|
|
@08b821a
|
4 years |
thomas2.klute |
gnutls_io.c: API documentation
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@104e881
|
4 years |
thomas2.klute |
General comment updates for Doxygen compatibility
Mostly /* */ vs. …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@14548b9
|
4 years |
thomas2.klute |
Update comments in gnutls_cache.(c|h) to work with Doxygen
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@e1c094c
|
4 years |
thomas2.klute |
Replace GnuTLSOCSPGraceTime with GnuTLSOCSPCacheTimeout
Configuring a …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@b888e8b
|
4 years |
thomas2.klute |
New directive GnuTLSOCSPCheckNonce
Some CAs refuse to send nonces in …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@3475e62
|
4 years |
thomas2.klute |
Remove EXPERIMENTAL mark for OCSP from internal documentation
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@c39ae1a
|
4 years |
thomas2.klute |
Initialize OCSP timeouts with an "unset" value
The configuration …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@ef107fd
|
4 years |
thomas2.klute |
Remove TODO for OCSP requests without nonces
Ideally all OCSP …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@0a02378
|
4 years |
thomas2.klute |
Style fixes for OCSP related time differences
* Consistently use …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@333bbc7
|
4 years |
thomas2.klute |
Configurable OCSP socket timeout
Stalled OCSP requests must time out …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@c6dda6d
|
4 years |
thomas2.klute |
Rate limit OCSP requests
Retries after failed OCSP requests must be …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@d26fa55
|
4 years |
thomas2.klute |
Allow GnuTLSOCSPGraceTime in virtual host context
mgs_set_timeout …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@3f0b470
|
5 years |
thomas2.klute |
Macro for the OCSP socket timeout
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@8a0da86
|
5 years |
thomas2.klute |
Adjust log levels for OCSP cache updates
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@9c456a9
|
5 years |
thomas2.klute |
Clean up cache logging
* Demote ordinary cache store/fetch operations …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@e9ef72c
|
5 years |
thomas2.klute |
Disable GnuTLSSessionTickets by default as described in handbook
The …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@f1147b6
|
5 years |
thomas2.klute |
OCSP post config: Ensure OCSP URI or response file are set
If the …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@ef06c74
|
5 years |
thomas2.klute |
Compatibility code for GCC version < 5
The builtin_add_overflow() …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@ac3f500
|
5 years |
thomas2.klute |
Compatibility code for GnuTLS version < 3.4
* gnutls_memset() is not …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@87d507b
|
5 years |
thomas2.klute |
Overwrite session ticket key before releasing it
Private key material …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@78b75b3
|
5 years |
thomas2.klute |
Restore GnuTLSOCSPResponseFile option
Using an externally updated …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@4d4a406
|
5 years |
thomas2.klute |
New config option: GnuTLSOCSPStapling
This flag option …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@70d014b
|
5 years |
thomas2.klute |
Remove FIXME comment about releasing config structures: Done!
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@b8700b0
|
5 years |
thomas2.klute |
Deinit proxy credentials on config pool cleanup
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@02eabe7
|
5 years |
thomas2.klute |
TLS Proxy: Fix memory leak while logging certificate status
The …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@f265001
|
5 years |
thomas2.klute |
Bind temporary pool in load_proxy_x509_credentials() to ptemp scope
…
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@7e7d328
|
5 years |
thomas2.klute |
Deinit PGP certificate on config pool cleanup
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@44e8944
|
5 years |
thomas2.klute |
Allocate memory for X.509 and PGP certificates only when needed
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@eee1432
|
5 years |
thomas2.klute |
Bind temporary pool in mgs_load_files() to ptemp scope
Pool 'spool' …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@45b7b83
|
5 years |
thomas2.klute |
Deinit PGP private key and keyring on config pool cleanup
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@db9ef68
|
5 years |
thomas2.klute |
Deinit client CA list on config pool cleanup
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@81433f1
|
5 years |
thomas2.klute |
Reformat mgs_load_files()
This commit changes only whitespace and …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@e2ba939
|
5 years |
thomas2.klute |
Prevent memory leaks in post_conf hook
Valgrind indicated memory …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@894efd0
|
5 years |
thomas2.klute |
Check OCSP response nonce
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@82745d1
|
5 years |
thomas2.klute |
Fix memory usage issues
* Use-after-free of the OCSP request in …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@16ad0eb
|
5 years |
thomas2.klute |
Perform OCSP request over HTTP
Finally the whole stack is there! …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@0831437
|
5 years |
thomas2.klute |
Clarify the purpose of mgs_time2sz()
I've renamed the CTIME macro to …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@47a909e
|
5 years |
thomas2.klute |
Create OCSP requests when updating the cached response
Actually …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@a372379
|
5 years |
thomas2.klute |
Store server certificate fingerprint in OCSP config
It's not like …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@cc74801e
|
5 years |
thomas2.klute |
Move generated vhost-wide OCSP config into a private structure
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@5559aa6
|
5 years |
thomas2.klute |
Rely on cache for OCSP response expiration
With fixed DBM cache …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@11e6205
|
5 years |
thomas2.klute |
dbm_cache_fetch(): Clear data size on allocation failure
Memory …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@b2e6406
|
5 years |
thomas2.klute |
Safe integer type conversion in mgs_filter_input()
Read sizes should …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@15b22cb
|
5 years |
thomas2.klute |
Allow compiling with clang
Needs just a minimal workaround for an …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@d6834e0
|
5 years |
thomas2.klute |
OCSP refresh mutex: Prevent parallel requests
Add a global mutex …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@aa68232
|
5 years |
thomas2.klute |
Move global cache mutex into the private cache struct
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@e809fb3
|
5 years |
thomas2.klute |
Use generic cache functions for OCSP response caching
With this, OCSP …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@3e22b82
|
5 years |
thomas2.klute |
Add generic store/fetch support to the memcached cache
Required to …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@70a1e5a
|
5 years |
thomas2.klute |
Introduce OCSP caching grace time
A cached OCSP response must be …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@f450ac9
|
5 years |
thomas2.klute |
Replace mgs_session_id2sz() with apr_(p?)escape_hex()
There's no need …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@d18afb8
|
5 years |
thomas2.klute |
Ensure that dbm_cache_fetch() does not return expired data
The cache …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@c6572ec
|
5 years |
thomas2.klute |
Apply default cache timeout to OCSP responses without nextUpdate
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@c55902b
|
5 years |
thomas2.klute |
Trigger cache expiration on fetch, small restructuring
In a situation …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@c005645
|
5 years |
thomas2.klute |
Mutex for DBM cache access
I noticed that with a DBM cache enabled …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@eb63377
|
5 years |
thomas2.klute |
Check only expiration time for OCSP responses from cache
Responses …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@366d1a1
|
5 years |
thomas2.klute |
Use nextUpdate field of OCSP response to set cache lifetime
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@08817d0
|
5 years |
thomas2.klute |
Check OCSP response before caching
Only verified responses should be …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@368e581
|
5 years |
thomas2.klute |
Update OCSP response cache only if response is missing or invalid
…
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@4bf4ce2
|
5 years |
thomas2.klute |
Use GCC builtins to catch overflows with mixed integer types
…
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@6b4136c
|
5 years |
thomas2.klute |
Store OCSP responses in DBM cache before use
This is not proper …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@2f932fa
|
5 years |
thomas2.klute |
Use gnutls_datum_t to pass DBM keys for GnuTLS sessions
The APR …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@6814e48
|
5 years |
thomas2.klute |
Explain the different signatures of the dbm_cache functions
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@15245bf
|
5 years |
thomas2.klute |
Split dbm_cache_fetch() in generic and GnuTLS session specific parts
…
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@1d1361f
|
5 years |
thomas2.klute |
Make dbm_cache_store() work outside connection context
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@ae08186
|
5 years |
thomas2.klute |
DBM cache: Separate session caching and generic store operation
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@f785704
|
5 years |
thomas2.klute |
Make dbm_cache_expire() work outside connection context
DBM cache …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@04e6e65
|
5 years |
thomas2.klute |
Move declarations of cache-related functions to a dedicated header
…
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@7511bfa
|
5 years |
thomas2.klute |
Use ap_log_cerror() instead of ap_log_error() where reasonable
…
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@8913410
|
5 years |
thomas2.klute |
Update copyright headers
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@c3ad933
|
5 years |
thomas2.klute |
Remove stale support code for Apache versions before 2.2
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@fd6bb19
|
5 years |
thomas2.klute |
Extract OCSP access URI from the server certificate
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@4ae7810
|
5 years |
thomas2.klute |
Log port along with hostname if OCSP trust list initialization fails
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@68ce93c
|
5 years |
thomas2.klute |
Rearrange mgs_get_ocsp_response() for readability
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@fad7695
|
5 years |
thomas2.klute |
Store OCSP trust list in server config
This avoids recreating the …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@64856fd
|
5 years |
thomas2.klute |
Get rid of exit(-1) calls in mgs_hook_post_config()
This allows the …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@2a1ffd6
|
5 years |
thomas2.klute |
Move trust list generation for OCSP to a separate function
The new …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@d35b98e
|
5 years |
thomas2.klute |
Check OCSP response and staple it only if good
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@94cb972
|
5 years |
thomas2.klute |
Minimal OCSP stapling implementation using externally provided …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@0bda20f
|
5 years |
thomas2.klute |
Make "make distcheck" work
This requires strict DIST/DISTCLEAN lists …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@eb34ac4
|
5 years |
thomas2.klute |
Let Automake handle module installation
Using a custom pkglib …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@19f2719
|
5 years |
thomas2.klute |
Update comments and formating in push/pull functions
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@a9fa300
|
5 years |
thomas2.klute |
Set GnuTLS session errno on all error paths in mgs_transport_read()
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@6868585
|
5 years |
thomas2.klute |
Remove unnecessary session pointer check
The transport functions are …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@be41ee4
|
5 years |
thomas2.klute |
Set GnuTLS session errno on errors in mgs_transport_write()
Sunil …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@8ac7c0d
|
5 years |
thomas2.klute |
Register "ssl_is_https" function for compatibility with mod_rewrite
…
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@bc539d5
|
5 years |
thomas2.klute |
Implement short message for mod_status reports
Until now the flags …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@600cf16
|
5 years |
thomas2.klute |
mgs_status_hook: Remove code for GnuTLS versions < 3
mod_gnutls …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@73b0bf0
|
5 years |
thomas2.klute |
mgs_filter_input: Use APR_STATUS_IS macros instead of integer comparison
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@a2368a4
|
5 years |
thomas2.klute |
Use TLS session cleanup hook for all connection pools
If a TLS …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@2ceb836
|
5 years |
thomas2.klute |
Update log messages on session termination (cleanup_gnutls_session, …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@401a0de
|
5 years |
thomas2.klute |
Close TLS session on EOF in input filter
If the input filter receives …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@f5a36ee
|
5 years |
thomas2.klute |
Pass EAGAIN/EINTR from gnutls_io_input_read to input filter
…
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@02a6a18
|
5 years |
thomas2.klute |
gnutls_io.c: Don't mix EAGAIN and EINTR in mgs_transport_read
…
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@dff03fa
|
6 years |
thomas2.klute |
Configure C99 mode
Variable declarations in for loops improve code …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@9ca1f21
|
6 years |
thomas2.klute |
Allow loading more than one PKCS #11 module using GnuTLSP11Module
…
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@88df24d
|
6 years |
thomas2.klute |
Replace "SSL" with "TLS" in config directive descriptions
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@176047e
|
6 years |
thomas2.klute |
Use AP_INIT_FLAG for On/Off? config directives
Letting the Apache …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@7764015
|
6 years |
thomas2.klute |
Update GnuTLSP11Module documentation for stricter semantics
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@746e993
|
6 years |
thomas2.klute |
Formatting fix for PKCS #11 module loading
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@f21d2a6
|
6 years |
thomas2.klute |
Changed the semantics of GnuTLSP11Module
That setting instructs …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|