summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Add Vitezslav Cizek and Christian Heimes to AUTHORSHEADmasterRob Crittenden2016-03-011-0/+2
|
* Update ChangeLog: DHE ciphers, gencert, FIPS, permission, ciphersRob Crittenden2016-03-011-0/+28
| | | | | | | | | | | | | | * Check for Apache user owner/group read permissions of NSS database * Update default ciphers to something more modern and secure * Fix test for DH cipher directive * Check for test and netstat before trying to use them * Don't ignore NSSProtocol when NSSFIPS is enabled Based on patch by Matthew Harmsen <mharmsen@redhat.com> * Use proper shell syntax to avoid creating /0 * tests: Centralize the openssl ciphers flags when comparing * Basic test case for DHE cipher negotiation * Remove -DH from test strings, duplicate test, fix test * Add server support for DHE ciphers.
* Update default cipher set to include stronger ciphersRob Crittenden2016-03-011-8/+1
| | | | | | | | | Insecure or less secure algorithms such as RC4, DES and 3DES are removed. Perfect forward secrecy suites with ephemeral ECDH key exchange have been added. IE 8 on Windows XP is no longer supported. https://fedorahosted.org/mod_nss/ticket/5
* Check filesystem permissions on NSS database at startupRob Crittenden2016-03-015-27/+124
| | | | | | | | | | | | | See if the configured user has read access to the NSS database during initialization so the server can gracefully shutdown rather than ending up in a forking loop because the database is owned by root and is therefore unreadable once Apache starts forking. Adds a new configuration option, NSSSkipPermissionCheck <on/off>, to skip this check in case something goes wrong. https://fedorahosted.org/mod_nss/ticket/3
* Change argumement order in make check so sqlite tests runRob Crittenden2016-03-011-1/+1
| | | | | | | Change 184804c82daf7fe04dfb0b0ecdc3e06be0c103c1 modified the way arguments are handled in test/setup.sh such that sql: was being dropped so tests were not being executed against sqlite databases.
* Check for test and netstat before trying to use themRob Crittenden2016-02-291-2/+10
| | | | | | | These may not be available on all systems. Work around it best we can. In the case of netstat this can be replaced by using /dev/urandom or /dev/random instead and piping it through tr to produce only ASCII strings.
* Don't ignore NSSProtocol when NSSFIPS is enabledRob Crittenden2016-02-291-54/+65
| | | | | | | | | | | | | | The value was always being set to TLS 1.0, 1.1 and 1.2, ignoring the configuration value. I suspect this is because this code dated to when only SSL2, 3 and TLS 1.0 were supported so it only enabled TLS v1.0. When 1.1 and 1.2 were added it seemed natural to automatically enable those as well. Natural but incorrect. Based on patch by Matthew Harmsen <mharmsen@redhat.com> RHBZ #1312052
* Use proper shell syntax to avoid creating /0Rob Crittenden2016-02-291-1/+1
| | | | | | I used if [ $x > 0 ]; ... which is obviously wrong :-( https://bugzilla.redhat.com/show_bug.cgi?id=1311392
* Fix test for DH cipher directiveRob Crittenden2016-02-292-0/+11
| | | | | | | Since we don't support ADH ciphers can just ignore DH-* Note that OpenSSL defines the DH- ciphers but does not implement them so the DH string support is there only for compatibility.
* tests: Centralize the openssl ciphers flags when comparingRob Crittenden2016-02-291-56/+64
| | | | | | | I used to have a separate set of options when comparing the NSS and OpenSSL ciphers. These differed between tests, sometimes being just a difference in order. This just made the tests hard to understand.
* Basic test case for DHE cipher negotiationRob Crittenden2016-02-293-0/+16
|
* Remove -DH from test strings, duplicate test, fix testRob Crittenden2016-02-291-29/+29
| | | | | | | The AESGCM test was duplicated. Remove one. Two different tests were in test_AES_no_ECDH. I broke one out separately.
* Add server support for DHE ciphersChristian Heimes2016-02-296-2/+87
| | | | | | | | Similar patch was provided by Vitezslav Cizek <vcizek@suse.com> Heavily modified by Rob Crittenden <rcritten@redhat.com> https://fedorahosted.org/mod_nss/ticket/15
* Update CL SIGHUP, NSSProxyNickname, SNI alert, FakeBasicAuthRob Crittenden2016-01-191-0/+14
| | | | | | | | | | | - Drop the check that NSSProxyNickname be required - Add basic reverse proxy test case - Don't send SSL alert on SNI lookup failure - Fail for colons in credentials with FakeBasicAuth - Always call SSL_ShutdownServerSessionIDCache() in ModuleKill - Document some python dependencies needed by make check - Add cipher test for ECDH+aRSA - Quote gcm and sha384 config values when comparing them
* Drop the check that NSSProxyNickname be requiredRob Crittenden2016-01-191-10/+7
| | | | | | | | This was incorrectly a required value when it is a completely optional setting. Remove it from the check completely and add a log entry when it is set. https://bugzilla.redhat.com/show_bug.cgi?id=874847
* Add basic reverse proxy test case (over Internet)Rob Crittenden2016-01-193-0/+19
| | | | | | | | Fetches https://www.google.com and just looks for a 200 response. This adds implicit requirement that the test machine has Internet access so I might have to remove this eventually, but it at least exercises that code in a positive test case.
* Always call SSL_ShutdownServerSessionIDCache() in ModuleKillRob Crittenden2016-01-191-3/+3
| | | | | | | | | | | | | | The guard of NSS_IsInitialized() was too strict because of the way Apache loads and unloads modules. We need to clean up the SessionIDCache thread locking when a SIGHUP is received otherwise a crash will occur. Note that this also eliminates a rather huge memory leak when the server is reloaded with a SIGHUP. https://bugzilla.redhat.com/show_bug.cgi?id=1277613 https://bugzilla.redhat.com/show_bug.cgi?id=1295976 https://fedorahosted.org/mod_nss/ticket/16
* Add test for colons in FakeBasicAuth user certificateRob Crittenden2016-01-153-6/+65
| | | | | | Update gencert to do a better job parsing arguments so I can pass in a --test flag to generate a special test-only user certificate to test colons in the DN.
* Fail for colons in credentials with FakeBasicAuthRob Crittenden2016-01-151-2/+33
| | | | | We will eventually want to use mod_auth_basic's AuthBasicFake but this will do for now.
* Don't send alert on SNI lookup failure to accomodate older clientsRob Crittenden2016-01-151-5/+19
| | | | | | | | | | | | | | | | | | | RFC 6066 section 3 says "It is NOT RECOMMENDED to send a warning-level unrecognized_name(112) alert, because the client's behavior in response to warning-level alerts is unpredictable." To maintain compatibility with mod_ssl, we will not send any alert (neither warning- nor fatal-level), i.e. we take the second action suggested in RFC. "If the server understood the ClientHello extension but does not recognize the server name, the server SHOULD take one of two actions: either abort the handshake by sending a fatal-level unrecognized_name(112) alert or continue the handshake." This is based on mod_ssl commit r1684462
* Add cipher test for ECDH+aRSARob Crittenden2016-01-151-0/+3
|
* Document some python dependencies needed by make checkRob Crittenden2016-01-151-0/+5
|
* Quote gcm and sha384 config values when comparing themRob Crittenden2015-11-181-2/+2
|
* Become 1.0.12Rob Crittenden2015-10-022-1/+2
|
* Fix memory leaks, uninit var, invalid readRob Crittenden2015-10-023-4/+14
| | | | | | | | | | | | | | Issues reported from valgrind. The invalid read came from using SNI hostInfo data directly. Just use the copy we apr_strndup() instead and all is well. The SNI hostInfo values were leaking. I had removed the calls to SECITEM_FreweItem at some point and forgotten to re-add them. mc->semid was not explicitly initialized so could have blown up if the compiler didn't automatically set it to 0. Explicitly set it to make warning go away (and to be safe).
* Fix typo in valgrind in start script, create separate logsRob Crittenden2015-10-021-1/+1
| | | | | Use the %p option to generate separate logs for each process with valgrind.
* Update changelog with reverse proxy SNI and whitespace cleanupRob Crittenden2015-10-021-0/+6
|
* Cleanup to remove a slew of trailing whitespaceRob Crittenden2015-10-0215-147/+147
|
* Add a test for reverse proxy SNIRob Crittenden2015-10-025-3/+31
|
* Rework SNI client reverse proxyRob Crittenden2015-10-023-17/+43
| | | | | | | | | | | | | Add a note to the table to indicate that the handhake is complete so we don't set the extension every time data is read or written. Drop NSSHandshakeCallback() as it didn't do anything and is replaced by the proxy callback. Extend the checks around calling SetURL to match those in mod_ssl: - a hostname is available - not SSLv3 - not an IP address
* Send SNI extension mod_nss acts as a reverse proxystanda2015-10-021-0/+39
|
* Don't run live webserver tests as the root userRob Crittenden2015-10-021-1/+5
| | | | | Apache doesn't like running as root and this ends up hanging the build process.
* Update README with SNI information and other useful bitsRob Crittenden2015-10-021-0/+14
|
* Update ChangeLog, fix frees, build Apache 2.2, autoconfRob Crittenden2015-10-021-0/+10
|
* Modernize autotools configuration slightly, add config.hRob Crittenden2015-10-023-6/+17
| | | | | | | | | | | I need to generate config.h because Apache ships its own autotools-generated config.h which redefines a lot of variables like PACKAGE_NAME, PACKAGE_TARBALL, etc. By having my own configh I can reset things before the compiler complains. The downside is that compile-time options are hidden in a config file instead of being defined on the gcc command-line.
* Fix some compiler warnings (and one real bug)Rob Crittenden2015-10-022-6/+5
| | | | | | | Most of these are unused variable. There is one adding an extra set of parens. The bug is using the wrong index variable, i instead of j.
* Fix compatibility with RHEL 6.x (Apache 2.2.x and NSS 3.15.1)Rob Crittenden2015-10-0212-8/+97
|
* Replace PR_Free with PORT_Freestanda2015-10-021-3/+3
| | | | Contributed by Stanislav Tokos
* Initialize session_tickets as FALSE instead of UNSETFedora Cloud User2015-10-021-1/+1
|
* Add -DH as another exclusion in the SSLv3 cipher testRob Crittenden2015-10-021-1/+1
| | | | make check was failing in Fedora rawhide
* Update changelog with SNI, SECURE_RENEG, hintsRob Crittenden2015-10-021-0/+5
|
* Add some hints when NSS database cannot be initializedRob Crittenden2015-10-021-7/+35
| | | | Check the permissions to see if the key file is readable.
* Add the SECURE_RENEG environment variableRob Crittenden2015-10-022-0/+8
|
* Enable the core dump directoryRob Crittenden2015-10-021-0/+2
|
* Always enable the glibc memory checking routinesRob Crittenden2015-10-021-1/+3
|
* Add test suite for SNIRob Crittenden2015-10-0212-130/+510
| | | | | | | | | | | | | | | | | | | | | | | | | python for OpenSSL is in quite a sad state with several competing mid-level implementations which provide different feature sets. The httplib client provides access to the negotiated cipher and protocol but not SNI (and it has lousy hostname checking). The urllib3 client provides SNI and is generally better but doesn't give any details on the connection. So I'm using both. The original one is used for basic server testing and the urllib3 one is used just for SNI testing. Also: - Indent the test configuration to make it more readable - Add separate config file for SNI testing - Add a CGI configuration and script to test CGI variables - Change client cipher test to use AES256-SHA instead of RC4 - Add a commented-out valgrind option in start for future debuggers - Change the VirtualServers to *:port and use ServerName - Add per-VH document roots so SNI can be more easily tested
* Add support for Server Name Indication (SNI)Rob Crittenden2015-10-028-13/+383
| | | | | | | | Uses a hash table to pair up server names and nicknames and a lookup is done during the handshake to determine which nickname to be used, and therefore which VirtualHost. Based heavily on patch from Stanislav Tokos <stokos@suse.de>
* Update changelog with memory, SHA384 and OpenSSL ciphersRob Crittenden2015-10-021-0/+7
|
* NSS added support for some SHA384 ciphers, add themRob Crittenden2015-10-026-5/+130
| | | | | | | I don't want to assume these ciphers are available in every distro so I'm bending over backwards a bit to check for availablility and get the defines right for the python cipher tests.
* Fix cipher memory leak and use PORT_Free instead of PR_FreeRob Crittenden2015-10-021-2/+3
| | | | | When retrieving the negotiated cipher the string was being leaked and the wrong free was being used for subject and issuer.
generated by cgit (git 2.34.1) at 2024-04-25 13:27:39 +0000