summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2018-10-17Testsuite: force non-TLSv1.3 for (OpenSSL) cert-variable testJeremy Harris
This maintains visibility of the cert choice required by the auth-method configuration. Leave the bogus results from pre-1.1.1 OpenSSL library bug while the fixed version is not in common use.
2018-10-14tidyingJeremy Harris
2018-10-14Testsuite: client script faciility for handling optional reponsesJeremy Harris
Use this to deal with fallout from TLS negotiation failure, where the server sees leftover encrypted data as garbage commands.
2018-10-14OpenSSL: Enhance connect/accept-time debugJeremy Harris
Also, use safer interface for error-strings.
2018-10-13Testsuite: tidyingJeremy Harris
2018-10-12Fix Mac buildJeremy Harris
Broken-by: 75c121f07a
2018-10-12Fix OpenBSD build.Jeremy Harris
Broken-by: 75c121f07a
2018-10-12Increase buffer size used for DNS responses. Bug 2329Jeremy Harris
2018-10-12tidyingJeremy Harris
2018-10-12Rename smtp.client-ip to smtp.remote-ipPhil Pennock
This tracks changes in the ARC draft. The Received-SPF headers remain unchanged.
2018-10-08Debug: output GnuTLS verbose reason for certificate verify refusalJeremy Harris
2018-10-06Testsuite: more TLSv1.3 handlingJeremy Harris
2018-10-06Docs: tweak ARC descriptionJeremy Harris
2018-10-06TFO: use enum for client statusJeremy Harris
2018-10-02Debug: noutf8 selector. Bug 2324Jeremy Harris
2018-09-30Testsuite: enhance json extract testsJeremy Harris
2018-09-30Expansions: fix json extract for de-wrapping nested objects. Bug 2322Jeremy Harris
2018-09-30Expansions: extract methods for JSON objects and arrays. Bug 2282Jeremy Harris
2018-09-29Events: tests. Bug 2322Jeremy Harris
2018-09-28Events: Fire msg:fail:internal for a non-system filter "fail" command. Bug ↵Matthias Kurz
2322
2018-09-28Events: Fire msg:fail:delivery event even when error is being ignored. Bug ↵Matthias Kurz
2314
2018-09-26Logging: do not log a missing proxy address, on delivery non-proxied.Jeremy Harris
Broken-by: e6d2a9894d
2018-09-23Check return from asprintf()Jeremy Harris
2018-09-23DSN: tescase for ESMTP DSN extension, RCPT optionsJeremy Harris
2018-09-21OpenSSL: Check return value from X509_NAME_oneline(). Bug 2316Jeremy Harris
It didn't used to be documented as possibly returning NULL, but now it is.
2018-09-21DANE: ignore undersized TLSA recordsJeremy Harris
2018-09-21Testsuite: output changes resultingJeremy Harris
2018-09-21Testsuite: timing change needed for debug changesJeremy Harris
Broken-by: 8008accd32
2018-09-20Testsuite: handle OpenSSL 1.1.1Jeremy Harris
2018-09-20Builtin macros for OpenSSL optionsJeremy Harris
2018-09-19ConstificationJeremy Harris
2018-09-19Testsuite: output changes resulting from timing change.Jeremy Harris
Broken-by: 8008accd32
2018-09-18Testsuite: track newer GnuTLS behaviourJeremy Harris
We have lost one log line, for a ciphers-negotiation failure on an early host in a list from routing. We still get something indicative if the last one fails, so I'm going to let this pass. Test 2025 will fail on earlier GnuTLS library versions as a result. NONE no longer works as documented, in priority string for GnuTLS.
2018-09-18GnuTLS: simplify cert hostname checkingJeremy Harris
2018-09-17ConstificationJeremy Harris
2018-09-17DANE: fix TA-mode verify under GnuTLS. Bug 2311Jeremy Harris
2018-09-17Avoid fixed-size buffers for file paths in DB openJeremy Harris
2018-09-17Events: raise msg:fail:internal & msg:complete for -Mrm. Bug 2310Matthias Kurz
2018-09-16testsuite output changesJeremy Harris
2018-09-16Fix filter noerror command. Bug 2318Matthias Kurz
2018-09-16Tidying and compiler-silencingJeremy Harris
2018-09-14tests: propagate CPPFLAGS into build invocationsPhil Pennock
With openssl installed by brew on macOS, OpenSSL headers are not in a normal place. I can fiddle with LDFLAGS/CPPFLAGS to get them available, but then the `./configure` step succeeds and build fails. Propagating the CPPFLAGS into the generated Makefile lets the build succeed and we get a `client-ssl` binary output.
2018-09-14Restore Darwin OS configurationPhil Pennock
MacStadium are providing us with free Mac Mini hosting as part of their FOSS support. I'm about to set it up. Let's have out-of-repo tuning in place before I begin.
2018-09-13Check returncode from SSL_CTX_set_cipher_list()Jeremy Harris
2018-09-10Unbreak test 0600 (copy/paste error)Phil Pennock
2018-09-10Docs: document ancillary info for more event types. Bug 2313Matthias Kurz
Patch from Matthias, with additional code indentation tweaks from JGH
2018-09-09docs: unbreak spec buildPhil Pennock
I've created a homebrew tap with sdop and xfpt in it, so I can install those more easily on macOS in the future, and now have bothered actually building the docs. `.url()` should have been `&url()` in two places. The `make spec.pdf` pipeline yields a document where those are not clickable links, but if i use `make spec.ps` and let macOS auto-convert to PDF upon open, those are proper clickable hyperlinks. So this switch is definitely for the better.
2018-09-09DANE - testcase for fail under GnuTLS with TA-mode to a selfsigned server certJeremy Harris
2018-09-09Docs: more indexing of affix-related bitsJeremy Harris
2018-09-07Fix broken doc links and http→https where possiblePhil Pennock
I got a cookie-cutter email from folks noting the modssl.org doc links were broken and asking us to use their site instead, which was both helpful and a rather heavy page with advertising on it, so not something I want our docs to link to. Fixed the modssl link to point to the correct current Apache docs, since mod_ssl has not been a separate project for … a very long time. Audited every `http:` link in the Spec, replacing with https if available, updating URLs as needed, or trimming deadwood as appropriate. This did edit one license text, but in a way which I believe is reasonable and in the license holder's best interests. * Use comments with a datestamp for any remaining http: URLs, showing when they were last audited * Suggest migrating away from Berkeley DB. * Drop mention of a patched `pam_unix` module which is no longer available. * In revamping the CDB tools links, add my own tools. * Redo the intro text for the mod_ssl stuff (first person voice of PH). * Rescorla's book's online examples appear to be gone; drop mention of them and point to Ristić's more recent book too. * Point to wikipedia list of DNSxL services as an overview, in part because I dropped the reference to the defunct rfc-ignorant.org and there was no good candidate as an exemplar for domain-based lists. * Note that mksd is a candidate for removal from Exim since mks_vir is dead. * Drop LogReport/lire reference (dead/gone and can't find it). * Redo proxy protocol spec-linking text. * Replace FAQ A1701 with text saying "don't do that" (self-signed certs) and just telling people to use a CA instead, pointing strongly to Let's Encrypt. We did nobody any favors with that old text still being present today (it was entirely appropriate when written).
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-08 16:09:04 +0000