aboutsummaryrefslogtreecommitdiff
path: root/contrib
Commit message (Collapse)AuthorAgeFilesLines
...
| * | | Don't use -march=nativeHoward Chu2019-06-121-0/+1
| | | |
* | | | Merge pull request #5552luigi11112019-06-121-2/+2
|\ \ \ \ | |/ / / |/| | | | | | | c27d961 [depends] update openssl to 1.0.2r (who-biz)
| * | | [depends] update openssl to 1.0.2rwho-biz2019-05-181-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - This addresses https://www.openssl.org/news/secadv/20190226.txt (CVE: 2019-1559) which impacted all versions of openssl-1.0. Note that this does not address CVE-2019-1543 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1543), which impacts all versions of openssl 1.1 through 1.1.0j and 1.1.1b. The above (1.1) is patched in openssl, where it was marked as low severity. Similar issues possibly present in monero, should be looked into w.r.t. CVE-2019-1543.
* | | | Merge pull request #5618luigi11112019-06-111-6/+4
|\ \ \ \ | | | | | | | | | | | | | | | b0a04f7 epee: fix SSL autodetect on reconnection (xiphon)
| * | | | epee: fix SSL autodetect on reconnectionxiphon2019-06-101-6/+4
| |/ / /
* | / / Fix GCC 9.1 build warningsmoneromooo-monero2019-06-091-0/+5
| |/ / |/| | | | | | | | GCC wants operator= aand copy ctor to be both defined, or neither
* | | Add ssl_options support to monerod's rpc mode.Lee Clagett2019-05-221-0/+38
|/ /
* | Merge pull request #5539Riccardo Spagni2019-05-153-106/+136
|\ \ | | | | | | | | | | | | | | | | | | | | | 3f612cda Changed odd bullet point to low level header (Rohaq) af9bc4ec Used subeaders to avoid slightly wonky looking formatting (Rohaq) 1873af35 Made code block usage consistent across all .md files (Rohaq) 68103075 Updated Copyright notice (Rohaq) 39bd157f Added Table of Contents to main README.md (Rohaq)
| * | Made code block usage consistent across all .md filesRohaq2019-05-123-106/+136
| |/
* | Merge pull request #5527luigi11112019-05-141-2/+2
|\ \ | | | | | | | | | 9a7a453 net_ssl: free certs after setting them up (moneromooo-monero)
| * | net_ssl: free certs after setting them upmoneromooo-monero2019-05-101-2/+2
| |/
* | Merge pull request #5519luigi11112019-05-141-1/+1
|\ \ | |/ |/| | | | | b8b957d cmake: fix incorrect hint for OPENSSL_ROOT_DIR (moneromooo-monero) 367bb80 mlog: default to not showing SSL errors (moneromooo-monero)
| * mlog: default to not showing SSL errorsmoneromooo-monero2019-05-061-1/+1
| |
* | Merge pull request #5509Riccardo Spagni2019-05-072-4/+128
|\ \ | | | | | | | | | a62e0725 net_ssl: SSL config tweaks for compatibility and security (moneromooo-monero)
| * | net_ssl: SSL config tweaks for compatibility and securitymoneromooo-monero2019-05-072-4/+128
| |/ | | | | | | | | | | | | | | | | | | add two RSA based ciphers for Windows/depends compatibility also enforce server cipher ordering also set ECDH to auto because vtnerd says it is good :) When built with the depends system, openssl does not include any cipher on the current whitelist, so add this one, which fixes the problem, and does seem sensible.
* | Merge pull request #5499Riccardo Spagni2019-05-071-0/+236
|\ \ | | | | | | | | | a4c4a2d8 blockchain: keep a rolling long term block weight median (moneromooo-monero)
| * | blockchain: keep a rolling long term block weight medianmoneromooo-monero2019-05-021-0/+236
| | |
* | | Merge pull request #5419Riccardo Spagni2019-05-076-5/+87
|\ \ \ | |_|/ |/| | | | | f29fecd5 build: debug and test builds via contrib (Dusan Klinec)
| * | build: debug and test builds via contribDusan Klinec2019-04-106-5/+87
| | |
* | | change SSL certificate fingerprint whitelisting from SHA1 to SHA-256moneromooo-monero2019-04-262-1/+3
| |/ |/| | | | | SHA1 is too close to bruteforceable
* | Merge pull request #5482Riccardo Spagni2019-04-241-0/+1
|\ \ | | | | | | | | | 9956500d net_helper: clear recv buffer on eof (moneromooo-monero)
| * | net_helper: clear recv buffer on eofmoneromooo-monero2019-04-231-0/+1
| | |
* | | Merge pull request #5479Riccardo Spagni2019-04-241-1/+1
|\ \ \ | | | | | | | | | | | | edbae2d0 levin_protocol_handler_async: tune down preallocation a fair bit (moneromooo-monero)
| * | | levin_protocol_handler_async: tune down preallocation a fair bitmoneromooo-monero2019-04-221-1/+1
| |/ / | | | | | | | | | | | | | | | It can allocate a lot when getting a lot of connections (in particular, the stress test on windows apparently pushes that memory to actual use, rather than just allocated)
* / / serialization: set default log categorymoneromooo-monero2019-04-213-1/+7
|/ /
* | epee: use boost/timer/timer.hpp, boost/timer.hpp is deprecatedmoneromooo-monero2019-04-181-1/+1
| |
* | Merge pull request #5447Riccardo Spagni2019-04-161-0/+34
|\ \ | | | | | | | | | 02c01c0b Add Brewfile to allow for an even easier management of dependencies (Florian)
| * | Add Brewfile to allow for an even easier management of dependenciesFlorian2019-04-151-0/+34
| | |
* | | Merge pull request #5445Riccardo Spagni2019-04-161-0/+12
|\ \ \ | | | | | | | | | | | | b18f0b10 wallet: new --offline option (moneromooo-monero)
| * | | wallet: new --offline optionmoneromooo-monero2019-04-151-0/+12
| |/ / | | | | | | | | | | | | It will avoid connecting to a daemon (so useful for cold signing using a RPC wallet), and not perform DNS queries.
* | | Merge pull request #5436Riccardo Spagni2019-04-161-3/+4
|\ \ \ | | | | | | | | | | | | 61d63900 net_helper: avoid unnecessary memcpy (moneromooo-monero)
| * | | net_helper: avoid unnecessary memcpymoneromooo-monero2019-04-131-3/+4
| | | |
* | | | Merge pull request #5432Riccardo Spagni2019-04-162-2/+9
|\ \ \ \ | |_|/ / |/| | | | | | | c3cf930f abstract_tcp_server2: fix timeout on exit (moneromooo-monero)
| * | | abstract_tcp_server2: fix timeout on exitmoneromooo-monero2019-04-122-2/+9
| |/ / | | | | | | | | | | | | | | | When closing connections due to exiting, the IO service is already gone, so the data exchange needed for a gracious SSL shutdown cannot happen. We just close the socket in that case.
* | | Merge pull request #5369Riccardo Spagni2019-04-152-2/+2
|\ \ \ | |/ / |/| | | | | e72c2c5d do not build in parallel as it is non-deterministic (Jane Mercer)
| * | do not build in parallel as it is non-deterministicJane Mercer2019-03-292-2/+2
| | |
* | | epee: init a new ssl related variable in ctormoneromooo-monero2019-04-111-0/+1
| | |
* | | simplewallet: new net_stats commandmoneromooo-monero2019-04-112-2/+30
| | | | | | | | | | | | displays total sent and received bytes
* | | Enabling daemon-rpc SSL now requires non-system CA verificationLee Clagett2019-04-072-0/+22
| | | | | | | | | | | | | | | If `--daemon-ssl enabled` is set in the wallet, then a user certificate, fingerprint, or onion/i2p address must be provided.
* | | Require manual override for user chain certificates.Lee Clagett2019-04-072-1/+5
| | | | | | | | | | | | | | | | | | | | | An override for the wallet to daemon connection is provided, but not for other SSL contexts. The intent is to prevent users from supplying a system CA as the "user" whitelisted certificate, which is less secure since the key is controlled by a third party.
* | | Only check top-level certificate against fingerprint list.Lee Clagett2019-04-071-2/+4
| | | | | | | | | | | | | | | | | | | | | This allows "chain" certificates to be used with the fingerprint whitelist option. A user can get a system-ca signature as backup while clients explicitly whitelist the server certificate. The user specified CA can also be combined with fingerprint whitelisting.
* | | Call `use_certificate_chain_file` instead of `use_certificate_file`Lee Clagett2019-04-071-1/+1
| | | | | | | | | | | | | | | | | | The former has the same behavior with single self signed certificates while allowing the server to have separate short-term authentication keys with long-term authorization keys.
* | | Perform RFC 2818 hostname verification in client SSL handshakesLee Clagett2019-04-073-5/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If the verification mode is `system_ca`, clients will now do hostname verification. Thus, only certificates from expected hostnames are allowed when SSL is enabled. This can be overridden by forcible setting the SSL mode to autodetect. Clients will also send the hostname even when `system_ca` is not being performed. This leaks possible metadata, but allows servers providing multiple hostnames to respond with the correct certificate. One example is cloudflare, which getmonero.org is currently using.
* | | Require server verification when SSL is enabled.Lee Clagett2019-04-072-11/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If SSL is "enabled" via command line without specifying a fingerprint or certificate, the system CA list is checked for server verification and _now_ fails the handshake if that check fails. This change was made to remain consistent with standard SSL/TLS client behavior. This can still be overridden by using the allow any certificate flag. If the SSL behavior is autodetect, the system CA list is still checked but a warning is logged if this fails. The stream is not rejected because a re-connect will be attempted - its better to have an unverified encrypted stream than an unverified + unencrypted stream.
* | | Add `verify_fail_if_no_cert` option for proper client authenticationLee Clagett2019-04-071-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | Using `verify_peer` on server side requests a certificate from the client. If no certificate is provided, the server silently accepts the connection and rejects if the client sends an unexpected certificate. Adding `verify_fail_if_no_cert` has no affect on client and for server requires that the peer sends a certificate or fails the handshake. This is the desired behavior when the user specifies a fingerprint or CA file.
* | | Pass SSL arguments via one class and use shared_ptr instead of referenceLee Clagett2019-04-079-166/+228
| | |
* | | Do not require client certificate unless server has some whitelisted.Lee Clagett2019-04-061-12/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently a client must provide a certificate, even if the server is configured to allow all certificates. This drops that requirement from the client - unless the server is configured to use a CA file or fingerprint(s) for verification - which is the standard behavior for SSL servers. The "system-wide" CA is not being used as a "fallback" to verify clients before or after this patch.
* | | Change SSL certificate file list to OpenSSL builtin load_verify_locationLee Clagett2019-04-067-76/+65
| |/ |/| | | | | | | | | | | | | | | | | | | | | | | Specifying SSL certificates for peer verification does an exact match, making it a not-so-obvious alias for the fingerprints option. This changes the checks to OpenSSL which loads concatenated certificate(s) from a single file and does a certificate-authority (chain of trust) check instead. There is no drop in security - a compromised exact match fingerprint has the same worse case failure. There is increased security in allowing separate long-term CA key and short-term SSL server keys. This also removes loading of the system-default CA files if a custom CA file or certificate fingerprint is specified.
* | Merge pull request #5375Riccardo Spagni2019-04-061-0/+1
|\ \ | | | | | | | | | 1569776a Add missing include (Leon Klingele)
| * | Add missing includeLeon Klingele2019-03-311-0/+1
| |/
generated by cgit v1.2.3 (git 2.51.0) at 2026-08-17 18:54:52 +0000