Re: LibreSSL: GOST implementation question & status

2014-07-27 Thread Dmitry Eremin-Solenikov
On Sun, Jul 27, 2014 at 11:14 PM, Miod Vallat wrote: >> First, I have a question regarding implementation of GOST public key >> cryptography. >> Is it OK to add dependency GOST => EC? It will allow me to reuse EC >> infrastructure >> for GOST public key cryptography (GOST R 34.10-2001 and -2012 us

Re: bgpctl: enlarge columns for 4-byte ASN display

2014-07-27 Thread Stuart Henderson
On 2014/07/27 17:24, Gregor Best wrote: > On Sun, Jul 27, 2014 at 03:36:06PM +0100, Stuart Henderson wrote: > > On 2014/07/27 11:15, Claudio Jeker wrote: > > > Not a big fan since this makes the bgpctl show output no longer fit 80 > > > chars and so will wrap lines on default terminals. While it is

Re: LibreSSL: GOST implementation question & status

2014-07-27 Thread Miod Vallat
> First, I have a question regarding implementation of GOST public key > cryptography. > Is it OK to add dependency GOST => EC? It will allow me to reuse EC > infrastructure > for GOST public key cryptography (GOST R 34.10-2001 and -2012 use ECC)? Yes. We aren't fond of unnecessary ifdefs, and EC

Re: bgpctl: enlarge columns for 4-byte ASN display

2014-07-27 Thread Claudio Jeker
On Sun, Jul 27, 2014 at 03:36:06PM +0100, Stuart Henderson wrote: > On 2014/07/27 11:15, Claudio Jeker wrote: > > Not a big fan since this makes the bgpctl show output no longer fit 80 > > chars and so will wrap lines on default terminals. While it is OK to > > increase the size it should be taken

string.h __POSIX_VISIBLE

2014-07-27 Thread frantisek holop
is there a reason why this check should be done twice? /usr/include/string.h:117: #if __POSIX_VISIBLE >= 200809 char*stpcpy(char *__restrict, const char *__restrict); char*stpncpy(char *__restrict, const char *__restrict, size_t); char*strndup(const char *, size_t); size_t strnlen(c

Re: [PATCH] libressl/apps: load trusted ca certificates as specified on the command line

2014-07-27 Thread Florian Zumbiehl
Hi, > Ha! Ain't this code great! You're correct that I misread it. So right > now: > * If you don't specify either option, no CAs will be available > * if you specify -CAfile and it can't be loaded, then no CAs will be > available > * if you specify -CApath and either it's the zero-length pa

Re: bgpctl: enlarge columns for 4-byte ASN display

2014-07-27 Thread Gregor Best
On Sun, Jul 27, 2014 at 03:36:06PM +0100, Stuart Henderson wrote: > On 2014/07/27 11:15, Claudio Jeker wrote: > > Not a big fan since this makes the bgpctl show output no longer fit 80 > > chars and so will wrap lines on default terminals. While it is OK to > > increase the size it should be taken

Re: bgpctl: enlarge columns for 4-byte ASN display

2014-07-27 Thread Stuart Henderson
On 2014/07/27 11:15, Claudio Jeker wrote: > Not a big fan since this makes the bgpctl show output no longer fit 80 > chars and so will wrap lines on default terminals. While it is OK to > increase the size it should be taken away from other fields in some whay. > An option would be to drop the OutQ

Re: [PATCH] libressl/apps: load trusted ca certificates as specified on the command line

2014-07-27 Thread Philip Guenther
On Sun, Jul 27, 2014 at 3:49 AM, Florian Zumbiehl wrote: > > > Is this an area where the current behavior cannot be used safely? No. > > Indeed, using CAs in circumstances where OpenSSL doesn't may create > > security issues for existing scripts using the openssl command. > > > > *If* using the

LibreSSL: GOST implementation question & status

2014-07-27 Thread Dmitry Eremin-Solenikov
Hello, First, I have a question regarding implementation of GOST public key cryptography. Is it OK to add dependency GOST => EC? It will allow me to reuse EC infrastructure for GOST public key cryptography (GOST R 34.10-2001 and -2012 use ECC)? Second. I have published a preview of cypher/message

Re: [PATCH] libressl/apps: load trusted ca certificates as specified on the command line

2014-07-27 Thread Florian Zumbiehl
Hi, [...] > Is this an area where the current behavior cannot be used safely? No. > Indeed, using CAs in circumstances where OpenSSL doesn't may create > security issues for existing scripts using the openssl command. > > *If* using the compiled in paths is correct, then I would think using the

Re: [Patch] exec(3) Manual

2014-07-27 Thread Philip Guenther
On Thu, Jul 24, 2014 at 5:30 PM, Justus Baumgartner wrote: > Add omitted reference to execvpe(). > > The second argument of execvpe() is referenced at the beginning of the > fifth paragraph, > but no mention of execvpe(). ... > The > .Fn execle > -function also specifies the environment of th

Re: [PATCH] libressl/apps: load trusted ca certificates as specified on the command line

2014-07-27 Thread Philip Guenther
On Sun, Jul 27, 2014 at 2:16 AM, Florian Zumbiehl wrote: > ping? > > > This is a fix for OpenSSL tickets #977 and #3213, loosely based on patch > from > > Reuben Thomas from #3213. > Hmm, what a mess. The "smime" and "ocsp" subcommands use an internal function setup_verify() to get the compiled

Re: bgpctl: enlarge columns for 4-byte ASN display

2014-07-27 Thread Gregor Best
On Sun, Jul 27, 2014 at 11:15:41AM +0200, Claudio Jeker wrote: > Not a big fan since this makes the bgpctl show output no longer fit 80 > chars and so will wrap lines on default terminals. > [...] Agreed, that's not good. > While it is OK to > increase the size it should be taken away from other

Re: [PATCH] libressl/apps: load trusted ca certificates as specified on the command line

2014-07-27 Thread Florian Zumbiehl
ping? > This is a fix for OpenSSL tickets #977 and #3213, loosely based on patch from > Reuben Thomas from #3213. > --- > src/apps/s_client.c |5 +++-- > src/apps/s_server.c | 10 ++ > src/apps/s_time.c |5 +++-- > 3 files changed, 12 insertions(+), 8 deletions(-) > > diff --

Re: bgpctl: enlarge columns for 4-byte ASN display

2014-07-27 Thread Claudio Jeker
Not a big fan since this makes the bgpctl show output no longer fit 80 chars and so will wrap lines on default terminals. While it is OK to increase the size it should be taken away from other fields in some whay. An option would be to drop the OutQ since that field has only limited value IMO. --