Warning about OpenSSL 1.0.2

[Alan DeKok]

On Oct 10, 2015, at 2:40 PM, Michael Ströder <michael at stroeder.com> wrote:
> Which exact version of OpenSSL 1.0.2?

  I'm not sure... I haven't seen people posting which version of OpenSSL they're using.

> I'm asking because I'm running FreeRADIUS 3.0.10 (formerly 3.0.9) on openSUSE
> Tumbleweed (x86_64 and armv6l) with package openssl-1.0.2d-1.1 using
> EAP-TTLS/PAP without issue.
> 
> Maybe you're hitting the HMAC ABI incompatibility?
> It was fixed in 1.0.2c:
> https://www.openssl.org/news/changelog.html#x2

  I don't think so.  But who knows...

  If OpenSSL 1.0.2d fixes the problem, then we can leave 2.2.9 alone, and not do 2.2.10.

  It's almost like the OpenSSL people just write code, and release it without doing any tests. 

  Alan DeKok.