summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* tests: Centralize the openssl ciphers flags when comparingRob Crittenden2016-02-291-56/+64
| | | | | | | I used to have a separate set of options when comparing the NSS and OpenSSL ciphers. These differed between tests, sometimes being just a difference in order. This just made the tests hard to understand.
* Basic test case for DHE cipher negotiationRob Crittenden2016-02-293-0/+16
|
* Remove -DH from test strings, duplicate test, fix testRob Crittenden2016-02-291-29/+29
| | | | | | | The AESGCM test was duplicated. Remove one. Two different tests were in test_AES_no_ECDH. I broke one out separately.
* Add server support for DHE ciphersChristian Heimes2016-02-296-2/+87
| | | | | | | | Similar patch was provided by Vitezslav Cizek <vcizek@suse.com> Heavily modified by Rob Crittenden <rcritten@redhat.com> https://fedorahosted.org/mod_nss/ticket/15
* Update CL SIGHUP, NSSProxyNickname, SNI alert, FakeBasicAuthRob Crittenden2016-01-191-0/+14
| | | | | | | | | | | - Drop the check that NSSProxyNickname be required - Add basic reverse proxy test case - Don't send SSL alert on SNI lookup failure - Fail for colons in credentials with FakeBasicAuth - Always call SSL_ShutdownServerSessionIDCache() in ModuleKill - Document some python dependencies needed by make check - Add cipher test for ECDH+aRSA - Quote gcm and sha384 config values when comparing them
* Drop the check that NSSProxyNickname be requiredRob Crittenden2016-01-191-10/+7
| | | | | | | | This was incorrectly a required value when it is a completely optional setting. Remove it from the check completely and add a log entry when it is set. https://bugzilla.redhat.com/show_bug.cgi?id=874847
* Add basic reverse proxy test case (over Internet)Rob Crittenden2016-01-193-0/+19
| | | | | | | | Fetches https://www.google.com and just looks for a 200 response. This adds implicit requirement that the test machine has Internet access so I might have to remove this eventually, but it at least exercises that code in a positive test case.
* Always call SSL_ShutdownServerSessionIDCache() in ModuleKillRob Crittenden2016-01-191-3/+3
| | | | | | | | | | | | | | The guard of NSS_IsInitialized() was too strict because of the way Apache loads and unloads modules. We need to clean up the SessionIDCache thread locking when a SIGHUP is received otherwise a crash will occur. Note that this also eliminates a rather huge memory leak when the server is reloaded with a SIGHUP. https://bugzilla.redhat.com/show_bug.cgi?id=1277613 https://bugzilla.redhat.com/show_bug.cgi?id=1295976 https://fedorahosted.org/mod_nss/ticket/16
* Add test for colons in FakeBasicAuth user certificateRob Crittenden2016-01-153-6/+65
| | | | | | Update gencert to do a better job parsing arguments so I can pass in a --test flag to generate a special test-only user certificate to test colons in the DN.
* Fail for colons in credentials with FakeBasicAuthRob Crittenden2016-01-151-2/+33
| | | | | We will eventually want to use mod_auth_basic's AuthBasicFake but this will do for now.
* Don't send alert on SNI lookup failure to accomodate older clientsRob Crittenden2016-01-151-5/+19
| | | | | | | | | | | | | | | | | | | RFC 6066 section 3 says "It is NOT RECOMMENDED to send a warning-level unrecognized_name(112) alert, because the client's behavior in response to warning-level alerts is unpredictable." To maintain compatibility with mod_ssl, we will not send any alert (neither warning- nor fatal-level), i.e. we take the second action suggested in RFC. "If the server understood the ClientHello extension but does not recognize the server name, the server SHOULD take one of two actions: either abort the handshake by sending a fatal-level unrecognized_name(112) alert or continue the handshake." This is based on mod_ssl commit r1684462
* Add cipher test for ECDH+aRSARob Crittenden2016-01-151-0/+3
|
* Document some python dependencies needed by make checkRob Crittenden2016-01-151-0/+5
|
* Quote gcm and sha384 config values when comparing themRob Crittenden2015-11-181-2/+2
|
* Become 1.0.12Rob Crittenden2015-10-022-1/+2
|
* Fix memory leaks, uninit var, invalid readRob Crittenden2015-10-023-4/+14
| | | | | | | | | | | | | | Issues reported from valgrind. The invalid read came from using SNI hostInfo data directly. Just use the copy we apr_strndup() instead and all is well. The SNI hostInfo values were leaking. I had removed the calls to SECITEM_FreweItem at some point and forgotten to re-add them. mc->semid was not explicitly initialized so could have blown up if the compiler didn't automatically set it to 0. Explicitly set it to make warning go away (and to be safe).
* Fix typo in valgrind in start script, create separate logsRob Crittenden2015-10-021-1/+1
| | | | | Use the %p option to generate separate logs for each process with valgrind.
* Update changelog with reverse proxy SNI and whitespace cleanupRob Crittenden2015-10-021-0/+6
|
* Cleanup to remove a slew of trailing whitespaceRob Crittenden2015-10-0215-147/+147
|
* Add a test for reverse proxy SNIRob Crittenden2015-10-025-3/+31
|
* Rework SNI client reverse proxyRob Crittenden2015-10-023-17/+43
| | | | | | | | | | | | | Add a note to the table to indicate that the handhake is complete so we don't set the extension every time data is read or written. Drop NSSHandshakeCallback() as it didn't do anything and is replaced by the proxy callback. Extend the checks around calling SetURL to match those in mod_ssl: - a hostname is available - not SSLv3 - not an IP address
* Send SNI extension mod_nss acts as a reverse proxystanda2015-10-021-0/+39
|
* Don't run live webserver tests as the root userRob Crittenden2015-10-021-1/+5
| | | | | Apache doesn't like running as root and this ends up hanging the build process.
* Update README with SNI information and other useful bitsRob Crittenden2015-10-021-0/+14
|
* Update ChangeLog, fix frees, build Apache 2.2, autoconfRob Crittenden2015-10-021-0/+10
|
* Modernize autotools configuration slightly, add config.hRob Crittenden2015-10-023-6/+17
| | | | | | | | | | | I need to generate config.h because Apache ships its own autotools-generated config.h which redefines a lot of variables like PACKAGE_NAME, PACKAGE_TARBALL, etc. By having my own configh I can reset things before the compiler complains. The downside is that compile-time options are hidden in a config file instead of being defined on the gcc command-line.
* Fix some compiler warnings (and one real bug)Rob Crittenden2015-10-022-6/+5
| | | | | | | Most of these are unused variable. There is one adding an extra set of parens. The bug is using the wrong index variable, i instead of j.
* Fix compatibility with RHEL 6.x (Apache 2.2.x and NSS 3.15.1)Rob Crittenden2015-10-0212-8/+97
|
* Replace PR_Free with PORT_Freestanda2015-10-021-3/+3
| | | | Contributed by Stanislav Tokos
* Initialize session_tickets as FALSE instead of UNSETFedora Cloud User2015-10-021-1/+1
|
* Add -DH as another exclusion in the SSLv3 cipher testRob Crittenden2015-10-021-1/+1
| | | | make check was failing in Fedora rawhide
* Update changelog with SNI, SECURE_RENEG, hintsRob Crittenden2015-10-021-0/+5
|
* Add some hints when NSS database cannot be initializedRob Crittenden2015-10-021-7/+35
| | | | Check the permissions to see if the key file is readable.
* Add the SECURE_RENEG environment variableRob Crittenden2015-10-022-0/+8
|
* Enable the core dump directoryRob Crittenden2015-10-021-0/+2
|
* Always enable the glibc memory checking routinesRob Crittenden2015-10-021-1/+3
|
* Add test suite for SNIRob Crittenden2015-10-0212-130/+510
| | | | | | | | | | | | | | | | | | | | | | | | | python for OpenSSL is in quite a sad state with several competing mid-level implementations which provide different feature sets. The httplib client provides access to the negotiated cipher and protocol but not SNI (and it has lousy hostname checking). The urllib3 client provides SNI and is generally better but doesn't give any details on the connection. So I'm using both. The original one is used for basic server testing and the urllib3 one is used just for SNI testing. Also: - Indent the test configuration to make it more readable - Add separate config file for SNI testing - Add a CGI configuration and script to test CGI variables - Change client cipher test to use AES256-SHA instead of RC4 - Add a commented-out valgrind option in start for future debuggers - Change the VirtualServers to *:port and use ServerName - Add per-VH document roots so SNI can be more easily tested
* Add support for Server Name Indication (SNI)Rob Crittenden2015-10-028-13/+383
| | | | | | | | Uses a hash table to pair up server names and nicknames and a lookup is done during the handshake to determine which nickname to be used, and therefore which VirtualHost. Based heavily on patch from Stanislav Tokos <stokos@suse.de>
* Update changelog with memory, SHA384 and OpenSSL ciphersRob Crittenden2015-10-021-0/+7
|
* NSS added support for some SHA384 ciphers, add themRob Crittenden2015-10-026-5/+130
| | | | | | | I don't want to assume these ciphers are available in every distro so I'm bending over backwards a bit to check for availablility and get the defines right for the python cipher tests.
* Fix cipher memory leak and use PORT_Free instead of PR_FreeRob Crittenden2015-10-021-2/+3
| | | | | When retrieving the negotiated cipher the string was being leaked and the wrong free was being used for subject and issuer.
* Fix invalid read when retrieving PEM certificateRob Crittenden2015-10-021-8/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Based heavily on patch submitted by Stanislav Tokos <stokos@suse.de> ==30687== Invalid read of size 1 ==30687== at 0x4C2D902: memmove (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==30687== by 0x9D0A844: nss_var_lookup_nss_cert_PEM (string3.h:58) ==30687== by 0x9D0AF58: nss_var_lookup_nss_cert (nss_engine_vars.c:437) ==30687== by 0x9D0B411: nss_var_lookup (nss_engine_vars.c:339) ==30687== by 0x9D08813: nss_hook_Fixup (nss_engine_kernel.c:878) ==30687== by 0x146FE9: ap_run_fixups (in /usr/sbin/httpd2-prefork) ==30687== by 0x15B2C7: ap_process_request (in /usr/sbin/httpd2-prefork) ==30687== by 0x158137: ??? (in /usr/sbin/httpd2-prefork) ==30687== by 0x153C52: ap_run_process_connection (in /usr/sbin/httpd2-prefork) ==30687== by 0x1602DD: ??? (in /usr/sbin/httpd2-prefork) ==30687== by 0x160585: ??? (in /usr/sbin/httpd2-prefork) ==30687== by 0x1610AC: ap_mpm_run (in /usr/sbin/httpd2-prefork) ==30687== Address 0xf8cbc11 is 0 bytes after a block of size 1,745 alloc'd ==30687== at 0x4C29F09: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==30687== by 0xAD0573F: PORT_Alloc_Util (in /usr/lib64/libnssutil3.so) ==30687== by 0xACFE179: NSSBase64_EncodeItem_Util (in /usr/lib64/libnssutil3.so) ==30687== by 0xACFE1DA: BTOA_DataToAscii_Util (in /usr/lib64/libnssutil3.so) ==30687== by 0x9D0A7EC: nss_var_lookup_nss_cert_PEM (nss_engine_vars.c:569) ==30687== by 0x9D0AF58: nss_var_lookup_nss_cert (nss_engine_vars.c:437) ==30687== by 0x9D0B411: nss_var_lookup (nss_engine_vars.c:339) ==30687== by 0x9D08813: nss_hook_Fixup (nss_engine_kernel.c:878) ==30687== by 0x146FE9: ap_run_fixups (in /usr/sbin/httpd2-prefork) ==30687== by 0x15B2C7: ap_process_request (in /usr/sbin/httpd2-prefork) ==30687== by 0x158137: ??? (in /usr/sbin/httpd2-prefork) ==30687== by 0x153C52: ap_run_process_connection (in /usr/sbin/httpd2-prefork)
* Implement EECDH, kECDH, AECDH, ECDSA and aECDSA cipher macrosRob Crittenden2015-10-022-0/+46
| | | | Also add test for AESGCM
* The OpenSSL DEFAULT cipher macro shouldn't enable NULL ciphersRob Crittenden2015-10-022-0/+21
|
* Update ChangeLog with doc, compiler warning and cipher fixesRob Crittenden2015-10-021-0/+7
|
* Correctly handle disabled ciphersRob Crittenden2015-10-021-1/+1
| | | | | | | | | A cipher value could be -1, 0 or 1 meaning completely disabled, disabled and enabled. A -1 passed to SSL_CipherPrefSet() could cause a cipher to actually be enabled. Now pass PR_TRUE if the cipher is enabled otherwise pass PR_FALSE. Fix CVE-2015-5244
* Add cast to suppress compiler warningRob Crittenden2015-08-271-1/+1
|
* Use %ld instead of %d for potentially long integer valuesRob Crittenden2015-08-271-1/+1
|
* Switch set_cipher_value() to void since there is no return valueRob Crittenden2015-08-271-4/+2
|
* Fix usage of sizeof() within strncat to not overflow bufferRob Crittenden2015-08-271-4/+4
|
generated by cgit (git 2.34.1) at 2024-06-12 00:32:32 +0000