|
|
@70a1e5a
|
7 years |
thomas2.klute |
Introduce OCSP caching grace time
A cached OCSP response must be …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@f450ac9
|
7 years |
thomas2.klute |
Replace mgs_session_id2sz() with apr_(p?)escape_hex()
There's no need …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@d18afb8
|
7 years |
thomas2.klute |
Ensure that dbm_cache_fetch() does not return expired data
The cache …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@c6572ec
|
7 years |
thomas2.klute |
Apply default cache timeout to OCSP responses without nextUpdate
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@c55902b
|
7 years |
thomas2.klute |
Trigger cache expiration on fetch, small restructuring
In a situation …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@c005645
|
7 years |
thomas2.klute |
Mutex for DBM cache access
I noticed that with a DBM cache enabled …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@eb63377
|
7 years |
thomas2.klute |
Check only expiration time for OCSP responses from cache
Responses …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@366d1a1
|
7 years |
thomas2.klute |
Use nextUpdate field of OCSP response to set cache lifetime
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@08817d0
|
7 years |
thomas2.klute |
Check OCSP response before caching
Only verified responses should be …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@368e581
|
7 years |
thomas2.klute |
Update OCSP response cache only if response is missing or invalid
…
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@4bf4ce2
|
7 years |
thomas2.klute |
Use GCC builtins to catch overflows with mixed integer types
…
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@6b4136c
|
7 years |
thomas2.klute |
Store OCSP responses in DBM cache before use
This is not proper …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@2f932fa
|
7 years |
thomas2.klute |
Use gnutls_datum_t to pass DBM keys for GnuTLS sessions
The APR …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@6814e48
|
7 years |
thomas2.klute |
Explain the different signatures of the dbm_cache functions
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@15245bf
|
7 years |
thomas2.klute |
Split dbm_cache_fetch() in generic and GnuTLS session specific parts
…
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@1d1361f
|
7 years |
thomas2.klute |
Make dbm_cache_store() work outside connection context
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@ae08186
|
7 years |
thomas2.klute |
DBM cache: Separate session caching and generic store operation
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@f785704
|
7 years |
thomas2.klute |
Make dbm_cache_expire() work outside connection context
DBM cache …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@04e6e65
|
7 years |
thomas2.klute |
Move declarations of cache-related functions to a dedicated header
…
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@7511bfa
|
7 years |
thomas2.klute |
Use ap_log_cerror() instead of ap_log_error() where reasonable
…
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@8913410
|
7 years |
thomas2.klute |
Update copyright headers
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@c3ad933
|
7 years |
thomas2.klute |
Remove stale support code for Apache versions before 2.2
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@fd6bb19
|
7 years |
thomas2.klute |
Extract OCSP access URI from the server certificate
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@4ae7810
|
7 years |
thomas2.klute |
Log port along with hostname if OCSP trust list initialization fails
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@68ce93c
|
7 years |
thomas2.klute |
Rearrange mgs_get_ocsp_response() for readability
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@fad7695
|
7 years |
thomas2.klute |
Store OCSP trust list in server config
This avoids recreating the …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@64856fd
|
7 years |
thomas2.klute |
Get rid of exit(-1) calls in mgs_hook_post_config()
This allows the …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@2a1ffd6
|
7 years |
thomas2.klute |
Move trust list generation for OCSP to a separate function
The new …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@d35b98e
|
7 years |
thomas2.klute |
Check OCSP response and staple it only if good
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@94cb972
|
7 years |
thomas2.klute |
Minimal OCSP stapling implementation using externally provided …
asynciodebian/masterdebian/stretch-backportsproxy-ticketupstream
|
|
|
@0bda20f
|
7 years |
thomas2.klute |
Make "make distcheck" work
This requires strict DIST/DISTCLEAN lists …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@eb34ac4
|
7 years |
thomas2.klute |
Let Automake handle module installation
Using a custom pkglib …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@19f2719
|
7 years |
thomas2.klute |
Update comments and formating in push/pull functions
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@a9fa300
|
7 years |
thomas2.klute |
Set GnuTLS session errno on all error paths in mgs_transport_read()
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@6868585
|
7 years |
thomas2.klute |
Remove unnecessary session pointer check
The transport functions are …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@be41ee4
|
7 years |
thomas2.klute |
Set GnuTLS session errno on errors in mgs_transport_write()
Sunil …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@8ac7c0d
|
7 years |
thomas2.klute |
Register "ssl_is_https" function for compatibility with mod_rewrite
…
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@bc539d5
|
7 years |
thomas2.klute |
Implement short message for mod_status reports
Until now the flags …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@600cf16
|
7 years |
thomas2.klute |
mgs_status_hook: Remove code for GnuTLS versions < 3
mod_gnutls …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@73b0bf0
|
7 years |
thomas2.klute |
mgs_filter_input: Use APR_STATUS_IS macros instead of integer comparison
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@a2368a4
|
7 years |
thomas2.klute |
Use TLS session cleanup hook for all connection pools
If a TLS …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@2ceb836
|
7 years |
thomas2.klute |
Update log messages on session termination (cleanup_gnutls_session, …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@401a0de
|
7 years |
thomas2.klute |
Close TLS session on EOF in input filter
If the input filter receives …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@f5a36ee
|
7 years |
thomas2.klute |
Pass EAGAIN/EINTR from gnutls_io_input_read to input filter
…
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@02a6a18
|
7 years |
thomas2.klute |
gnutls_io.c: Don't mix EAGAIN and EINTR in mgs_transport_read
…
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@dff03fa
|
7 years |
thomas2.klute |
Configure C99 mode
Variable declarations in for loops improve code …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@9ca1f21
|
7 years |
thomas2.klute |
Allow loading more than one PKCS #11 module using GnuTLSP11Module
…
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@88df24d
|
7 years |
thomas2.klute |
Replace "SSL" with "TLS" in config directive descriptions
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@176047e
|
7 years |
thomas2.klute |
Use AP_INIT_FLAG for On/Off? config directives
Letting the Apache …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@7764015
|
7 years |
thomas2.klute |
Update GnuTLSP11Module documentation for stricter semantics
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@746e993
|
7 years |
thomas2.klute |
Formatting fix for PKCS #11 module loading
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@f21d2a6
|
7 years |
thomas2.klute |
Changed the semantics of GnuTLSP11Module
That setting instructs …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@efd3cfe
|
8 years |
thomas2.klute |
Whitespace fix in gnutls_hooks.c
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@99f8375
|
8 years |
thomas2.klute |
Ensure safe defaults during client verification
Initialize the …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@dfd5837
|
8 years |
thomas2.klute |
Log possible error messages from gnutls_bye
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@ee687ab
|
8 years |
thomas2.klute |
Update README and post-install documentation hint
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@e021722
|
8 years |
thomas2.klute |
Update copyright headers for Nikos Mavrogiannopoulos' PKCS #11 patch
…
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@e391197
|
8 years |
thomas2.klute |
Update copyright headers for C source
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@a2e3c33
|
8 years |
thomas2.klute |
Rename option SSLProxyEngine to GnuTLSProxyEngine
This matches the …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@e765670
|
8 years |
thomas2.klute |
Fix signature of mgs_cache_child_init when building without …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@87f1ed2
|
8 years |
thomas2.klute |
Allow loading of an additional PKCS #11 provider library
When using …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@4133f2d
|
8 years |
thomas2.klute |
Unify argument handling in mgs_set_priorities
Just store the argument …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@2cde026d
|
8 years |
thomas2.klute |
Merge branch 'new-gnutls-api'
Merge my TLS proxy implementation with …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@73f6f12
|
8 years |
thomas2.klute |
Check handshake result before logging "TLS connection opened"
Without …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@f030883
|
8 years |
thomas2.klute |
Set GnuTLS priorities for proxy connections separately
Until now, …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@d04f7da
|
8 years |
thomas2.klute |
Version guards for gnutls_privkey_import_openpgp_raw workaround
The …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@8b472af
|
8 years |
thomas2.klute |
Use server root for file paths in TLS proxy config
This is what users …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@2cde8111
|
8 years |
thomas2.klute |
Workarounds for OpenPGP key handling
Commit …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@01b5d85
|
8 years |
thomas2.klute |
Merge branch 'client-verify-fix' into new-gnutls-api
Merge the fix …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@c4a015b
|
8 years |
thomas2.klute |
Merge branch 'split-testsuite' into new-gnutls-api
OpenPGP support is …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@259e835
|
8 years |
thomas2.klute |
Merge branch 'master' into new-gnutls-api
Branch 'master' at this …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@1d9cfaf
|
8 years |
thomas2.klute |
gnutls_config.c: Backport function signature changes from master
…
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@809c422
|
8 years |
thomas2.klute |
TLS proxy: Add support for CRLs to back end server verification
When …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@bd24203
|
8 years |
thomas2.klute |
Explicitly build trust list for proxy connections
This change …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@7d2123d
|
8 years |
thomas2.klute |
Log errors while loading proxy certificate trust list
The way the …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@6bbc00a
|
8 years |
thomas2.klute |
Check hostname of proxy back end server against certificate
…
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@0de1839
|
8 years |
thomas2.klute |
Support X.509 auth for TLS proxy connections
This commit adds support …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@7314438
|
8 years |
thomas2.klute |
Fix whitespace problems detected by git
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@b324906
|
8 years |
thomas2.klute |
Merge branch 'client-verify-fix' into tls-proxy
Most importantly, …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@5a8a32b
|
8 years |
thomas2.klute |
TLS Client auth: Check server verify mode if unset for dir
The …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@b429e4c
|
8 years |
thomas2.klute |
Cleanup handler for proxy TLS connections
When handling client …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@d7a8286
|
8 years |
thomas2.klute |
Remove debug log messages for allocating connection config memory
…
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@265eafc
|
8 years |
thomas2.klute |
gnutls_io.c: Log connection start/end and unusual input filter events
…
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@4261999
|
8 years |
thomas2.klute |
gnutls_io_input_read: Retry gnutls_record_recv if necessary
While …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@398d1a0
|
8 years |
thomas2.klute |
Improved logging for gnutls_io_input_read
* Log if something tried to …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@4fefa39
|
8 years |
thomas2.klute |
src/gnutls_io.c: Reformat gnutls_io_filter_error for readability
No …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@beb14d9
|
8 years |
thomas2.klute |
Proof of concept: Support for proxy back end connections using TLS
…
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@c1ef069
|
8 years |
thomas2.klute |
Record if a connection is a proxy connection
When handling a proxy …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@5342265
|
8 years |
thomas2.klute |
Close last for loop in mgs_find_sni_server
The closing brace for the …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@07d548d
|
8 years |
thomas2.klute |
Properly use SSLProxyEngine option
ssl_proxy_enable now checks if …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@accbb83
|
8 years |
thomas2.klute |
mod_gnutls.c: Whitespace and line break fixes
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@c782c1f
|
8 years |
thomas2.klute |
Don't do global deinit when disabling TLS for a proxy back end …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@e8acf05
|
8 years |
thomas2.klute |
Enable/disable TLS per connection in ssl_engine_disable
Previously, …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@e4b58b6
|
8 years |
thomas2.klute |
Check error codes during GnuTLS connection init
These calls shouldn't …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@3d361b8
|
8 years |
thomas2.klute |
Check if filters exist before removing them in ssl_engine_disable
…
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@64dadf8
|
8 years |
thomas2.klute |
Use proper GNUTLS_ENABLED_* macros in SSL proxy functions
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@031acac
|
9 years |
nmav |
Use the new (3.1.3+) GnuTLS APIs to obtain private keys.
This allows …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@fd82e59
|
9 years |
dkg |
use strict compiler arguments by default (-Wall -Werror -Wextra)
…
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@765cac2
|
9 years |
dkg |
clean up MGS_SIDE abuse of apr_pstrcat
We were allocating twice as …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|
@2aaf4f5
|
9 years |
dkg |
implement GnuTLSExportCertificates control over max exported cert size …
asynciodebian/masterdebian/stretch-backportsjessie-backportsproxy-ticketupstream
|
|
|