Update for OpenSSL PKCS#11 engine

We found a couple of bugs in the engine since the last update.

  • 6375348 Using pkcs11 as the SSLCryptoDevice with Apache/OpenSSL causes significant performance drop
  • 6573196 memory is leaked when OpenSSL is used with PKCS#11 engine

Updated engine patch against latest stable source code release of OpenSSL: pkcs11_engine-0.9.8e.patch.2007-09-26 (README)

Comments:

This is great news. These fixes don't seem to be in 10u4. Do you know if/when they'll be backported to Solaris 10?

Posted by Derek Morr on September 26, 2007 at 08:34 AM CEST #

hi Derek, no, they are not there. They will be in 10u5 and also in a patch. However, I can't tell you any ETA for this patch since we don't know now.

Posted by Jan on September 27, 2007 at 04:31 AM CEST #

Hi!

I just installed Solaris 10 U5 on T1000. I am still getting "140943FC:SSL routines:SSL3_READ_BYTES:sslv3 alert bad record mac" error. Both wget and curl clients report this error from time to time when load is around 10-20 connections per second with a static web page served by Apache 2.2.8:

wget --no-check-certificate https://192.71.188.142:8443/ -O /tmp/roska >> wgetlog 2>> wgeterrorlog
curl -k --sslv3 https://192.71.188.142:8443/ >> curllog 2>> curlerrorlog

Here is how I build Apache:

CFLAGS='-DSSL_EXPERIMENTAL -DSSL_ENGINE' ./configure --prefix=/export/home/apa/apache --enable-cache --enable-mem-cache --enable-ssl --with-mpm=prefork --enable-rule=SSL_EXPERIMENTAL --with-ssl=/usr/sfw --enable-deflate
make
make install

I have tested some other build options as well but the have not managed to get rid of those errors. If I comment out "SSLCryptoDevice pkcs11" in httpd.conf both clients work fine. But the CPU usage grows on the server as expected.

Posted by Antti Paju on April 23, 2008 at 02:36 AM CEST #

we have been working on roughly 15 bugs in the engine we have found during the past few months. I think one of them should fix your issue. When we put those fixes back to Nevada, I'll release a new patch. I hope it will be within one month.

Posted by Jan on April 23, 2008 at 07:16 AM CEST #

Post a Comment:
  • HTML Syntax: NOT allowed
About

Jan Pechanec

Search

Categories
Archives
« April 2014
SunMonTueWedThuFriSat
  
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
   
       
Today