summaryrefslogtreecommitdiffstats
path: root/source4/lib/tls/tls_tstream.c
Commit message (Collapse)AuthorAgeFilesLines
* Revert "s4:tls_tstream: allow mode of SSL keyfile to be 0400, not only 0600"Stefan Metzmacher2014-03-281-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 05c1fe50556e2330e23b7efb38e653428b9bdadf. This was discussed here: https://bugzilla.samba.org/show_bug.cgi?id=10392#c11 This generated warnings like: invalid permissions on file '/memdisk/metze/W/b138235/samba/bin/ab/promoted_dc/private/tls/key.pem': has 0600 should be 0400'. I think we need a better way. Maybe file_check_permissions() should get allow_perms and deny_perms. And we would call it with allow_perms = 0400 and deny_perms = 0177. And bits in none of them are ignored. For now we revert this and wait for a better fix. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Fri Mar 28 12:37:17 CET 2014 on sn-devel-104
* s4:tls_tstream: allow mode of SSL keyfile to be 0400, not only 0600Michael Brown2014-01-311-2/+3
| | | | | | | | | | | Bug: https://bugzilla.samba.org/show_bug.cgi?id=10392 Signed-off-by: Michael Brown <michael@netdirect.ca> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Fri Jan 31 01:27:03 CET 2014 on sn-devel-104
* CVE-2013-4476: s4:libtls: check for safe permissions of tls private key file ↵Björn Baumbach2013-11-111-0/+16
| | | | | | | | | | | | | | | | | | (key.pem) If the tls key is not owned by root or has not mode 0600 samba will not start up. Bug: https://bugzilla.samba.org/show_bug.cgi?id=10234 Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Björn Baumbach <bb@sernet.de> Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Karolin Seeger <kseeger@samba.org> Autobuild-Date(master): Mon Nov 11 13:07:16 CET 2013 on sn-devel-104
* s4:lib/tls - include GNUTLS headers consistently using <...>Matthias Dieter Wallnöfer2012-02-181-1/+1
| | | | | | | | | These are system-specific. Reviewed-by: Jelmer Autobuild-User: Matthias Dieter Wallnöfer <mdw@samba.org> Autobuild-Date: Sat Feb 18 00:43:58 CET 2012 on sn-devel-104
* s4:lib/tls - call "gnutls_transport_set_lowat" only on GNUTLS < 3.0Matthias Dieter Wallnöfer2011-11-301-0/+4
| | | | | | | | | | | | | | | | This function call together with the lowat feature has been removed in release 3.0 as described in this mailing list post: http://old.nabble.com/gnutls_transport_set_lowat-deprecated-td32554230.html. Since we do not make any use of lowat (esprimed by each function call) we are free to simply omit it on v3.0 and later. This addresses bug #8537. Reviewed by: abartlet + metze Autobuild-User: Matthias Dieter Wallnöfer <mdw@samba.org> Autobuild-Date: Wed Nov 30 20:11:14 CET 2011 on sn-devel-104
* s4:tls_tstream: also use a dynamic buffer for the pull sideStefan Metzmacher2011-01-181-3/+12
| | | | | | | | | Maybe that fixes the remaining issues with some gnutls versions. metze Autobuild-User: Stefan Metzmacher <metze@samba.org> Autobuild-Date: Tue Jan 18 17:26:08 CET 2011 on sn-devel-104
* s4:tls_tstream: fix partial reads, so that the gnutls layer doesn't read the ↵Stefan Metzmacher2011-01-181-1/+6
| | | | | | same data twice metze
* tls_tstream: use a dynamic buffer for the push caseStefan Metzmacher2010-12-041-6/+21
| | | | | | | | | Some versions of gnutls doesn't handle EAGAIN correctly, so we better allow sending buffers without a low size limitation, the limit is now UINT16_MAX (0xFFFF) and we allocate the buffer with talloc each time. metze
* tls_tstream: increase the buffer sizeMatthieu Patou2010-12-041-1/+1
| | | | | | | | | | | | | | | | The problem is that with certain version of gnutls are not working properly if the server is sending in different packet things like (at least) * Certificate * Server Key exchange * Client certificate Somehow it really expect this to be done in one packet as some structures used _gnutls_send_handshake are reinitialized at every packet exchange and intermediate steps didn't expect it Signed-off-by: Stefan Metzmacher <metze@samba.org>
* s4:lib/tls/tls_tstream.c - quiet warning on Solaris "cc" by castsMatthias Dieter Wallnöfer2010-11-291-2/+2
|
* s4:lib/tls: buffer writes in tstream_tls_push_function()Stefan Metzmacher2010-10-081-10/+76
| | | | | | | | | | | | This works arround bugs in gnutls_handshake(), which diesn't handle EAGAIN correctly, when they use the push function. Thanks to Marcel.Ritter@rrze.uni-erlangen.de and Matthieu Patou <mat@samba.org> for the debugging work on bug #7218. metze
* s4:lib/tls: make more clear what the immediate event is forStefan Metzmacher2010-10-081-6/+6
| | | | metze
* s4:lib/tls: fix enabled logic in tstream_tls_params_server()Stefan Metzmacher2010-10-081-1/+11
| | | | metze
* s4:lib/tls: add gnutls backend for tstreamStefan Metzmacher2010-09-281-0/+1249
metze Autobuild-User: Stefan Metzmacher <metze@samba.org> Autobuild-Date: Tue Sep 28 02:29:42 UTC 2010 on sn-devel-104
generated by cgit (git 2.34.1) at 2024-06-30 23:08:59 +0000