summaryrefslogtreecommitdiffstats
path: root/mod_nss.h
Commit message (Collapse)AuthorAgeFilesLines
* Check filesystem permissions on NSS database at startupRob Crittenden2016-03-011-0/+3
| | | | | | | | | | | | | See if the configured user has read access to the NSS database during initialization so the server can gracefully shutdown rather than ending up in a forking loop because the database is owned by root and is therefore unreadable once Apache starts forking. Adds a new configuration option, NSSSkipPermissionCheck <on/off>, to skip this check in case something goes wrong. https://fedorahosted.org/mod_nss/ticket/3
* Add server support for DHE ciphersChristian Heimes2016-02-291-0/+3
| | | | | | | | Similar patch was provided by Vitezslav Cizek <vcizek@suse.com> Heavily modified by Rob Crittenden <rcritten@redhat.com> https://fedorahosted.org/mod_nss/ticket/15
* Cleanup to remove a slew of trailing whitespaceRob Crittenden2015-10-021-6/+6
|
* Modernize autotools configuration slightly, add config.hRob Crittenden2015-10-021-1/+13
| | | | | | | | | | | I need to generate config.h because Apache ships its own autotools-generated config.h which redefines a lot of variables like PACKAGE_NAME, PACKAGE_TARBALL, etc. By having my own configh I can reset things before the compiler complains. The downside is that compile-time options are hidden in a config file instead of being defined on the gcc command-line.
* Fix compatibility with RHEL 6.x (Apache 2.2.x and NSS 3.15.1)Rob Crittenden2015-10-021-0/+4
|
* Add support for Server Name Indication (SNI)Rob Crittenden2015-10-021-0/+11
| | | | | | | | Uses a hash table to pair up server names and nicknames and a lookup is done during the handshake to determine which nickname to be used, and therefore which VirtualHost. Based heavily on patch from Stanislav Tokos <stokos@suse.de>
* Add support for TLS Session Tickets (RFC 5077)Rob Crittenden2015-06-111-0/+2
| | | | | | New server/vhost config option, NSSSessionTickets, to enable or disable TLS Session Tickets support. This is off by default in NSS.
* Add RenegBufferSize optionRob Crittenden2015-06-101-1/+9
| | | | | | | Control the buffer size used on a POST when SSL renegotiation is being done. The default is 128K. Resolves BZ 1214366
* Add compatibility for mod_ssl-style cipher definitionsRob Crittenden2014-12-021-18/+2
| | | | | | | | - Add Camelia ciphers - Remove Fortezza ciphers - Add TLSv1.2-specific ciphers Resolves BZ: #862938
* Completely remove support for SSLv2Rob Crittenden2014-11-121-3/+2
|
* Apache 2.4 compatibility changesRob Crittenden2014-02-211-2/+1
|
* Work with mod_proxy when mod_ssl is also loaded.Rob Crittenden2014-02-211-13/+4
| | | | | | | | There is a single-set of hooks in mod_proxy so if mod_ssl was even loaded,even if not being used, it would grab those hooks and mod_nss would not work. Resolves #1021469
* Add a semaphore lock around retrieving token PINs from the nss_pcachercritten2011-03-021-0/+7
| | | | | | | pipe. Rarely requests to the pipe were getting overridden causing that child to not enable SSL. Fedora bug 677701
* Only call PK11_ListCerts once and pass it when configuring eachrcritten2010-09-221-1/+1
| | | | | | | | | | | | virtual server. This saves considerable time when there are a lot of certificates and/or virtual servers. Change enforce so that we only check the validity of the certificate if enforcecerts is enabled (the default). Patch contributed by Wolter Eldering <wolter.eldering@vanad.com.cn> bug 635324
* Compare CN value of remote host with requested host in reverse proxy.rcritten2010-05-131-0/+2
| | | | | | Add configuration option to disable this, defaulting to on. 591224
* Add controls for managing SSL renegotiationrcritten2010-03-021-0/+8
| | | | | | | | | NSS is introducing some new controls in response to CVE-2009-3555, MITM attacks via session renegotiation. This patch adds some tuning so these options can be set at run time. Patch contributed by Kai Engert based on some early work by Rob Crittenden.
* NSS has been modified to not allow a fork after an NSS_Init() in the softrcritten2008-05-091-0/+2
| | | | | | | | | token. It apparently always did this for hardware tokens as it is part of the PKCS#11 spec. This moves the initialization code into the child process init function. 444348
* If mod_ssl isn't loaded then register the hooks to mod_proxy so we canrcritten2007-10-181-0/+10
| | | | do at least secure proxy in front of an unsecure host.
* Resolves: 241936rcritten2007-05-311-3/+0
| | | | | | | | | | | Bring in some updates based on diffs from 2.0.59 to 2.2.4 - Do explicit TRUE/FALSE tests with sc->enabled to see if SSL is enabled. Don't depend on the fact that TRUE == 1 - Remove some dead code - Minor update to the buffer code that buffers POST data during a renegotation - Optimize setting environment variables by using a switch statement.
* 211612rcritten2006-10-201-0/+6
| | | | Add support for setting a default OCSP responder.
* 204138rcritten2006-08-251-0/+1
| | | | | | | | | Add new NSSPassPhraseDialog method, defer, where only the tokens that are found in the file pointed to by this directive are initialized. Otherwise every token that NSS finds it attempts to authenticate. Syntax is: NSSPassPhraseDialog defer:/path/to/password.conf
* Merge in changes from http://svn.apache.org/viewvc?view=rev&revision=290965rcritten2006-08-091-0/+4
| | | | | | | | | | | | | | | | | | Implement a (bounded) buffer of request body data to provide a limited but safe fix for the mod_nss renegotiation-vs-requests-with-bodies bug: * mod_nss.h (nss_io_buffer_fill): Add prototype. * nss_engine_io.c (nss_io_buffer_fill, nss_io_filter_buffer): New functions. * nss_engine_kernel.c (nss_hook_Access): If a renegotiation is needed, and the request has a non-zero content-length, or a t-e header (and 100-continue was not requested), call nss_io_buffer_fill to set aside the request body data if possible, then proceed with the negotiation. PR: 12355
* Merge in changes from http://svn.apache.org/viewvc?view=rev&revision=161958rcritten2006-08-091-1/+0
| | | | | | | | | | | | | | | The issue was that mod_ssl wasn't always picking up ssl-unclean-shutdown settings. This isn't an issue for mod_nss since it doesn't support separate shutdown modes, but this does simplify the code a bit. * mod_nss.h: Remove nss_hook_Translate. * nss_engine_kernel.c (nss_hook_ReadReq): Merge in nss_hook_Translate. (nss_hook_Translate): Remove. * mod_nss.c (nss_register_hooks): Ensure that _ReadReq hook runs after mod_setenvif.c; don't register translate_name hook.
* 200610rcritten2006-08-031-1/+10
| | | | | | | Change the kludge for determining the current version of Apache we're building against. Claim to be building against 2.0.55 if not told otherwise. The exact version matters less than knowing which API to use.
* 196070rcritten2006-06-201-0/+1
| | | | Fix compilation warnings
* 188300rcritten2006-04-071-1/+1
| | | | Replace C++ style comments to make the Sun Forte compiler happy.
* Add support for Elliptical Curve Cryptography (ECC). This is disabledrcritten2006-03-021-0/+16
| | | | by default. To enable it, pass --enable-ecc to configure.
* Changes to allow the mod_nss to work in Apache 2.2.0. Based on a patchrcritten2006-01-041-0/+9
| | | | | | | from Oden Eriksson. The conditional to determine which API to use is a bit weak at the moment but it works with Apache 2.0.54 and 2.2.0.
* Add support for seeding the NSS Random Number Generator. This addsrcritten2005-10-031-0/+23
| | | | | a new directive, NSSRandomSeed based on the mod_ssl SSLRandomSeed directive.
* Add proxy support to mod_nss. Most of the changes are related torcritten2005-09-291-3/+11
| | | | | | adding new configuration directives. For the others we need to initialize an NSS socket differently whether we will be acting as a client or a server.
* Add OCSP supportrcritten2005-09-061-0/+2
|
* Add a FIPS configuration option. This enables the FIPS internalrcritten2005-08-191-0/+2
| | | | | database module, configures for SSLv3 and TLSv1 and enables the 2 FIPS ciphers (and disables all the others).
* Add NSS database prefix supportrcritten2005-06-291-0/+2
|
* Changed function and configuration names so mod_nss can peacefullyrcritten2005-05-311-64/+64
| | | | co-exist with mod_ssl.
* By default, don't start with an expired cert. Add optionrcritten2005-05-201-1/+3
| | | | | | SSLEnforceValid Cert on/off to allow one to start with a bad cert. Fix up some error messages and add in a missing cipher.
* Initial import of mod_nssrcritten2005-05-171-0/+388
generated by cgit (git 2.34.1) at 2025-07-01 14:58:53 +0000