Date: Fri, 7 Jan 2011 05:34:44 +0300 From: Solar Designer <solar@...nwall.com> To: john-users@...ts.openwall.com Subject: Re: hmailserver patch has errors, error when compiling in Linux x86 64-bit and 32-bit Robert, James - On Thu, Jan 06, 2011 at 09:08:18PM -0500, Robert Harris wrote: > Why is the jumbo patch so dependent on such an old version of openssl? It is not. This is a minimum version requirement, not an exact version requirement. You should also be able to build with 0.9.8 and newer (and I think you did on your Cygwin). > It looks like OpenSSL 0.9.7 was first outdated in July 2005. In a sense, yes. Upstream support for 0.9.7 ended in 2007. Yes, we need to update to 1.0.0+ in Owl-current - this is planned. For the Owl 3.0 release, this change would potentially make the system less "stable" overall, so we chose to postpone it. We did not have enough resources (people's time) for all desired package updates in 2007-2009, and in 2010 it was too late (we wanted to release the stable stuff that we happened to readily have). Yes, this means that we're the ones to backport any important security fixes (or reuse other distros' backports) in Owl 3.0-stable. We're quite used to that. We already have some security fix backports in our 0.9.7m-based package. In fact, our use of an older branch of OpenSSL happened to save us from some vulnerabilities (that were only introduced in later versions). > What is the process/level of effort to get JtR using the latest versions of > Openssl? No process, no effort. It just works. It's just not great to require those newer versions yet, so the jumbo patches released so far only require 0.9.7+ and I am unhappy about changing that to 0.9.8+ just yet. That's irrespective of Owl's version of OpenSSL. There are other systems still in use that only have 0.9.7. > What do you want to do to resolve/How do you want to handle the current > "issue" with the hmailserver patch? I might look into including a SHA-256 implementation along with this patch when I consider merging this into the jumbo patch. Or add a compile-time OpenSSL version check, excluding some "formats" on older versions. Or not merge. I think that there are fewer users of the jumbo patch who would benefit from integrated hmailserver support than those who would be inconvenienced by the requirement of 0.9.8+. So simply merging the patch would be bad overall (at this time). If/when we have more "formats", including some more popular ones, that also need 0.9.8+ for some reason, then this could be a reason to introduce this requirement (and merge the hmailserver patch as well). Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.