| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
See if the configured user has read access to the NSS database
during initialization so the server can gracefully shutdown
rather than ending up in a forking loop because the database is
owned by root and is therefore unreadable once Apache starts
forking.
Adds a new configuration option, NSSSkipPermissionCheck <on/off>,
to skip this check in case something goes wrong.
https://fedorahosted.org/mod_nss/ticket/3
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
Add a note to the table to indicate that the handhake is complete
so we don't set the extension every time data is read or written.
Drop NSSHandshakeCallback() as it didn't do anything and is replaced
by the proxy callback.
Extend the checks around calling SetURL to match those in mod_ssl:
- a hostname is available
- not SSLv3
- not an IP address
|
| | |
|
| |
|
|
|
|
|
|
| |
Uses a hash table to pair up server names and nicknames and
a lookup is done during the handshake to determine which
nickname to be used, and therefore which VirtualHost.
Based heavily on patch from Stanislav Tokos <stokos@suse.de>
|
| |
|
|
|
|
| |
New server/vhost config option, NSSSessionTickets, to enable
or disable TLS Session Tickets support. This is off by default
in NSS.
|
| |
|
|
|
|
|
| |
Control the buffer size used on a POST when SSL renegotiation is
being done. The default is 128K.
Resolves BZ 1214366
|
| |
|
|
|
| |
If support is available in NSS then it is just a matter of including
TLS 1.2 in the protocol range.
|
| | |
|
| |
|
|
|
|
|
|
| |
There is a single-set of hooks in mod_proxy so if mod_ssl was even
loaded,even if not being used, it would grab those hooks and mod_nss
would not work.
Resolves #1021469
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Set protocol version ranges:
(1) Set the minimum protocol accepted
(2) Set the maximum protocol accepted
(3) Protocol ranges extend from maximum down to minimum
protocol
(4) All protocol ranges are completely inclusive;
no protocol in the middle of a range may be excluded
(5) NSS automatically negotiates the use of the strongest
protocol for a connection starting with the maximum
specified protocol and downgrading as necessary to the
minimum specified protocol
For example, if SSL 3.0 is chosen as the minimum protocol, and
TLS 1.1 is chosen as the maximum protocol, SSL 3.0, TLS 1.0, and
TLS 1.1 will all be accepted as protocols, as TLS 1.0 will not
and cannot be excluded from this range. NSS will automatically
negotiate to utilize the strongest acceptable protocol for a
connection starting with the maximum specified protocol and
downgrading as necessary to the minimum specified protocol
(TLS 1.1 -> TLS 1.0 -> SSL 3.0).
BZ 816394
|
| |
|
|
|
|
|
| |
pipe. Rarely requests to the pipe were getting overridden causing
that child to not enable SSL.
Fedora bug 677701
|
| |
|
|
|
|
| |
Add configuration option to disable this, defaulting to on.
591224
|
| |
|
|
|
|
|
|
|
| |
NSS is introducing some new controls in response to CVE-2009-3555,
MITM attacks via session renegotiation. This patch adds some tuning
so these options can be set at run time.
Patch contributed by Kai Engert based on some early work by Rob
Crittenden.
|
| |
|
|
| |
do at least secure proxy in front of an unsecure host.
|
| |
|
|
|
|
|
|
|
|
|
| |
Bring in some updates based on diffs from 2.0.59 to 2.2.4
- Do explicit TRUE/FALSE tests with sc->enabled to see if SSL is enabled.
Don't depend on the fact that TRUE == 1
- Remove some dead code
- Minor update to the buffer code that buffers POST data during a
renegotation
- Optimize setting environment variables by using a switch statement.
|
| |
|
|
| |
Add support for setting a default OCSP responder.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The issue was that mod_ssl wasn't always picking up ssl-unclean-shutdown
settings. This isn't an issue for mod_nss since it doesn't support
separate shutdown modes, but this does simplify the code a bit.
* mod_nss.h: Remove nss_hook_Translate.
* nss_engine_kernel.c
(nss_hook_ReadReq): Merge in nss_hook_Translate.
(nss_hook_Translate): Remove.
* mod_nss.c (nss_register_hooks): Ensure that _ReadReq
hook runs after mod_setenvif.c; don't register translate_name hook.
|
| |
|
|
|
|
|
| |
Change the kludge for determining the current version of Apache we're
building against. Claim to be building against 2.0.55 if not told
otherwise. The exact version matters less than knowing which API to
use.
|
| |
|
|
| |
Fix compilation warnings
|
| |
|
|
| |
by default. To enable it, pass --enable-ecc to configure.
|
| |
|
|
|
|
|
| |
from Oden Eriksson.
The conditional to determine which API to use is a bit weak at the moment
but it works with Apache 2.0.54 and 2.2.0.
|
| |
|
|
|
| |
a new directive, NSSRandomSeed based on the mod_ssl SSLRandomSeed
directive.
|
| |
|
|
|
|
| |
adding new configuration directives. For the others we need to
initialize an NSS socket differently whether we will be acting as a
client or a server.
|
| | |
|
| |
|
|
|
| |
database module, configures for SSLv3 and TLSv1 and enables the
2 FIPS ciphers (and disables all the others).
|
| | |
|
| | |
|
| |
|
|
| |
co-exist with mod_ssl.
|
| |
|
|
|
|
| |
SSLEnforceValid Cert on/off to allow one to start with a bad cert.
Fix up some error messages and add in a missing cipher.
|
| |
|
