December 2017 - Boost - lists.boost.org

[beast] Security
by Phil Endecott 13 Dec '17

13 Dec '17

Dear All, To what extent do we think that Beast should be "secure"? I am thinking mostly about handling malicious input. Has it been reviewed by anyone with specific experience of how HTTP can be attacked? Has it been "fuzzed"? Regards, Phil.

6 10

linker error in 1.66 rc1 (regression from 1.65.1)
by Mark Incley 13 Dec '17

13 Dec '17

Hi, Using Visual Studio 2017 15.5, the following minimal test case causes a linker error with Boost 1.66 RC1 but builds fine with 1.65.1: Produces... 1>------ Build started: Project: aZ80, Configuration: Debug Win32 ------ 1>libboost_timer-vc141-mt-gd-x32-1_66.lib(cpu_timer.obj) : error LNK2005: "public: static class boost::chrono::time_point<class boost::chrono::steady_clock,class boost::chrono::duration<__int64,class boost::ratio<1,1000000000> > > __cdecl boost::chrono::steady_clock::now(void)" (?now@steady_clock@chrono@boost@@SA?AV?$time_point@Vsteady_clock@chrono@boost@@V?$duration@_JV?$ratio@$00$0DLJKMKAA@@boost@@@23@@23@XZ) already defined in libboost_chrono-vc141-mt-gd-x32-1_66.lib(chrono.obj) 1>libboost_timer-vc141-mt-gd-x32-1_66.lib(cpu_timer.obj) : error LNK2005: "double __cdecl boost::chrono::chrono_detail::get_nanosecs_per_tic(void)" (?get_nanosecs_per_tic@chrono_detail@chrono@boost@@YANXZ) already defined in libboost_chrono-vc141-mt-gd-x32-1_66.lib(chrono.obj) 1>C:\Projects\aZ80\vs\Debug\aZ80.exe : fatal error LNK1169: one or more multiply defined symbols found Swapping the order of the includes appears to workaround the problem. Mark. -- Sent from: http://boost.2283326.n4.nabble.com/Boost-Dev-f2600599.html

2 5

[release] Boost 1.66.0 Release Candidate 1
by Daniel James 11 Dec '17

11 Dec '17

The release candidates for the 1.66.0 release are now available at: <https://dl.bintray.com/boostorg/release/1.66.0/source/> The in progress release notes are: <http://www.boost.org/users/history/in_progress.html> Library documentation is available at: <http://www.boost.org/doc/libs/1_66_0/> The SHA256 checksums are as follows: c9d29486dd12f19d321da65eb5f0a157ec0f0edfd4701ade48c644310c8f0676 boost_1_66_0_rc1.7z 6232f7e7873b2d1f112fb62c726f7066e9a7e0643ed2aac7d31d20bf5749fbc0 boost_1_66_0_rc1.tar.bz2 30ad6d1c7380d6e6a87ce1bc54388ab957de67a2e8fa44dd3c106eafad0f6ac2 boost_1_66_0_rc1.tar.gz cd2c64f243c89e04329e94f3b803f0744171b44fee7a8b4e3256b3a625dcbd1c boost_1_66_0_rc1.zip As always, the release managers would appreciate it if you download the candidate of your choice and give building it a try. Please report both success and failure, and anything else that is noteworthy.

5 5

Info: Boost.Config is older than your compiler version - message is surprising
by Paul A. Bristow 11 Dec '17

11 Dec '17

I've just updated to the latest and greatest Visual Studio 15.5 and also got my Boost develop branch up-to-date. But I'm still getting this message: "Info: Boost.Config is older than your compiler version - probably nothing bad will happen - but you may wish to look for an updated Boost version. Define BOOST_CONFIG_SUPPRESS_OUTDATED_MESSAGE to suppress this message." I've just rebuilt my library files that have the new -x64- x32 in the name (great - but grrrr because I have had to change all my command files to generate them, previously in /x64 and /win32 folders ;-) The library files have names like libboost_chrono-vc141-mt-x64-1_66.lib so version number is still at 1.66 (a fact confirmed by the config_info Boost version 106600) The config_info.txt output is attached. So I am surprised to get this potentially useful warning. It would *much* more helpful if the warning told which version number of both compiler and Boost? (Just like the 'File not found' message that provokes "Which *&%$%^!!ing file" expletives). Paul PS The Good news is that defining BOOST_CONFIG_SUPPRESS_OUTDATED_MESSAGE quiets as promised. --- Paul A. Bristow Prizet Farmhouse Kendal UK LA8 8AB +44 (0) 1539 561830

4 15

Help requested for boost documentation for polymorphic_value
by Jonathan Coe 11 Dec '17

11 Dec '17

I have been preparing polymorphic_value for submission to boost. I have draft documentation here: https://drive.google.com/open?id=1xpD8s8zDzedVDDlqjsl1JtYGaJBHWoGy but am having problems generating doxygen docs. A forward declaration seems to stop generation of docs for methods of polymorphic_value. I'm at a loss as to why doxygen is not working properly for boost doc (it works fine when run in isolation) and would be grateful for any insight anyone can offer. I suspect it's a simple problem but I'm not very experienced with doxygen and am new to the boost docs tools. source is here: https://github.com/jbcoe/polymorphic_value/tree/boost regards, Jon

2 2

Optional third-party libraries
by James E. King, III 09 Dec '17

09 Dec '17

The boost documentation on the web site talks about building boost from source, but I don't see information on how to leverage optional third party libraries easily accessible in the documentation from the place the user will most likely end up: "Building From Source". This information seems to be tucked away in documentation of various components, making it difficult to actually build a complete boost. I think it would be a good idea to bring this information up to the top level build instructions, at the very least itemize these third party packages and then link to the relevant project-specific documentation pages that talk about configuring to use them. Here are the third party optional libraries I know about so far and the libraries that use them: bzip2 (iostreams) iconv (locale - if icu not available) icu (locale, regex) lzma (iostreams) openssl (asio, beast) pthread-win32 (sync, thread) zlib (beast, gil, iostreams) Any others? Would folks find it useful if this information was part of the standard "Building From Source" sections of the upper layers of documentation? Thanks, Jim

5 5

[config] msvc-15.5, updating tests
by John Maddock 09 Dec '17

09 Dec '17

While working on updating Boost.Config for msvc-15.5 I've managed to break the test case for boost_no_cxx17_iterator_traits (both GCC and msvc agree on this) but can't see what's wrong :( The change is this one: https://github.com/boostorg/config/commit/305f5a58ef879037b0fd9fdaa8e05615c… which removes use of std::iterator as a base class. Anyone any ideas? Many thanks, John. --- This email has been checked for viruses by AVG. http://www.avg.com

2 2

[release] Boost 1.66.0 Beta 1 Release Candidate 1
by Daniel James 09 Dec '17

09 Dec '17

The release candidates for the 1.66.0 beta release are now available at: <https://dl.bintray.com/boostorg/beta/1.66.0.beta.1/source/> The SHA256 checksums are as follows: 0e137e61069e95f61fe0e46aa4a5432e65e209e87d470ea3c15b0ea1327583ac boost_1_66_0_b1_rc1.7z eff4854c1a672830c55fd2323ebe42d5d83e0f7a3d0a9d354d8bf55289831fa0 boost_1_66_0_b1_rc1.tar.bz2 f4fb07aa1ec639707570e42a848796d9a8155f23d1ece0f0a6a0cbee99807038 boost_1_66_0_b1_rc1.tar.gz d5f480441223f45427199697edbdd78145499084f835597247a452d2a7e1e798 boost_1_66_0_b1_rc1.zip The in progress release notes are at: <http://www.boost.org/users/history/in_progress.html> And the documentation is at: <http://www.boost.org/doc/libs/1_66_0_beta1/> As always, the release managers would appreciate it if you download the candidate of your choice and give building it a try. Please report both success and failure, and anything else that is noteworthy.

11 42

[beast] Security Review: Hybrid Application Assessment
by Vinnie Falco 09 Dec '17

09 Dec '17

Since 2005, Bishop Fox has provided security consulting services to the Fortune 1000, high-tech startups, and financial institutions worldwide. The author of Beast, Vinnie Falco, engaged Bishop Fox to assess the security of the Boost C++ Beast HTTP/S networking library. The following report details the findings identified during the course of the engagement, which started on September 11, 2017. The assessment team conducted a hybrid application assessment of the Beast library. Bishop Fox’s hybrid application assessment methodology leverages the real-world attack techniques of application penetration testing in combination with targeted source code review to thoroughly identify application security vulnerabilities. These full-knowledge assessments begin with automated scans of the deployed application and source code. Next, analyses of the scan results are combined with manual review to thoroughly identify potential application security vulnerabilities. In addition, the team performs a review of the application architecture and business logic to locate any design-level issues. Finally, the team performs manual exploitation and review of these issues to validate the findings. <https://vinniefalco.github.io/BeastAssets/Beast%20-%20Hybrid%20Application%…> Note: The permessage-deflate vulnerability described in the report is confirmed to be fixed in the version of Beast which is included in Boost 1.66.0 Thanks

1 0

Requesting endorsements for YAP review
by Zach Laine 07 Dec '17

07 Dec '17

I mailed the list several months ago about YAP, an expression template library written against C++14 and later standards. The sources can be found here: https://github.com/tzlaine/yap and online docs here: https://tzlaine.github.io/yap I'd like to put this in the review queue, and so I'm looking for endorsements for this. At the time of my initial emails, there was some interest, but not much. Expression templates are a niche technology, so this makes sense. I'm trying to make ETs less expert friendly, so that they leave their experts-only niche. I feel this library does a fairly good job of that. If you do too, please endorse! Thanks, Zach

4 4