Tatsuhiro Tsujikawa
3297a303bf
nghttpx: Add client auth options for session cache memcached TLS connection
2016-02-13 18:46:07 +09:00
Tatsuhiro Tsujikawa
f1580f95d4
nghttpx: Add TLS support for session cache memcached connection
2016-02-13 18:46:07 +09:00
Tatsuhiro Tsujikawa
82f942c3a3
nghttpx: Parameterize configuration values for client side TLS context
2016-02-11 18:34:31 +09:00
Tatsuhiro Tsujikawa
6d49110a33
Rename FrontendAddr as UpstreamAddr
2016-02-07 17:51:53 +09:00
Tatsuhiro Tsujikawa
2e38208d74
nghttpx: Fixups for HTTP/1 backend TLS support
2016-02-07 17:43:30 +09:00
Tatsuhiro Tsujikawa
bb4e2f6a24
nghttpx: Add TLS support for HTTP/1 backend
2016-02-07 17:43:30 +09:00
Tatsuhiro Tsujikawa
5e9bcbec9a
nghttpx: Fix bug that IPv6 address in Forwarded "for" is not quoted-string
2016-02-01 23:29:17 +09:00
Tatsuhiro Tsujikawa
aa07fe7fa6
nghttpx: Support multiple frontend addresses
...
This commit allows nghttpx to listen to multiple address and port pair
by specifying -f option multiple times.
2016-02-01 23:10:29 +09:00
Tatsuhiro Tsujikawa
9ac3e643d8
Revert "nghttpx: Add --curves option to specify supported elliptic curves"
...
This reverts commit e278893b64
.
SSL_CONF_CTX functions are not working correctly with OpenSSL 1.0.2.
It requires 1.1.0 to make it work.
2016-01-21 19:50:38 +09:00
Tatsuhiro Tsujikawa
e278893b64
nghttpx: Add --curves option to specify supported elliptic curves
2016-01-21 18:23:13 +09:00
Tatsuhiro Tsujikawa
db8de490a0
nghttpx: Omit Forwarded for and by parameter if UNIX domain socket is used
2016-01-19 23:26:04 +09:00
Tatsuhiro Tsujikawa
0402481be4
nghttpx: Organize connection related configuration into struct
2016-01-19 16:56:12 +09:00
Tatsuhiro Tsujikawa
f3e1dc7a4f
nghttpx: Structured TLS related configurations
2016-01-18 14:21:09 +09:00
Tatsuhiro Tsujikawa
3d5f5b6a28
nghttpx: Fix compiler warning
2016-01-17 18:27:25 +09:00
Tatsuhiro Tsujikawa
4f07db8bcb
src: Rename our new string classes
2016-01-17 11:33:45 +09:00
Tatsuhiro Tsujikawa
2c7ed01f0c
nghttpx: Use std::string for Downstream::backend_tls_sni_name
2016-01-17 01:00:15 +09:00
Tatsuhiro Tsujikawa
34d5382d66
nghttpx: Use VString for DownstreamAddr::host and hostport to remember size
2016-01-17 00:52:41 +09:00
Tatsuhiro Tsujikawa
dbbf3a4a10
nghttpx: Refactor TLS hostname match
2016-01-16 23:54:21 +09:00
Tatsuhiro Tsujikawa
248a64f0b2
Compile with OpenSSL 1.1.0-pre1
2015-12-14 21:12:25 +09:00
Tatsuhiro Tsujikawa
d867fe64e3
src: Rename endsWith as ends_with
2015-11-28 00:42:51 +09:00
Tatsuhiro Tsujikawa
de247f7d33
src: Rename startsWith as starts_with
2015-11-28 00:42:51 +09:00
Tatsuhiro Tsujikawa
c6ef1c02b9
Switch to clang-format-3.6
2015-11-13 00:53:29 +09:00
Tatsuhiro Tsujikawa
9b18e47671
nghttpx: Use --backend-tls-sni-field to verify certificate hostname
2015-11-08 00:22:44 +09:00
Tatsuhiro Tsujikawa
f0d2c9f94b
Compile with BoringSSL
...
Compile with BoringSSL except for neverbleed and libnghttp2_asio. The
former uses ENGINE and RSA_METHOD, and they are quite different
between OpenSSL and BoringSSL. The latter uses boost::asio, which
calls OpenSSL functions deleted in BoringSSL.
2015-09-29 23:38:17 +09:00
Tatsuhiro Tsujikawa
566b0476d7
nghttpx: Enable neverbleed for client private key; don't run nb without TLS
2015-09-26 21:28:46 +09:00
Tatsuhiro Tsujikawa
044385ab6e
Add neverbleed support
...
neverbleed is disabled by default. To enable it, use
--with-neverbleed configure option.
2015-09-26 19:01:31 +09:00
Tatsuhiro Tsujikawa
c44587a70c
nghttpx: Use _Exit when exiting from child process
2015-09-24 23:57:24 +09:00
Janusz Dziemidowicz
84f96a2fd5
Do not try to set TCP_NODELAY when frontend is an UNIX socket
...
This silences warning log that otherwise spams logs on every accepted
connection.
2015-09-23 12:22:34 +02:00
Tatsuhiro Tsujikawa
36d562927f
nghttpx: Use nghttp2::ssl::DEFAULT_CIPHER_LIST for backend TLS connection
2015-08-23 23:03:29 +09:00
Tatsuhiro Tsujikawa
1c12606e70
nghttpx: Don't allow blacked listed cipher suites for HTTP/2 connection
2015-08-19 23:42:43 +09:00
Tatsuhiro Tsujikawa
b8f05c89bd
nghttpx: App data in SSL is Connection, not ClientHandler
2015-08-13 00:42:59 +09:00
Tatsuhiro Tsujikawa
ff44e211ed
nghttpx: Fix tls handshake bug
...
This fixes 2 things:
1. potential busy loop
2. disabling ticket is not working after resumption
2015-08-09 18:33:49 +09:00
Tatsuhiro Tsujikawa
d0a37d59a5
nghttpx: Disable TLS session ticket if ticket key is not available
2015-07-29 20:38:49 +09:00
Tatsuhiro Tsujikawa
a1288a5826
nghttpx: Rename --tls-ticket-cipher as --tls-ticket-key-cipher
2015-07-28 23:49:37 +09:00
Tatsuhiro Tsujikawa
a4a9cfd650
nghttpx: Change session cache key prefix
2015-07-27 21:18:12 +09:00
Tatsuhiro Tsujikawa
bb228c27de
Merge branch 'master' into memcached
...
Conflicts:
src/shrpx_ssl.cc
2015-07-27 21:16:02 +09:00
Tatsuhiro Tsujikawa
7152e0f6b8
nghttpx: Fix bug that decrypt only key is not considered
2015-07-27 21:13:02 +09:00
Tatsuhiro Tsujikawa
e3cdfd12ea
nghttpx: Use std::array for TicketKey
2015-07-27 02:12:07 +09:00
Tatsuhiro Tsujikawa
cd25c6846e
nghttpx: Create struct Address which holds struct sockaddr_union and length
2015-07-27 01:41:10 +09:00
Tatsuhiro Tsujikawa
90b4b48c7e
nghttpx: Add shared session cache using memcached
2015-07-26 23:33:06 +09:00
Tatsuhiro Tsujikawa
adec2c06bf
nghttpx: Set SSL/TLS session timeout to 12 hours
2015-07-24 23:59:19 +09:00
Tatsuhiro Tsujikawa
04bd25d468
nghttpx: Simplify ticket handling between workers just using mutex
2015-07-23 23:13:29 +09:00
Tatsuhiro Tsujikawa
a8574fdef2
nghttpx: Use Use std::string instead of std::unique_ptr<char[]> for tls config
2015-07-20 23:15:01 +09:00
Tatsuhiro Tsujikawa
dd8ce1e9d2
nghttpx: Use std::unique_ptr<char[]> instead of raw char pointer
2015-07-20 21:37:23 +09:00
Tatsuhiro Tsujikawa
e8167ceea7
nghttpx: Add AES-256-CBC encryption for TLS session ticket
2015-07-18 02:02:33 +09:00
Tatsuhiro Tsujikawa
6307f96fb3
nghttpx: Enable host-path backend routing in HTTP/2 backend
...
To achieve host-path backend routing, we changed behaviour of
--backend-http2-connections-per-worker. It now sets the number of
HTTP/2 physical connections per pattern group if pattern is used in -b
option.
Fixes GH-292
2015-07-12 23:02:30 +09:00
Tatsuhiro Tsujikawa
3119fc259c
Select backend based on request host and path by extending -b option
...
-b option syntax is now <HOST>,<PORT>[;<PATTERN>[:...]]. The optional
<PATTERN>s specify the request host and path it is used for. The
<PATTERN> can contain path, host + path or host. The matching rule is
closely designed to ServeMux in Go programming language.
2015-07-11 00:15:52 +09:00
Tatsuhiro Tsujikawa
301df2a856
src: Disable SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
2015-06-22 23:26:45 +09:00
Tatsuhiro Tsujikawa
532bffdb01
nghttpx: Minimize critical section for shared ocsp response
2015-06-12 21:27:12 +09:00
Tatsuhiro Tsujikawa
34efc6b7a4
More constexpr
2015-05-29 22:36:05 +09:00