<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;"><div>Hi Sergey,</div><div> Are you also looking to have a fix for the POODLE vulnerability?</div><div><br></div><div>Thanks,</div><div>Jagannath</div><div><br></div><span id="OLK_SRC_BODY_SECTION"><div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt"><span style="font-weight:bold">From: </span> Sergey Kandaurov <<a href="mailto:pluknet@nginx.com">pluknet@nginx.com</a>><br><span style="font-weight:bold">Reply-To: </span> "<a href="mailto:nginx-devel@nginx.org">nginx-devel@nginx.org</a>" <<a href="mailto:nginx-devel@nginx.org">nginx-devel@nginx.org</a>><br><span style="font-weight:bold">Date: </span> Wednesday, October 29, 2014 at 11:39 PM<br><span style="font-weight:bold">To: </span> "<a href="mailto:nginx-devel@nginx.org">nginx-devel@nginx.org</a>" <<a href="mailto:nginx-devel@nginx.org">nginx-devel@nginx.org</a>><br><span style="font-weight:bold">Subject: </span> Re: [PATCH] SSL: make ssl_password_file work with recent OpenSSL releases<br></div><div><br></div><div><div><div>On Oct 28, 2014, at 12:38 AM, Piotr Sikora <<a href="mailto:piotr@cloudflare.com">piotr@cloudflare.com</a>> wrote:</div><blockquote id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE" style="BORDER-LEFT: #b5c4df 5 solid; PADDING:0 0 0 5; MARGIN:0 0 0 5;"><div> Also, I think that PKCS#12 support should be added in a separate</div><div> commit, instead of mixing it with semi-related fix.</div></blockquote><div><br></div><div>How so? It is not about adding error handling support for yet another format,</div><div>because it was already there but was broken for the same reason after 1.0.1j.</div><div><br></div><div>Below is an updated patch with fixed header inclusion I’d like to commit.</div><div><br></div><div># HG changeset patch</div><div># User Piotr Sikora <<a href="mailto:piotr@cloudflare.com">piotr@cloudflare.com</a>></div><div># Date 1414150080 25200</div><div># Fri Oct 24 04:28:00 2014 -0700</div><div># Node ID 8316cb9139f5f5b0fb39969006d68708f22f312d</div><div># Parent 973fded4f461f3a397779b3a1dc80881b1b34974</div><div>SSL: make ssl_password_file work with recent OpenSSL releases.</div><div><br></div><div>Multiple passwords in a single ssl_password_file feature was broken after</div><div>recent OpenSSL changes (commit 4aac102f75b517bdb56b1bcfd0a856052d559f6e).</div><div><br></div><div>Affected OpenSSL releases: 0.9.8zc, 1.0.0o, 1.0.1j and 1.0.2-beta3.</div><div><br></div><div>Signed-off-by: Piotr Sikora <<a href="mailto:piotr@cloudflare.com">piotr@cloudflare.com</a>></div><div><br></div><div>diff -r 973fded4f461 -r 8316cb9139f5 src/event/ngx_event_openssl.c</div><div>--- a/src/event/ngx_event_openssl.c<span class="Apple-tab-span" style="white-space:pre"> </span>Wed Oct 15 22:57:23 2014 +0400</div><div>+++ b/src/event/ngx_event_openssl.c<span class="Apple-tab-span" style="white-space:pre"> </span>Fri Oct 24 04:28:00 2014 -0700</div><div>@@ -410,8 +410,12 @@ ngx_ssl_certificate(ngx_conf_t *cf, ngx_</div><div> if (ERR_GET_LIB(n) == ERR_LIB_CIPHER</div><div> && ERR_GET_REASON(n) == CIPHER_R_BAD_DECRYPT)</div><div> #else</div><div>- if (ERR_GET_LIB(n) == ERR_LIB_EVP</div><div>- && ERR_GET_REASON(n) == EVP_R_BAD_DECRYPT)</div><div>+ if ((ERR_GET_LIB(n) == ERR_LIB_PEM</div><div>+ && ERR_GET_REASON(n) == PEM_R_BAD_DECRYPT)</div><div>+ || (ERR_GET_LIB(n) == ERR_LIB_EVP</div><div>+ && ERR_GET_REASON(n) == EVP_R_BAD_DECRYPT)</div><div>+ || (ERR_GET_LIB(n) == ERR_LIB_PKCS12</div><div>+ && ERR_GET_REASON(n) == PKCS12_R_PKCS12_CIPHERFINAL_ERROR))</div><div> #endif</div><div> {</div><div> ERR_clear_error();</div><div>diff -r 973fded4f461 -r 8316cb9139f5 src/event/ngx_event_openssl.h</div><div>--- a/src/event/ngx_event_openssl.h<span class="Apple-tab-span" style="white-space:pre"> </span>Wed Oct 15 22:57:23 2014 +0400</div><div>+++ b/src/event/ngx_event_openssl.h<span class="Apple-tab-span" style="white-space:pre"> </span>Fri Oct 24 04:28:00 2014 -0700</div><div>@@ -25,6 +25,9 @@</div><div> #ifndef OPENSSL_NO_OCSP</div><div> #include <openssl/ocsp.h></div><div> #endif</div><div>+#ifndef OPENSSL_IS_BORINGSSL</div><div>+#include <openssl/pkcs12.h></div><div>+#endif</div><div> #include <openssl/rand.h></div><div> #include <openssl/rsa.h></div><div> #include <openssl/x509.h></div><div><br></div><div>-- </div><div>Sergey Kandaurov</div><div><br></div><div>_______________________________________________</div><div>nginx-devel mailing list</div><div><a href="mailto:nginx-devel@nginx.org">nginx-devel@nginx.org</a></div><div><a href="http://mailman.nginx.org/mailman/listinfo/nginx-devel">http://mailman.nginx.org/mailman/listinfo/nginx-devel</a></div><div><br></div></div></div></span></body></html>