, "openssl-users-request@openssl.org" <openssl-users-request@openssl.org> ha scritto:<br></font></div> <br><br> <div class="y_msg_container"><div dir="ltr">Send openssl-users mailing list submissions to<br></div><div dir="ltr"> <a ymailto="mailto:openssl-users@openssl.org" href="mailto:openssl-users@openssl.org">openssl-users@openssl.org</a><br></div><div dir="ltr"><br></div><div dir="ltr">To subscribe or unsubscribe via the World Wide Web, visit<br></div><div dir="ltr"> <a href="https://mta.openssl.org/mailman/listinfo/openssl-users" target="_blank">https://mta.openssl.org/mailman/listinfo/openssl-users</a><br></div><div dir="ltr">or, via email, send a message with subject or body 'help' to<br></div><div dir="ltr"> <a ymailto="mailto:openssl-users-request@openssl.org" href="mailto:openssl-users-request@openssl.org">openssl-users-request@openssl.org</a><br></div><div dir="ltr"><br></div><div dir="ltr">You can reach the person managing the list at<br></div><div dir="ltr"> <a ymailto="mailto:openssl-users-owner@openssl.org" href="mailto:openssl-users-owner@openssl.org">openssl-users-owner@openssl.org</a><br></div><div dir="ltr"><br></div><div dir="ltr">When replying, please edit your Subject line so it is more specific<br></div><div dir="ltr">than "Re: Contents of openssl-users digest..."<br></div><div dir="ltr"><br></div><div dir="ltr"><br></div><div dir="ltr">Today's Topics:<br></div><div dir="ltr"><br></div><div dir="ltr"> 1. SSL cipher list to disable TLS 1.0 & TLS 1.1 (Hema Murthy)<br></div><div dir="ltr"> 2. In ssl3_write_bytes, some checks related to hanlding write<br></div><div dir="ltr"> failure are missing (Raja ashok)<br></div><div dir="ltr"><br></div><div dir="ltr"><br></div><div dir="ltr">----------------------------------------------------------------------<br></div><div dir="ltr"><br></div><div dir="ltr">Message: 1<br></div><div dir="ltr">Date: Mon, 27 Mar 2017 11:59:16 +0530<br></div><div dir="ltr">From: Hema Murthy <<a ymailto="mailto:chintuhema@gmail.com" href="mailto:chintuhema@gmail.com">chintuhema@gmail.com</a>><br></div><div dir="ltr">To: <a ymailto="mailto:openssl-users@openssl.org" href="mailto:openssl-users@openssl.org">openssl-users@openssl.org</a><br></div><div dir="ltr">Subject: [openssl-users] SSL cipher list to disable TLS 1.0 & TLS 1.1<br></div><div dir="ltr">Message-ID:<br></div><div dir="ltr"> <<a ymailto="mailto:CACWQscaOQt0zX9jm8ydTPTq9Joym3UtUrHyrfd9ggLds2UdQfg@mail.gmail.com" href="mailto:CACWQscaOQt0zX9jm8ydTPTq9Joym3UtUrHyrfd9ggLds2UdQfg@mail.gmail.com">CACWQscaOQt0zX9jm8ydTPTq9Joym3UtUrHyrfd9ggLds2UdQfg@mail.gmail.com</a>><br></div><div dir="ltr">Content-Type: text/plain; charset="utf-8"<br></div><div dir="ltr"><br></div><div dir="ltr">Hi,<br></div><div dir="ltr"><br></div><div dir="ltr">My system is<br></div><div dir="ltr"><br></div><div dir="ltr">FreeBSD 10.2<br></div><div dir="ltr"><br></div><div dir="ltr">OpenSSL 1.0.2h<br></div><div dir="ltr"><br></div><div dir="ltr">lighttpd :lighttpd-1.4.23<br></div><div dir="ltr"><br></div><div dir="ltr">Am trying to disable TLS1.0 and TLS1.1 through lighttpd.conf<br></div><div dir="ltr"><br></div><div dir="ltr">but am not sure of what is the equivalent cipher list to be used.<br></div><div dir="ltr"><br></div><div dir="ltr">I followed the below link and it didnt work for me.<br></div><div dir="ltr"><br></div><div dir="ltr">In case of Appweb Server,I was able to successfully disable TLS1.0 & Above<br></div><div dir="ltr">and TLS1.1 & Above using<br></div><div dir="ltr"><br></div><div dir="ltr">SSLProtocol = "ALL -SSLV2 -SSLV3 -TLSV1"<br></div><div dir="ltr"><br></div><div dir="ltr">SSLProtocol = "ALL -SSLV2 -SSLV3 -TLSV1.1"<br></div><div dir="ltr"><br></div><div dir="ltr"><br></div><div dir="ltr"><br></div><div dir="ltr">But the same cipher is not working for lighttpd.<br></div><div dir="ltr"><br></div><div dir="ltr">Am very new to this and do not know how to proceed further.<br></div><div dir="ltr"><br></div><div dir="ltr">Would be great and appreciate if anyone can give me pointers on this.<br></div><div dir="ltr"><br></div><div dir="ltr">Please help.<br></div><div dir="ltr"><br></div><div dir="ltr"><br></div><div dir="ltr"><br></div><div dir="ltr">Thanks & Regards,<br></div><div dir="ltr"><br></div><div dir="ltr">Hema<br></div><div dir="ltr">-------------- next part --------------<br></div><div dir="ltr">An HTML attachment was scrubbed...<br></div><div dir="ltr">URL: <<a href="http://mta.openssl.org/pipermail/openssl-users/attachments/20170327/02b8fb3b/attachment-0001.html" target="_blank">http://mta.openssl.org/pipermail/openssl-users/attachments/20170327/02b8fb3b/attachment-0001.html</a>><br></div><div dir="ltr"><br></div><div dir="ltr">------------------------------<br></div><div dir="ltr"><br></div><div dir="ltr">Message: 2<br></div><div dir="ltr">Date: Mon, 27 Mar 2017 08:25:16 +0000<br></div><div dir="ltr">From: Raja ashok <<a ymailto="mailto:raja.ashok@huawei.com" href="mailto:raja.ashok@huawei.com">raja.ashok@huawei.com</a>><br></div><div dir="ltr">To: "<a ymailto="mailto:openssl-users@openssl.org" href="mailto:openssl-users@openssl.org">openssl-users@openssl.org</a>" <<a ymailto="mailto:openssl-users@openssl.org" href="mailto:openssl-users@openssl.org">openssl-users@openssl.org</a>>,<br></div><div dir="ltr"> "<a ymailto="mailto:openssl-dev@openssl.org" href="mailto:openssl-dev@openssl.org">openssl-dev@openssl.org</a>" <<a ymailto="mailto:openssl-dev@openssl.org" href="mailto:openssl-dev@openssl.org">openssl-dev@openssl.org</a>><br></div><div dir="ltr">Subject: [openssl-users] In ssl3_write_bytes, some checks related to<br></div><div dir="ltr"> hanlding write failure are missing<br></div><div dir="ltr">Message-ID: <<a ymailto="mailto:FDFEA8C9B9B6BD4685DCC959079C81F5E19315C4@blreml509-mbx" href="mailto:FDFEA8C9B9B6BD4685DCC959079C81F5E19315C4@blreml509-mbx">FDFEA8C9B9B6BD4685DCC959079C81F5E19315C4@blreml509-mbx</a>><br></div><div dir="ltr">Content-Type: text/plain; charset="gb2312"<br></div><div dir="ltr"><br></div><div dir="ltr">Hi,<br></div><div dir="ltr"><br></div><div dir="ltr">I feel there is a check missing in ssl3_write_bytes, in case of handling write failure.<br></div><div dir="ltr"><br></div><div dir="ltr">Consider SSL_write is called with 20000 bytes buffer, then internally in ssl3_write_bytes we try to send it as two record (16384 and 3616). If TCP send failed for the second record then we store the states internally (wnum, wpend_tot and wpend_buf) and return back the result.<br></div><div dir="ltr"><br></div><div dir="ltr">Later application has to call SSL_write with same buffer, if it calls with different buffer of length 100 byte then we fail that in ssl3_write_bytes using the check (len < tot).<br></div><div dir="ltr"><br></div><div dir="ltr">But consider application calls with buffer of size 18000 bytes and SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER is enabled. Then (len < tot) will not succeed as tot is 16384. Then it will call ssl3_write_pending to send the remaining 3616 record. If it succeeds we are incrementing tot, (tot += i). Now tot will have 20000.<br></div><div dir="ltr"><br></div><div dir="ltr">Later there is a check (tot == len), this will not succeed. Then directly we are doing n = (len - tot), this will overflow and store a value close to 2^32 in n. Then it will cause out of bound access to the application buffer "buf".<br></div><div dir="ltr"><br></div><div dir="ltr">I hope we should have one more check (len < (tot + s->s3->wpend_tot)) before calling ssl3_write_pending.<br></div><div dir="ltr"><br></div><div dir="ltr"> if ((len < tot) || (len < (tot + s->s3->wpend_tot))){<br></div><div dir="ltr"> SSLerr(SSL_F_SSL3_WRITE_BYTES, SSL_R_BAD_LENGTH);<br></div><div dir="ltr"> return (-1);<br></div><div dir="ltr">}<br></div><div dir="ltr"><br></div><div dir="ltr">Note : I am referring 1.0.2k version of OpenSSL.<br></div><div dir="ltr"><br></div><div dir="ltr">Regards,<br></div><div dir="ltr">Ashok<br></div><div dir="ltr"><br></div><div dir="ltr">________________________________<br></div><div dir="ltr">[Company_logo]<br></div><div dir="ltr"><br></div><div dir="ltr">Raja Ashok V K<br></div><div dir="ltr">Huawei Technologies<br></div><div dir="ltr">Bangalore, India<br></div><div dir="ltr"><a href="http://www.huawei.com/" target="_blank">http://www.huawei.com</a><br></div><div dir="ltr">________________________________<br></div><div dir="ltr">????????????????????????????????????????<br></div><div dir="ltr">????????????????????????????????????????<br></div><div dir="ltr">???????????????????????????????????<br></div><div dir="ltr">This e-mail and its attachments contain confidential information from HUAWEI, which<br></div><div dir="ltr">is intended only for the person or entity whose address is listed above. Any use of the<br></div><div dir="ltr">information contained herein in any way (including, but not limited to, total or partial<br></div><div dir="ltr">disclosure, reproduction, or dissemination) by persons other than the intended<br></div><div dir="ltr">recipient(s) is prohibited. If you receive this e-mail in error, please notify the sender by<br></div><div dir="ltr">phone or email immediately and delete it!<br></div><div dir="ltr"><br></div><div dir="ltr">-------------- next part --------------<br></div><div dir="ltr">An HTML attachment was scrubbed...<br></div><div dir="ltr">URL: <<a href="http://mta.openssl.org/pipermail/openssl-users/attachments/20170327/e8f3d72a/attachment.html" target="_blank">http://mta.openssl.org/pipermail/openssl-users/attachments/20170327/e8f3d72a/attachment.html</a>><br></div><div dir="ltr">-------------- next part --------------<br></div><div dir="ltr">A non-text attachment was scrubbed...<br></div><div dir="ltr">Name: image001.jpg<br></div><div dir="ltr">Type: image/jpeg<br></div><div dir="ltr">Size: 6737 bytes<br></div><div dir="ltr">Desc: image001.jpg<br></div><div dir="ltr">URL: <<a href="http://mta.openssl.org/pipermail/openssl-users/attachments/20170327/e8f3d72a/attachment.jpg" target="_blank">http://mta.openssl.org/pipermail/openssl-users/attachments/20170327/e8f3d72a/attachment.jpg</a>><br></div><div dir="ltr"><br></div><div dir="ltr">------------------------------<br></div><div dir="ltr"><br></div><div dir="ltr">Subject: Digest Footer<br></div><div dir="ltr"><br></div><div dir="ltr">_______________________________________________<br></div><div dir="ltr">openssl-users mailing list<br></div><div dir="ltr"><a ymailto="mailto:openssl-users@openssl.org" href="mailto:openssl-users@openssl.org">openssl-users@openssl.org</a><br></div><div dir="ltr"><a href="https://mta.openssl.org/mailman/listinfo/openssl-users" target="_blank">https://mta.openssl.org/mailman/listinfo/openssl-users</a><br></div><div dir="ltr"><br></div><div dir="ltr"><br></div><div dir="ltr">------------------------------<br></div><div dir="ltr"><br></div><div dir="ltr">End of openssl-users Digest, Vol 28, Issue 35<br></div><div dir="ltr">*********************************************<br></div><br><br></div> </div> </div> </div></div></body></html>