ngircd/doc, branch rel-27ngircd with make
http://git.nakidai.ru/ngircd/atom?h=rel-272024-04-26T12:18:32+00:00Update doc/Platforms.txt2024-04-26T12:18:32+00:00Alexander Bartonalex@barton.de2024-04-19T21:41:21+00:00urn:sha1:7ccf98edfaad0c8af4a3984f3177071b1f2b4a19Clarify that "CAFile" is not set by default2024-04-19T21:49:59+00:00Alexander Bartonalex@barton.de2024-04-19T21:49:59+00:00urn:sha1:3e3f6cbeceefd9357b53b27c2386bb39306ab353Update doc/Platforms.txt2024-04-11T20:11:38+00:00Alexander Bartonalex@barton.de2024-04-02T20:33:50+00:00urn:sha1:0d42ea7709c786cd9c405cf04395afd0091e580eFix quoting in code examples in doc/Container.md2024-03-31T09:19:48+00:00Alexander Bartonalex@barton.de2024-03-29T11:34:50+00:00urn:sha1:ddba1263073e27059ba5346d6665612524454531S2S-TLS: Convert SSL.txt to Markdown and update information given2024-03-23T19:19:01+00:00Alexander Bartonalex@barton.de2024-01-08T17:31:30+00:00urn:sha1:b826fad15871f73435328b1d77fd364838389adb
No longer describe creating self-signed certificates or using "stunnel",
as both is not recommended.
Support for server certificate validation on server links [S2S-TLS]2024-03-23T19:19:01+00:00Christoph Biedlngircd.anoy@manchmal.in-ulm.de2014-11-02T13:48:34+00:00urn:sha1:817937b218c4b57515f54216ebc936cd69df0aae
This patch provides code to validate the server certificate in
server links, defeating nasty man-in-the-middle attacks on server
links.
Features:
- Check whether the certificate is signed by a trusted certificate
authority (CA).
- Check the host name, including wildcard certificates and Subject
Alternative Names.
- Optionally check against a certificate revocation list (CRL).
- Implementation for both OpenSSL and GnuTLS linkage.
Left for another day:
- Parameterize the TLS parameter of an outbound connection. Currently,
it's hardcoded to disable all versions before TLSv1.1.
- Using certificate as CA-certificate. They work for GnuTLS only but
perhaps this should rather raise an error there, too.
- Optional OCSP checking.
- Checking client certificates. Code is there but this first needs some
consideration about the use cases. This could replace all other
authentication methods, for both client-server and server-server
connections.
This patch is based on a patch by Florian Westphal from 2009, which
implemented this for OpenSSL only:
From: Florian Westphal <fw@strlen.de>
Date: Mon, 18 May 2009 00:29:02 +0200
Subject: SSL/TLS: Add initial certificate support to OpenSSL backend
Commit message modified by Alex Barton.
Closes #120, "Server links using TLS/SSL need certificate validation".
Supersedes PR #8, "Options for verifying and requiring SSL client
certificates", which had (incomplete?) code for OpenSSL, no GnuTLS.
QuickStart.md: Tweak the text a bit ...2024-03-17T21:42:19+00:00Alexander Bartonalex@barton.de2024-03-17T19:36:20+00:00urn:sha1:c1c0bca0e2fa7b678a18155abaf364fcb9dab427Add a Dockerfile and documentation to the project2024-03-17T21:42:15+00:00Alexander Bartonalex@barton.de2024-02-09T21:58:44+00:00urn:sha1:934f3a0d88becd5f0434e0d1a1cf8f3195c6486dStreamline the "testsuite" and "srcdoc" make targets2024-02-09T23:22:33+00:00Alexander Bartonalex@barton.de2024-02-09T23:03:13+00:00urn:sha1:c0b8b94550cb589cee39b4e87d8714273d3885f6Doxygen: Update the footer links2024-02-05T13:03:42+00:00Alexander Bartonalex@barton.de2024-01-31T20:03:44+00:00urn:sha1:39eccffa32c36e55a2fd32f7a33aa929ba0b197b