summaryrefslogtreecommitdiffstats
path: root/nss_engine_config.c
Commit message (Collapse)AuthorAgeFilesLines
* Check filesystem permissions on NSS database at startupRob Crittenden2016-03-011-0/+11
| | | | | | | | | | | | | See if the configured user has read access to the NSS database during initialization so the server can gracefully shutdown rather than ending up in a forking loop because the database is owned by root and is therefore unreadable once Apache starts forking. Adds a new configuration option, NSSSkipPermissionCheck <on/off>, to skip this check in case something goes wrong. https://fedorahosted.org/mod_nss/ticket/3
* Fix memory leaks, uninit var, invalid readRob Crittenden2015-10-021-0/+1
| | | | | | | | | | | | | | Issues reported from valgrind. The invalid read came from using SNI hostInfo data directly. Just use the copy we apr_strndup() instead and all is well. The SNI hostInfo values were leaking. I had removed the calls to SECITEM_FreweItem at some point and forgotten to re-add them. mc->semid was not explicitly initialized so could have blown up if the compiler didn't automatically set it to 0. Explicitly set it to make warning go away (and to be safe).
* Cleanup to remove a slew of trailing whitespaceRob Crittenden2015-10-021-21/+21
|
* Initialize session_tickets as FALSE instead of UNSETFedora Cloud User2015-10-021-1/+1
|
* Add support for Server Name Indication (SNI)Rob Crittenden2015-10-021-0/+22
| | | | | | | | Uses a hash table to pair up server names and nicknames and a lookup is done during the handshake to determine which nickname to be used, and therefore which VirtualHost. Based heavily on patch from Stanislav Tokos <stokos@suse.de>
* Add support for TLS Session Tickets (RFC 5077)Rob Crittenden2015-06-111-0/+10
| | | | | | New server/vhost config option, NSSSessionTickets, to enable or disable TLS Session Tickets support. This is off by default in NSS.
* Add RenegBufferSize optionRob Crittenden2015-06-101-0/+21
| | | | | | | Control the buffer size used on a POST when SSL renegotiation is being done. The default is 128K. Resolves BZ 1214366
* Completely remove support for SSLv2Rob Crittenden2014-11-121-5/+3
|
* Add a semaphore lock around retrieving token PINs from the nss_pcachercritten2011-03-021-0/+9
| | | | | | | pipe. Rarely requests to the pipe were getting overridden causing that child to not enable SSL. Fedora bug 677701
* Compare CN value of remote host with requested host in reverse proxy.rcritten2010-05-131-0/+11
| | | | | | Add configuration option to disable this, defaulting to on. 591224
* Add controls for managing SSL renegotiationrcritten2010-03-021-0/+28
| | | | | | | | | NSS is introducing some new controls in response to CVE-2009-3555, MITM attacks via session renegotiation. This patch adds some tuning so these options can be set at run time. Patch contributed by Kai Engert based on some early work by Rob Crittenden.
* The wrong variable was being used to report that NSSPassPhraseHelperrcritten2007-06-071-2/+2
| | | | wasn't found.
* 211612rcritten2006-10-201-0/+37
| | | | Add support for setting a default OCSP responder.
* 204138rcritten2006-08-251-3/+13
| | | | | | | | | Add new NSSPassPhraseDialog method, defer, where only the tokens that are found in the file pointed to by this directive are initialized. Otherwise every token that NSS finds it attempts to authenticate. Syntax is: NSSPassPhraseDialog defer:/path/to/password.conf
* 197681rcritten2006-07-051-0/+2
| | | | Initialize the ECC certificate and key pointers to NULL.
* 196070rcritten2006-06-201-1/+3
| | | | Fix compilation warnings
* Add support for Elliptical Curve Cryptography (ECC). This is disabledrcritten2006-03-021-0/+19
| | | | by default. To enable it, pass --enable-ecc to configure.
* Add support for seeding the NSS Random Number Generator. This addsrcritten2005-10-031-0/+89
| | | | | a new directive, NSSRandomSeed based on the mod_ssl SSLRandomSeed directive.
* Add proxy support to mod_nss. Most of the changes are related torcritten2005-09-291-6/+65
| | | | | | adding new configuration directives. For the others we need to initialize an NSS socket differently whether we will be acting as a client or a server.
* Add OCSP supportrcritten2005-09-061-0/+11
|
* Add a FIPS configuration option. This enables the FIPS internalrcritten2005-08-191-0/+11
| | | | | database module, configures for SSLv3 and TLSv1 and enables the 2 FIPS ciphers (and disables all the others).
* Add NSS database prefix supportrcritten2005-06-291-0/+12
|
* Initialize enforcement of valid certificates to true.rcritten2005-06-031-0/+1
|
* Changed function and configuration names so mod_nss can peacefullyrcritten2005-05-311-53/+46
| | | | co-exist with mod_ssl.
* By default, don't start with an expired cert. Add optionrcritten2005-05-201-0/+12
| | | | | | SSLEnforceValid Cert on/off to allow one to start with a bad cert. Fix up some error messages and add in a missing cipher.
* Initial import of mod_nssrcritten2005-05-171-0/+535
generated by cgit (git 2.34.1) at 2024-06-09 10:50:26 +0000