summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Bugzilla Bug #906082 - mod_nss requires manpages for gencert and nss_pcache.Matthew Harmsen2013-07-022-17/+124
|
* Fix static array overrun when generating arg list for nss_pcacheRob Crittenden2011-10-261-1/+1
| | | | | | | | | | From Coverity: mod_nss-1.0.8/nss_engine_init.c:467: overrun-local: Overrunning static array "child_argv", with 5 elements, at position 5 with index variable "5". https://bugzilla.redhat.com/show_bug.cgi?id=714154
* No need to shut things down if NSS isn't initialized.Rob Crittenden2011-06-141-0/+4
| | | | | | Patch contributed by Ulf Weltman BZ 618466
* Always copy in client certificate and fix FakeBasicAuthRob Crittenden2011-06-142-9/+10
| | | | | | | | | When NSSOptions +FakeBasicAuth is set for a directory, and a certificate is not provided with which the BasicAuth can be Faked, and the client provides an Authorization header, the FakeBasicAuth code in mod_nss may not properly reject an attempt to spoof. BZ 702437
* Add a semaphore lock around retrieving token PINs from the nss_pcachercritten2011-03-026-7/+98
| | | | | | | pipe. Rarely requests to the pipe were getting overridden causing that child to not enable SSL. Fedora bug 677701
* Add man page for gencertrcritten2011-02-033-7/+112
|
* * Don't use memcpy as it may operate on overlapping memory (#669118)rcritten2011-01-121-0/+4
| | | | Patch ported from mod_ssl by Stephen Gallagher <sgallagh@redhat.com>
* Bug 669118rcritten2011-01-121-2/+2
| | | | | | | | memcpy of overlapping memory is no longer allowed by glibc. This is mod_ssl bug https://issues.apache.org/bugzilla/show_bug.cgi?id=45444 Patch ported by Stephen Gallagher.
* Revert PR_WOULD_BLOCK change and reset the NSPR error value before calllingrcritten2010-09-241-2/+2
| | | | | | | PR_Read(). In testing with TPS from dogtag this really seems to fix #620856 this time.
* Bring up to date.rcritten2010-09-221-1/+26
|
* Only call PK11_ListCerts once and pass it when configuring eachrcritten2010-09-222-27/+34
| | | | | | | | | | | | virtual server. This saves considerable time when there are a lot of certificates and/or virtual servers. Change enforce so that we only check the validity of the certificate if enforcecerts is enabled (the default). Patch contributed by Wolter Eldering <wolter.eldering@vanad.com.cn> bug 635324
* Fix endless read loop in some situations when handling POST data (#620856)rcritten2010-09-171-1/+2
| | | | | | This was discovered in the dogtag TPS subsystem. I haven't been able to duplicate it outside of that but it is trivial inside. This seems to fix it and brings the code closer to what mod_ssl does here as well.
* 2010-05-14 Rob Crittenden <rcritten@redhat.com>rcritten2010-05-141-0/+9
| | | | | | | | | | * Ignore SIGHUP in nss_pcache (#591889). Contributed by Joshua Roys <roysjosh@gmail.com> 2010-05-13 Rob Crittenden <rcritten@redhat.com> * Compare CN value of remote host with requested host in reverse proxy. * Add configuration option to disable this, defaulting to on. (#591224) * Based on patch from Joshua Roys <roysjosh@gmail.com
* Ignore SIGHUP in nss_pcache (#591889).rcritten2010-05-141-0/+3
| | | | Contributed by Joshua Roys <roysjosh@gmail.com>
* Compare CN value of remote host with requested host in reverse proxy.rcritten2010-05-135-50/+50
| | | | | | Add configuration option to disable this, defaulting to on. 591224
* Update list of error messagesrcritten2010-03-221-2/+14
|
* Add TLS renegotiation options to the configuration filercritten2010-03-181-0/+11
|
* Add controls for managing SSL renegotiationrcritten2010-03-024-0/+62
| | | | | | | | | NSS is introducing some new controls in response to CVE-2009-3555, MITM attacks via session renegotiation. This patch adds some tuning so these options can be set at run time. Patch contributed by Kai Engert based on some early work by Rob Crittenden.
* Fix another place we should set PR_WOULD_BLOCK_ERROR during a read.rcritten2009-11-111-0/+1
|
* Return -1 on a read failure and set the appropriate NSPR error message.rcritten2009-02-191-1/+2
| | | | | | | | | | | This bug has lingered for so long since mod_nss wasn't able to be used with mod_proxy until now. What one would see with this bug is sometimes a page would work, sometimes not (just the headers would be retrieved). The problem was we were return 0 which means EOF and was interpreted by upper levels to mean the transfer was done rather than no data being available. 484380
* Fix bug in disabling mod_ssl when installing mod_nss with 'make install'rcritten2008-08-262-2/+2
|
* Bring up-to-date to mod_nss 1.0.8rcritten2008-07-211-0/+33
|
* Restore moduleKill function so that NSS remains initialized during thercritten2008-07-161-3/+11
| | | | | | | entire configuration state. Other modules were relying on mod_nss leaving NSS initialized. 453508
* Don't inherit the MP cache when running in threaded modercritten2008-07-141-4/+35
| | | | | | Don't initialize the database if the SSL is disabled in the configuration 454701
* Don't allow blank passwords if FIPS is enabled. This is not allowedrcritten2008-07-021-1/+6
| | | | by the NSS FIPS 140-2 security policy.
* Fix parsing error where a token with no password would end up with arcritten2008-07-021-2/+5
| | | | | | | trailing tab in its value causing NSS to not find it. If there is no password stored for a token return a 1-byte response so that the read on the other end won't time out.
* No need to link with softokn3rcritten2008-05-162-2/+2
| | | | 446101
* Make FIPS mode work. This fixes 2 problems:rcritten2008-05-162-2/+10
| | | | | | | | | | 1. In nss_init_SSLLibrary() the server config wasn't being set properly for each virtual server so FIPS wasn't getting turned on. 2. There seem to be a problem in NSS_Shutdown() that makes subsequent logins appear to succeed but they actually are skipped causing keys and certs to not be available. Also switch an error message to a warning related to FIPS ciphers.
* NSS has been modified to not allow a fork after an NSS_Init() in the softrcritten2008-05-092-164/+230
| | | | | | | | | token. It apparently always did this for hardware tokens as it is part of the PKCS#11 spec. This moves the initialization code into the child process init function. 444348
* Resolves BZ 248722rcritten2008-01-031-2/+7
| | | | | See if the certificate has a version before trying to decode it into a CGI variable.
* If mod_ssl isn't loaded then register the hooks to mod_proxy so we canrcritten2007-10-183-0/+39
| | | | do at least secure proxy in front of an unsecure host.
* The error message was wrong if NSSPassPhraseHelper pointed to arcritten2007-06-071-0/+7
| | | | | | non-existant file. Don't require a password file AND NSSPassPhraseHelper. Only the helper is required.
* Only NSSPassPhraseHelper needs to be required.rcritten2007-06-071-3/+2
|
* The wrong variable was being used to report that NSSPassPhraseHelperrcritten2007-06-071-2/+2
| | | | wasn't found.
* Populate the changelog.rcritten2007-06-011-0/+80
|
* Resolves: 241936rcritten2007-05-317-117/+91
| | | | | | | | | | | Bring in some updates based on diffs from 2.0.59 to 2.2.4 - Do explicit TRUE/FALSE tests with sc->enabled to see if SSL is enabled. Don't depend on the fact that TRUE == 1 - Remove some dead code - Minor update to the buffer code that buffers POST data during a renegotation - Optimize setting environment variables by using a switch statement.
* 229660rcritten2007-02-221-0/+5
| | | | Log a warning on a malformed password file entry instead of dropping core.
* 226747rcritten2007-02-011-1/+1
| | | | Fix typo in cipher echde_rsa_null (transposed h and d).
* 222173rcritten2007-01-102-5/+14
| | | | | | | | Stop processing tokens when a login fails so we can correctly report the failure. Fix an off-by-one error in nss_pcache that prevented 1 character passwords (not a huge problem but a bug none-the-less).
* 213081rcritten2006-10-301-3/+3
| | | | | | The way I was using to detect the model being used was incorrect. Now use the # of threads available. Guaranteed to be 0 for prefork and > 0 for worker (threaded)
* 212426rcritten2006-10-261-14/+17
| | | | Don't fire up the NSS engine if SSL isn't enabled.
* 211612rcritten2006-10-205-3/+116
| | | | Add support for setting a default OCSP responder.
* 211139rcritten2006-10-172-8/+22
| | | | | Only call NSS_Shutdown when we've initialized the database. Also update the NSS log messages to those added in NSS 3.11.3.
* 208848rcritten2006-10-021-1/+1
| | | | | | | If the password stored in a file pointed to by NSSPassPhraseDialog didn't match the database password then Apache would core on Solaris (because passwd was NULL). The error message is still a bit lackluster but at least it doesn't core anymore.
* Add information about ECC including required versions of NSPR and NSSrcritten2006-09-051-6/+222
| | | | | | | | and the available ciphers. Clarify starting up Apache without requiring user intervention. Fix a few bad links to NSPR.
* 204138rcritten2006-08-253-4/+33
| | | | | | | | | Add new NSSPassPhraseDialog method, defer, where only the tokens that are found in the file pointed to by this directive are initialized. Otherwise every token that NSS finds it attempts to authenticate. Syntax is: NSSPassPhraseDialog defer:/path/to/password.conf
* Initialize the NSS cache before NSS_Init is called. A race conditionrcritten2006-08-241-8/+8
| | | | | | was being triggered during the first module unload when calling NSS_Shutdown because the cache wasn't finished setting itself up in MP mode.
* Merge in http://svn.apache.org/viewvc?view=rev&revision=354394rcritten2006-08-091-2/+5
| | | | | * nss_engine_kernel.c (nss_hook_Access): Omit further access control checks if SSL is not in use regardless of vhost settings.
* Merge in changes from http://svn.apache.org/viewvc?view=rev&revision=290965rcritten2006-08-093-64/+206
| | | | | | | | | | | | | | | | | | Implement a (bounded) buffer of request body data to provide a limited but safe fix for the mod_nss renegotiation-vs-requests-with-bodies bug: * mod_nss.h (nss_io_buffer_fill): Add prototype. * nss_engine_io.c (nss_io_buffer_fill, nss_io_filter_buffer): New functions. * nss_engine_kernel.c (nss_hook_Access): If a renegotiation is needed, and the request has a non-zero content-length, or a t-e header (and 100-continue was not requested), call nss_io_buffer_fill to set aside the request body data if possible, then proceed with the negotiation. PR: 12355
* Merge in changes from http://svn.apache.org/viewvc?view=rev&revision=104700rcritten2006-08-092-0/+29
| | | | | | | | | * nss_engine_vars.c (nss_var_lookup_ssl_cert_remain): New function. (nss_var_lookup_nss_cert): Support _V_REMAIN suffix for SSL_{SERVER,CLIENT} as number of days until certificate expires. * nss_engine_kernel.c: Export SSL_CLIENT_V_REMAIN if +StdEnvVars is configured.
generated by cgit (git 2.34.1) at 2025-07-01 21:11:28 +0000