openssl and atexit 

TIL:
 - linux calls atexit() callbacks when a library is unloaded, not just
at process exit
 - AIX doesn't
 - openssl 1.1 adds an atexit handler
 - openssl 1.1 has some code to try to prevent the library from really
being unloaded by inflating the dlopen reference count so its atexit
will really be available at exit.
    - https://github.com/openssl/openssl/pull/1693
    -  apparently this isn't working on AIX
 - openssl 1.1 doesn't seem to be provided by IBM or third parties on
AIX as of early 2018.

Comments

Post a Comment

Popular posts from this blog

systemd unit for WebSphere Liberty (wlp)

This is the for-dummies cheatsheet for creating a basic WLP systemd unit. Note that the paths here use a separate WLP_USER_DIR directory specified in etc/server.env Step 1: Create /etc/systemd/system/wlp.service: [Unit] Description=wlp After=network-online.target Wants=network-online.target [Service] ExecStart=/home/covener/data/apps/wlp-bin/bin/server start ExecStop=/home/covener/data/apps/wlp-bin/bin/server stop User=covener Environment=JAVA_HOME=/home/covener/java Type=forking Restart = always PIDFile=/home/covener/data/apps/wlp-usr/servers/.pid/defaultServer.pid [Install] WantedBy=multi-user.target Step 2: Stop your server manually (systemd gets confused by a define service that was started outside of systemd) Step 3: Get systemctl to pick up the new unit: systemctl daemon-reload Step 4: Start server with systemctl: systemctl start wlp Step 5: Enable for starting on reboot: systemd enable wlp Other Hints: systemctl --no-...
Read more

Recovering from SQL1072C for (db2) dummies

After an OS upgrade, my IBM Directory Server was hanging waiting for its underlying database to come up. db2start was returning the error above, which implied some other manager process should be started -- which is a red herring. A one-time db2ftok made db2start magically work. Maybe there was a usable error message somewhere? Maybe not.
Read more

Wireshark tip of the day: SSL handshake versions

Hypothetical scenario is that a user has disabled TLS < 1.2 and has sporadic SSL handshake failures.  The suspected culprit is just a non-TLS 1.2 client, but people can be simultaneously skeptical and lazy. # Show TLSv1.2 client hellos tshark -Y "ssl.handshake.version == 0x303" -r ssl.cap  # Show TLSv1.1 client hellos tshark -Y "ssl.handshake.version == 0x302" -r ssl.cap  # Show TLSv1.0 client hellos tshark -Y "ssl.handshake.version == 0x301" -r ssl.cap  Caution!  It's easy to glance at wireshark/tshark output and be confused that all clients speak TLSv1.2.  TLS has versioning at the outter record layer and also in the inner handshake messages.  99% of the time, the inner  versioning is the important one.  But wireshark will often display TLSv1.2 on the outter layer even when it's transmitted as 0x30 x00 because of some early ambiguity in specs.  Net, don't look at the version in the Record twistie or the en...
Read more