lighttpd
/
lighttpd1.4
2
0
Fork 0
Code Issues Releases Wiki Activity
3,743 Commits 9 Branches 87 Tags 16 MiB
Commit Graph

23 Commits

Author SHA1 Message Date
Glenn Strauss 915b4ef3fc [multiple] fix TLS config string parsing 
flagged by coverity

(incomplete fix a few commits back)
 2021-01-17 15:50:28 -05:00
Glenn Strauss d5b166c04d [multiple] fix TLS config string parsing 
flagged by coverity

final segment of colon (':') separated string was being ignored
in some TLS config strings in mod_gnutls and mod_mbedtls

workaround: add ':' at end of config string (or apply this patch)
 2021-01-17 14:33:19 -05:00
Glenn Strauss 0e2a14921e [multiple] fix coverity warnings 2021-01-17 14:32:46 -05:00
Glenn Strauss 3088c76c8c [mod_mbedtls] use local strncmp_const() 
On some older gcc, strncmp is a macro and expects three arguments,
but does not see expansion of lighttpd CONST_STR_LEN() macro before
warning/error about incorrect number of arguments
 2020-12-28 09:13:21 -05:00
Glenn Strauss 171a064036 [mod_mbedtls] include mbedtls/platform_util.h 
include mbedtls/platform_util.h for mbedtls_platform_zeroize()
(instead of relying on an indirect include)

(fixes build with (very old) mbedtls-2.14.0)
 2020-12-28 08:54:50 -05:00
Glenn Strauss 1212f60991 buffer_append_path_len() to join paths 
use buffer_append_path_len() to join path segments
 2020-12-24 16:13:20 -05:00
Glenn Strauss 6fb63fa8d6 [multiple] include mbedtls/config.h after select 
include mbedtls/config.h crypto lib config
after selecting crypto lib to use
 2020-10-29 16:41:27 -04:00
Glenn Strauss 31fc3a0773 [TLS] server.feature-flags "ssl.session-cache" 
disabled by default, but can be enabled
(session tickets should be preferred)

applies to mod_openssl, mod_wolfssl, mod_nss

session cache is not currently implemented in mod_mbedtls or mod_gnutls
 2020-10-29 01:05:55 -04:00
Glenn Strauss 1d27391c29 [mod_mbedtls] wrap addtl code in preproc defines 
wrap additional code in preprocessor defines to check if enabled in lib
 2020-10-28 22:58:47 -04:00
Glenn Strauss 949662d27e [multiple] add some missing config cleanup 
(thx stbuehler)
 2020-10-24 16:08:21 -04:00
Glenn Strauss 61f7d531eb [mod_mbedtls] newer mbedTLS vers support TLSv1.3 2020-10-24 02:03:05 -04:00
Glenn Strauss f98dff9bc3 [mod_mbedtls] quiet unused variable warning 2020-10-20 23:16:00 -04:00
Glenn Strauss d865d8c330 [TLS] ignore empty "CipherString" in ssl-conf-cmd 
e.g. ssl.openssl.ssl-conf-cmd = ("CipherString" => "")
 2020-10-19 21:40:14 -04:00
Glenn Strauss 496cd8ff44 [mod_mbedtls] quiet CLOSE_NOTIFY after conn reset 
do not log error after connection reset
 2020-10-13 22:31:10 -04:00
Glenn Strauss 874707cd66 [TLS] use fdevent_load_file_bytes() for STEK file 
remove direct dependency on <unistd.h> from lighttpd TLS modules
 2020-10-11 12:19:27 -04:00
Glenn Strauss 16a70b9253 [multiple] TLS modules use chunkqueue_peek_data() 2020-10-11 12:19:27 -04:00
Glenn Strauss a330746f06 [TLS] error if inherit empty TLS cfg from globals 
error if $SERVER["socket"] inherits empty TLS config from global scope
and ssl.engine = "enable" in the $SERVER["socket"]
 2020-10-11 12:19:26 -04:00
Glenn Strauss bbcc2f229a [multiple] allow TLS ALPN "h2" if "server.h2proto" 2020-10-03 09:05:38 -04:00
Glenn Strauss 33c8cf41db [multiple] rename connection_reset hook to request 
rename connection_reset to handle_request_reset
 2020-08-02 07:47:41 -04:00
Glenn Strauss 164f7600b7 [multiple] con hooks store ctx in con->plugin_ctx 
modules with connection level hooks now store ctx in con->plugin_ctx
 2020-08-02 07:47:41 -04:00
Glenn Strauss 0ad57da55b [mod_openssl,mbedtls,gnutls,nss] fdevent_load_file 
employ fdevent_load_file() to load CRL, X509 cert, and private key files
into memory
 2020-07-08 22:51:32 -04:00
Glenn Strauss 3e2e8e6d29 [mod_mbedtls] ssl.stek-file to specify encrypt key 
difference from mod_openssl:

Admin should schedule an independent job to periodically
generate a new STEK up to 2 times during key lifetime
(mbedtls internals store up to 2 keys)

(more details in prior commit message for mod_openssl)
 2020-07-08 22:51:31 -04:00
Glenn Strauss cb753ec5b5 [mod_mbedtls] mbedTLS option for TLS 
(experimental)

mod_mbedtls supports most ssl.* config options supported by mod_openssl

thx Ward Willats for the initial discussion and attempt in the comments
  https://redmine.lighttpd.net/boards/3/topics/7029
 2020-07-08 22:51:31 -04:00