Fix #1146 + some coding style cleanups #1156
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Fix #1033: Change header name format in HTTP tables configuration.
Fix #772: Change 'keepalive' and 'client_body' timeouts applying.
The page is used later as skb page fragment in TLS handshake. 2. Cleanups in PEM decoder. 3. Remove DHM routines called only for FS IO (unused). 4. Revert DTLS routines (dirty code) as it's supposed to used them for QUIC.
Fix #900: Change some comments and add unit tests.
2. Make GFSM traverse skb list and call a FSM for each skb. TLS layer must collect skbs before decryption to have AEAD tag, so it sends list of decrypted skbs to HTTP layer by GFSM call. However, HTTP manages skb list on it's own. 3. Make ttls_decrypt() to work with plain buffers as well as fragmented skbs; 4. Some cleanups.
SIMD crypto algorithms won't be called through cryptd. Some cleanups.
tfw_gfsm_switch() can be called multiple times during tfw_gfsm_move() call. After each tfw_gfsm_switch() call current FSM is switched to FSM stated in fsm_hooks. Thus FSM(st) actually points on child FSM state, not parent one.
Fix review comments for #1037
Fix build of TLS module
Various backup file copies were accidentally added to the repo.
remove rebase artifacts
Sanitize Content-Type for multipart/form-data requests
* req->vhost is expected to be non-NULL, as it was checked before; * disallow multiple instances of http_post_validate at topmost level; * a typo.
follow-up changes (see #1139)
Replace void ptr by union
Instead of distinct flag, TFW_HTTP_CONN_CLOSE flags is set to close client connection. The reason for a change is message adjusting on forwarding. The 'Connection: ' header should be properly set.
…tely, serve all pending requests first Fix #962
ss_close_sync() was replaced by tfw_connection_close() in current master.
Fixes on serving requests with errors
…llo, while we still don't know the cipher suite. So calculate two checksums in parallel and copy SHA256 contex if necessary when ClientHello sets xfrm.ciphersuite_info. The rest of the patch, besides ttls_update_checksum() changes, is coding style adjustments.
|
Didn't finish the review yet. But it seems that the issue is still here. I've tried to run tests on the CI, and crash on |
|
May be related: #1157 . There also a lot of warnings in kernel log during the test. Please see |
aleksostapenko
approved these changes
Jan 26, 2019
| sizeof(*sha256)); | ||
| bzero_fast(&hs->ecdh_ctx, sizeof(ttls_ecdh_context)); | ||
| } | ||
|
|
There was a problem hiding this comment.
Redundant empty line.
| * @key_cert - chosen key/cert pair (server); | ||
| * @sni_key_cert - key/cert list from SNI; | ||
| * @sni_ca_chain - trusted CAs from SNI callback; | ||
| * @sni_ca_crt - trusted CAs CRLs from SNI; |
There was a problem hiding this comment.
sni_ca_crt -> sni_ca_crl
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fix #1146: ttls_update_checksum() can be called for chunk of ClientHello,
while we still don't know the cipher suite. So calculate two checksums
in parallel and copy SHA256 contex if necessary when ClientHello
sets xfrm.ciphersuite_info.
The rest of the patch, besides ttls_update_checksum() changes, is
coding style adjustments.