4 ms·

And my patch for OpenSSL that does the same thing: https://gist.github.com/indutny/1bda1561254f2d133b18 https://gist.github.com/indutny/1bda1561254f2d133b18 , p

by indutny 12y ago

And my patch for OpenSSL that does the same thing: https://gist.github.com/indutny/1bda1561254f2d133b18 https://gist.github.com/indutny/1bda1561254f2d133b18 , ping me on email if you want to find out how to use it in your setup.

haberman 12y ago
No disrespect meant, but from a security perspective the idea of patching security-critical software with a patch from a stranger on the Internet is kind of crazy, isn't it?
- peterwwillis 12y ago
  All open source software is made up of patches from strangers on the internet.
  - indutny 12y ago
    Indeed :) On a serious note, I'm waiting for a reviewal from OpenSSL team.
  - twistedpair 12y ago
    I think I heard that quote on XKCD once.
  - haberman 12y ago
    Not really. Gatekeepers of important open-source software are usually people who are known in the community and often employed by companies who work in the area.
- mzs 12y ago
  Though Fedor isn't just some complete stranger online.
  - haberman 12y ago
    Maybe that's the part I was missing. There was no link to more information in his (her?) HN profile.
    - mikeyouse 12y ago
      > There was no link to more information in his (her?) HN profile. 'His' apparently. I didn't know either, but apparently he was the first to crack Cloudfare's Heartbleed challenge: http://blog.cloudflare.com/the-results-of-the-cloudflare-challenge/ http://blog.cloudflare.com/the-results-of-the-cloudflare-cha... His LinkedIn / twitter for reference: https://www.linkedin.com/in/indutny https://www.linkedin.com/in/indutny https://twitter.com/indutny https://twitter.com/indutny
      - indutny 12y ago
        Let's be honest about it, this patch hasn't got any attention from OpenSSL team yet, but I heard that some people from the team are interested in it. Never got a response, but it looks correct to me.
- kyledrake 12y ago
  indutny is no stranger. Highly respected coder.
indutny 12y ago
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Here is an example of how it could be used (in my TLS terminator): https://github.com/indutny/bud/compare/master...feature/async-key-ex https://github.com/indutny/bud/compare/master...feature/asyn... Basically, if you have ever used async SSL API, you should be aware of things like: SSL_ERROR_WANT_READ SSL_ERROR_WANT_WRITE In addition to these two, my patch adds: SSL_ERROR_WANT_SIGN SSL_ERROR_WANT_RSA_DECRYPT If one of these is returned - you may get the data that should be signed/decrypted with: SSL_get_key_ex_data() SSL_get_key_ex_len() Get the key type (in case of SIGN): SSL_get_key_ex_type() // Returns EVP_PKEY_RSA, EVP_PKEY_ECC And get signature digest nid with: SSL_get_key_ex_md() Please be aware of the fact that `md` could be `NID_md5_sha1`, take a look at bud's code to figure out what should be done in this case (basically, you'll need to use raw `RSA_decrypt_private()`). After performing sign/decrypt (which could happen in other thread, or on a different server) you should call: SSL_supply_key_ex() to supply the result and continue handshake process. At this point `SSL_read()`/`SSL_write()` will start returning proper values. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJUG2D2AAoJENcGPM4Zt+iQJdoQAKZxbcGpzHFktSbU3uDocy3R fywWmqkYnoJ5jWF3xn4Excv4dAGhMfb/7tm9nt9zyV8g0Qsu8ChqWTl+kgK+hj9o mV+3jhqPDWR2VhmAC3J5ZsCpNm3IW/iNgGiU+u/k9N2i0WHjYSoTHM/NooN5GIu2 KKhNXPw1Y05yxOZWmbUInMl/uscGWDtzylRNyJpfLFFu3JDQy1sBTKD6UAZC5ERY 7LUZ1TqVdk1DPY3Tf/j4IaB9Ds9teGLGj63J8upJhDjWHibFzV5bx6X+FjknUB9M xaebV4yfHZNRHseBu2ZqTQ2f2MNnXVisdzJRX6oyYeyq872MsJjAFhbFhFTi0sTI T8Y9n8cjuctbn+zTISVyVqEEBl8udWTY1t14SJ9lNcdU3xAf9OzEBVdORpUDqFl+ zteRC145o7gs7mEtJjyBpy8mhXB3mc13ZkC2qaJIyqkqAPODu/xlqCga7oaogHNy Q2wy0HUeX69Ra0ada3TcJQgB14qESj3Uvq1hcgFk7SEXBxkU5NJ2OcItvU1+emd7 hRlQvDqiiQcK9WgsdOIKZpovtT3FswhsIy0Tv77Nx9PY04urOTEgmhPJHveCJOQq i0apvI09YgimXs4Sd5h3rs9TsKrDtG0BG0jM1zfo5zbcKE2IbMpmzOc84MxkwUSl tPV48uw46UVpu4zOOByM =zJGs -----END PGP SIGNATURE-----

by indutny 12y ago

haberman 12y ago

No disrespect meant, but from a security perspective the idea of patching security-critical software with a patch from a stranger on the Internet is kind of crazy, isn't it?

peterwwillis 12y ago
All open source software is made up of patches from strangers on the internet.
- indutny 12y ago
  Indeed :) On a serious note, I'm waiting for a reviewal from OpenSSL team.
- twistedpair 12y ago
  I think I heard that quote on XKCD once.
- haberman 12y ago
  Not really. Gatekeepers of important open-source software are usually people who are known in the community and often employed by companies who work in the area.
mzs 12y ago
Though Fedor isn't just some complete stranger online.
- haberman 12y ago
  Maybe that's the part I was missing. There was no link to more information in his (her?) HN profile.
  - mikeyouse 12y ago
    > There was no link to more information in his (her?) HN profile. 'His' apparently. I didn't know either, but apparently he was the first to crack Cloudfare's Heartbleed challenge: http://blog.cloudflare.com/the-results-of-the-cloudflare-challenge/ http://blog.cloudflare.com/the-results-of-the-cloudflare-cha... His LinkedIn / twitter for reference: https://www.linkedin.com/in/indutny https://www.linkedin.com/in/indutny https://twitter.com/indutny https://twitter.com/indutny
    - indutny 12y ago
      Let's be honest about it, this patch hasn't got any attention from OpenSSL team yet, but I heard that some people from the team are interested in it. Never got a response, but it looks correct to me.
kyledrake 12y ago
indutny is no stranger. Highly respected coder.

indutny 12y ago

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Here is an example of how it could be used (in my TLS terminator): https://github.com/indutny/bud/compare/master...feature/async-key-ex https://github.com/indutny/bud/compare/master...feature/asyn... Basically, if you have ever used async SSL API, you should be aware of things like: SSL_ERROR_WANT_READ SSL_ERROR_WANT_WRITE In addition to these two, my patch adds: SSL_ERROR_WANT_SIGN SSL_ERROR_WANT_RSA_DECRYPT If one of these is returned - you may get the data that should be signed/decrypted with: SSL_get_key_ex_data() SSL_get_key_ex_len() Get the key type (in case of SIGN): SSL_get_key_ex_type() // Returns EVP_PKEY_RSA, EVP_PKEY_ECC And get signature digest nid with: SSL_get_key_ex_md() Please be aware of the fact that `md` could be `NID_md5_sha1`, take a look at bud's code to figure out what should be done in this case (basically, you'll need to use raw `RSA_decrypt_private()`). After performing sign/decrypt (which could happen in other thread, or on a different server) you should call: SSL_supply_key_ex() to supply the result and continue handshake process. At this point `SSL_read()`/`SSL_write()` will start returning proper values. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJUG2D2AAoJENcGPM4Zt+iQJdoQAKZxbcGpzHFktSbU3uDocy3R fywWmqkYnoJ5jWF3xn4Excv4dAGhMfb/7tm9nt9zyV8g0Qsu8ChqWTl+kgK+hj9o mV+3jhqPDWR2VhmAC3J5ZsCpNm3IW/iNgGiU+u/k9N2i0WHjYSoTHM/NooN5GIu2 KKhNXPw1Y05yxOZWmbUInMl/uscGWDtzylRNyJpfLFFu3JDQy1sBTKD6UAZC5ERY 7LUZ1TqVdk1DPY3Tf/j4IaB9Ds9teGLGj63J8upJhDjWHibFzV5bx6X+FjknUB9M xaebV4yfHZNRHseBu2ZqTQ2f2MNnXVisdzJRX6oyYeyq872MsJjAFhbFhFTi0sTI T8Y9n8cjuctbn+zTISVyVqEEBl8udWTY1t14SJ9lNcdU3xAf9OzEBVdORpUDqFl+ zteRC145o7gs7mEtJjyBpy8mhXB3mc13ZkC2qaJIyqkqAPODu/xlqCga7oaogHNy Q2wy0HUeX69Ra0ada3TcJQgB14qESj3Uvq1hcgFk7SEXBxkU5NJ2OcItvU1+emd7 hRlQvDqiiQcK9WgsdOIKZpovtT3FswhsIy0Tv77Nx9PY04urOTEgmhPJHveCJOQq i0apvI09YgimXs4Sd5h3rs9TsKrDtG0BG0jM1zfo5zbcKE2IbMpmzOc84MxkwUSl tPV48uw46UVpu4zOOByM =zJGs -----END PGP SIGNATURE-----