aboutsummaryrefslogtreecommitdiff
path: root/contrib/epee (unfollow)
AgeCommit message (Collapse)AuthorFilesLines
2022-07-13Template hash func to fix compiler error on < gcc-6j-berman1-0/+10
2022-07-08address PR commentsj-berman3-390/+385
2022-07-05connection: fix implementationanon4-836/+1229
2022-05-23Windows build: fix narrowing error for WaitForSingleObjectJeffrey Ryan1-1/+1
`WaitForSingleObject` returns a `DWORD`, not an int, so assign `retval` as such and it should fix the error.
2022-05-17src, epee: fix a couple compiler warningsselsta1-1/+0
2022-05-05Give better error messages when missing SSL filesJeffrey Ryan1-1/+24
While copying my data dir to another drive, I missed copying the rpc_ssl.key file b/c of the file permissions. This change will give a much more clear, descriptive error in that scenario.
2022-04-28Doxygen: Hide anonymous namespaces from documentation by defaultJeffrey1-1/+1
Bonus: little doc fix for net_ssl.h
2022-04-22EPEE: Remove gzip_encoding.hJeffrey2-237/+1
2022-04-22EPEE: Remove hmac-md5Jeffrey3-302/+0
2022-04-21add a sanity check to RPC input data sizemoneromooo-monero2-0/+12
reported by m31007
2022-04-18Change C-style-casts to static_cast in time_helper.hJeffrey1-4/+4
At the request of @mj-xmr: https://github.com/monero-project/monero/pull/8211#discussion_r822868321
2022-04-18Remove the only 4 non-UTF8 characters in codebaseJeffrey1-4/+4
Relevant commit in old PR: 1b798a7042070cc8063bd341ebf7025da554b632
2022-04-18Factor out move_it_backward from misc_language.hJeffrey1-9/+1
Relevant commit from old PR: 330df2952cb2863a591158b984c0fb7f652887ac
2022-04-18Move copyable_atomic into connection_contextJeffrey1-56/+0
Relevant commit from old PR: bd0a5119957d3ef9130a0b82599e1696995ef235
2022-04-18Refactor out to_nonconst_iterator.hJeffrey4-55/+1
Relevant commit on old PR: 2499269696192ce30dd125ddee90a80d4326dff9
2022-04-18Refactor out pragma_comp_defsJeffrey4-35/+4
Relevant commits on the old cleanup PR: 36933c7f5c7778e2d7fbfea5361c11fb41070467 21e43de0f300ee47b7e597098908601bf591950b 3c678bb1cedfd7b865ac2e7aaf014de4bfb3eb3d
2022-04-18Merge functionality of misc_os_dependent into time_helper.hJeffrey8-279/+33
Actions: 1. Remove unused functions from misc_os_dependent.h 2. Move three remaining functions, get_gmt_time, get_ns_count, and get_tick_count into time_helper.h 3. Remove unused functions from time_helper.h 4. Refactor get_ns_count and get_internet_time_str and get_time_interval_string 5. Remove/add includes as needed Relevant commits on the old PR: a9fbe52b02ffab451e90c977459fea4642731cd1 9a59b131c4ed1be8afe238fff3780fe203c65a46 7fa9e2817df9b9ef3f0290f7f86357939829e588
2022-04-18Trimming FatJeffrey7-149/+0
Remove unused include statements or unused definitions.
2022-04-18Boring Old DeletesJeffrey67-9622/+0
Here lies dozens of unused files. This commit is ONLY file deletions except for the removing of a couple of #includes and removing filenames from CmakeLists where appropriate.
2022-04-10epee: allow copying a rolling_median_t objectmoneromooo-monero1-1/+14
2022-04-09Remove serialization/enableableJeffrey3-72/+0
Currently working on an EPEE [ser/de]ialization library for Rust and at first glance, EPEE seemed to have support for optional wrappers. However, after looking into it, this feature appears to be half-baked and unused. Furthermore, adding support for optional values would be better suited to implement at the storage level, in my opinion. That would make parsing DOMs easier and less error-prone. If anyone is currently using this code, please comment. Thanks! At the time of writing, this PR has no merge conflicts with #8211
2022-03-30Remove dead code from parserse_base_utils and fix unit testsJeffrey2-77/+1
* Remove `match_string()`, `match_number()`, and `match_word()` * Remove `match_word_with_extrasymb()` and `match_word_til_equal_mark()` * Adapt unit test for `match_number()` to `match_number2()` * Adapt unit test for `match_string()` to `match_string2()` Note: the unit tests were testing for the old version of the functions, and the interfaces for these functions changed slightly, so I had to also edit the tests. As of writing, this PR has no merge conflicts with #8211 Additional changes during review: * Explicitly set up is_[float/signed]_val to be changed before each call * Structify the tests and fix uninitialized variables
2022-03-30Eliminate dependence on boost::interprocess #8223Jeffrey7-39/+34
In this repo, `boost::interprocess` was being used soley to make `uint32_t` operations atomic. So I replaced each instance of `boost::interprocess::ipcdetail::atomic(...)32` with `std::atomic` methods. I replaced member declarations as applicable. For example, when I needed to change a `volatile uint32_t` into a `std::atomic<uint32_t>`. Sometimes, a member was being used a boolean flag, so I replaced it with `std::atomic<bool>`. You may notice that I didn't touch `levin_client_async.h`. That is because this file is entirely unused and will be deleted in PR monero-project#8211. Additional changes from review: * Make some local variables const * Change postfix operators to prefix operators where value was not need
2022-03-25Fix typo: SERIALIZE_TYPE_DUOBLEJeffrey3-5/+5
2022-03-04Copyright: Update to 2022mj-xmr34-34/+43
2022-02-19Undefined behaviour fixesSChernykh6-12/+24
Fixes issues reported in #8120
2021-10-22epee: add missing headerselsta2-0/+2
2021-10-20epee: avoid ADL selecting C++14 std::quotedselsta1-14/+9
2021-09-16cmake: set required C/C++ standard to 11selsta2-5/+10
Co-authored-by: Jason Rhinelander <jason@imaginary.ca>
2021-08-20support cors wildcardwoodser1-1/+1
2021-08-19epee: link with Boost_SYSTEM_LIBRARYselsta1-0/+2
2021-08-13fix median overflow bugkoe1-1/+2
2021-08-11epee: tidying post-incrementation -> pre-incrementationmj-xmr3-7/+7
2021-08-05p2p: remove blocked addresses/hosts from peerlistmoneromooo-monero1-0/+3
2021-07-27Make SSL key/cert storage backward-compatibleNathan Dorfman1-1/+2
This is required to build on OpenBSD (which uses LibreSSL). It also allows building against versions of OpenSSL before 1.0.2.
2021-06-11Compil time: move epee storages/parserse_base_utils.h to parserse_base_utils.cppmj-xmr3-233/+291
2021-05-24Fix boost 1.76.0 compatibilityloqs1-0/+2
Add missing header boost/mpl/contains.hpp monero-project/monero/issues/7728
2021-05-09epee: include public openssl header in cmakeselsta1-1/+4
2021-04-27cmake: set 3.5 as minimum versionselsta2-2/+2
2021-04-27clang: fix -Wrange-loop-analysis warningsselsta1-2/+2
2021-04-24epee linkage dynamic; move monero_add_library to main CMakeLists.txtmj-xmr1-3/+4
2021-04-16Split epee/string_tools.h and encapsulate boost::lexical_castmj-xmr17-492/+718
2021-04-16Revert "Merge pull request #7136"luigi11117-164/+135
This reverts commit 63c7ca07fba2f063c760f786a986fb3e02fb040e, reversing changes made to 2218e23e84a89e9a1e4c0be5d50f891ab836754f.
2021-04-16CMake: new macro - finding all headers (extract from epee)mj-xmr1-5/+2
2021-03-28Reduce compilation time of epee/portable_storage_template_helper.hmj-xmr4-199/+242
2021-03-12async_protocol_handler_config: fix deadlockanon1-28/+24
2021-02-25Epee: add headers to project files (via glob), to be able to search for them ↵mj-xmr1-1/+10
easily. Use case: IDEs
2021-02-23epee: return HTTP error 400 (Bad request) on deserialization errormoneromooo-monero1-2/+14
It's better than 404 (Not found)
2021-02-21Fix compiler warning for in keyvalue_serialization.hmj-xmr1-1/+2
2021-02-19async_protocol_handler_config: remove connection correctlyanon1-1/+1
2021-02-13Store RPC SSL key/cert for consistent authentication between runsLee Clagett3-0/+57
2021-02-06Reduce compilation time of epee/portable_storage.hmj-xmr11-216/+286
2021-01-23Improve cryptonote (block and tx) binary read performanceLee Clagett1-4/+4
2021-01-19boosted_tcp_server: fix connection lifetimeanon2-7/+19
2021-01-19Remove unnecessary atomic operations in levin codeLee Clagett1-32/+2
2021-01-19Remove payload copy in all outgoing p2p messagesLee Clagett7-135/+164
2021-01-16Reduced executable size; reduced call sequence to "allowed" log functionLee Clagett1-2/+2
2021-01-16Remove payload copy in all outgoing p2p messagesLee Clagett7-135/+164
2021-01-07storages: overridable limits for loading portable_storage from binarymoneromooo-monero5-33/+63
2021-01-05epee: also limit number of strings in portable_storagemoneromooo-monero1-1/+11
They require at least 24 bytes
2021-01-03epee: don't log raw packet datamoneromooo-monero1-4/+4
2021-01-03add a max levin packet size by command typemoneromooo-monero1-4/+13
2021-01-02portable_storage: better sanity checkingmoneromooo-monero1-2/+7
2020-12-31portable_storage: check object limit where appropriatemoneromooo1-1/+6
also fix pedantic off by one in check
2020-12-28portable_storage: forbid unnamed sectionsxiphon3-0/+3
2020-12-28portable_storage: remove array element limitmoneromooo-monero1-5/+0
some people don't want it
2020-12-28ssl: buffered handshake detectionanon5-13/+14
2020-12-27portable_storage: remove overly aggressive cutoffmoneromooo-monero1-2/+0
2020-12-26epee: fix some issues using connections after shutdownmoneromooo-monero1-6/+21
2020-12-26portable_storage: add some sanity checks on data sizemoneromooo-monero1-1/+35
especially when allocated size is >> serialized data size
2020-12-20Restrict duplicate keys in epee binary formatLee Clagett1-1/+4
2020-12-17Add aggressive restrictions to pre-handshake p2p buffer limitLee Clagett2-10/+25
2020-12-14Fix byte_stream::put_nLee Clagett1-1/+1
2020-12-13readline_buffer: Avoid consecutive duplicates in the historycodesoap1-2/+16
2020-12-08Fixed issues found by static analysisSChernykh1-1/+0
- rolling_median: tried to free uninitialized pointer in a constructor - net_node.inl: erase-remove idiom was used incorrectly. remove_if doesn't actually remove elements, see http://cpp.sh/6fcjv - bulletproofs.cc: call to sizeof() instead of vector.size(), luckily it only impacts performance and not code logic there
2020-12-06protocol: drop peers that don't reply to queriesmoneromooo1-8/+6
2020-12-04keep only the last seen node on a given host in the white listmoneromooo1-0/+33
2020-11-09epee: tighten the URL parsing regexp a littlemoneromooo-monero1-4/+4
fixes massive amounts of time spent on pathological inputs Found by OSS-Fuzz
2020-11-07epee: readline_buffer - fix thread safety, fix sync() after stop()xiphon1-1/+9
2020-10-13Change to more efficient allocation strategy in byte_streamLee Clagett2-18/+8
2020-10-13Allow byte_stream->byte_slice conversion to shrink unused buffer spaceLee Clagett2-5/+21
2020-10-10Change epee binary output from std::stringstream to byte_streamLee Clagett12-51/+71
2020-08-17Add clear method to byte_streamLee Clagett1-0/+3
2020-08-02epee: further defending against exceptions in command handlersmoneromooo-monero1-0/+7
2020-07-30epee: guard against exceptions in RPC handlersmoneromooo-monero1-9/+31
2020-07-24Wallet, daemon: From 'help_advanced' back to 'help', and new 'apropos' commandrbrunner71-0/+25
2020-07-23Fix overflow issue in epee:misc_utils::rolling_median_t and median(), with ↵koe2-2/+12
unit test
2020-07-22epee: Remove unused functions in local_ip.hJean Pierre Dudey1-26/+0
Signed-off-by: Jean Pierre Dudey <me@jeandudey.tech>
2020-07-20wallet2_api: implement runtime proxy configurationxiphon3-8/+6
2020-06-21epee: fix array underflow in unicode parsingmoneromooo-monero1-1/+1
Reported by minerscan Also independently found by OSS-Fuzz just recently
2020-05-31Fix boost <1.60 compilation and fix boost 1.73+ warningsLee Clagett4-17/+17
2020-05-23rpc: don't display invalid json errors on default log levelmoneromooo-monero1-1/+1
It's not something the user needs to know, and will display attacker controlled data
2020-05-20ByteSlice: Fix persisting ptr to std::moved SSO bufferDoyle1-1/+4
The Bug: 1. Construct `byte_slice.portion_` with `epee::span(buffer)` which copies a pointer to the SSO buffer to `byte_slice.portion_` 2. It constructs `byte_slice.storage_` with `std::move(buffer)` (normally this swap pointers, but SSO means a memcpy and clear on the original SSO buffer) 3. `slice.data()` returns a pointer from `slice.portion_` that points to the original SSO cleared buffer, `slice.storage_` has the actual string.
2020-05-19fix a few typos in error messagesmoneromooo-monero1-1/+1
Reported by adrelanos
2020-05-16epee: use memwipe rather than memset for md5 secretsmoneromooo-monero1-6/+6
That's used by HTTP auth now
2020-05-14build: fix boost 1.73 compatibilityselsta2-6/+6
2020-05-12Fixed bugs for take_slice and byte_stream->byte_sliceLee Clagett1-9/+17
2020-05-11remove double includessumogr2-7/+0
2020-05-06Update copyright year to 2020SomaticFanatic21-21/+21
Update copyright year to 2020
2020-04-27trezor: adapt to new passphrase mechanismDusan Klinec2-0/+11
- choice where to enter passphrase is now made on the host - use wipeable string in the comm stack - wipe passphrase memory - protocol optimizations, prepare for new firmware version - minor fixes and improvements - tests fixes, HF12 support
2020-04-15Allow wallet2.h to run in WebAssemblywoodser6-159/+260
- Add abstract_http_client.h which http_client.h extends. - Replace simple_http_client with abstract_http_client in wallet2, message_store, message_transporter, and node_rpc_proxy. - Import and export wallet data in wallet2. - Use #if defined __EMSCRIPTEN__ directives to skip incompatible code.
2020-04-11Add byte_stream for zero-copy serialization, and add support in ZMQ-JSON.Lee Clagett5-4/+386
2020-04-03Use byte_slice for sending zmq messages - removes data copy within zmqLee Clagett2-5/+24
2020-03-31p2p: fix frequent weak_ptr exception on connectionmoneromooo-monero1-1/+6
When a handshake fails, it can fail due to timeout or destroyed connection, in which case the connection will be, or already is, closed, and we don't want to do it twice. Additionally, when closing a connection directly from the top level code, ensure the connection is gone from the m_connects list so it won't be used again. AFAICT this is now clean in netstat, /proc/PID/fd and print_cn. This fixes a noisy (but harmless) exception.
2020-03-30Fixed string_ref usage bug in epee::from_hex::vectorLee Clagett1-3/+3
2020-03-13epee: avoid spamming 'Generating SSL certificate' in the logsxiphon1-2/+2
2020-03-11Use boost::asio::ssl::context::sslv23 for backwards compatibilityMartijn Otto1-1/+3
All the insecure protocols that this enables are then disabled, so they cannot be actually used. The end-result is the same.
2020-03-09Move hex->bin conversion to monero copyright files and with less includesLee Clagett4-36/+58
2020-03-09Remove temporary std::string creation in some hex->bin callsLee Clagett1-5/+6
2020-03-05Various improvements to the ZMQ JSON-RPC handling:Lee Clagett1-1/+11
- Finding handling function in ZMQ JSON-RPC now uses binary search - Temporary `std::vector`s in JSON output now use `epee::span` to prevent allocations. - Binary -> hex in JSON output no longer allocates temporary buffer - C++ structs -> JSON skips intermediate DOM creation, and instead write directly to an output stream.
2020-02-17remove empty statementsInterchained3-3/+3
Cleaning up a little around the code base.
2020-02-12wipeable_string: split - treat CR, LF and Tabs as separatorsxiphon1-3/+4
2020-02-12console_handler: do not let exception past the dormoneromooo-monero1-3/+7
Coverity 208373
2020-01-28Explicitly define copy assignment operatorMartijn Otto1-0/+7
The implicit copy assignment operator was deprecated because the class has an explicit copy constructor. According to the standard: The generation of the implicitly-defined copy assignment operator is deprecated (since C++11) if T has a user-declared destructor or user-declared copy constructor. Recent versions of gcc (9.1+) and clang (10.0) warn about this.
2020-01-26epee: remove backward compatible endian specific address serializationmoneromooo-monero1-6/+2
2020-01-26serialization: do not write optional fields with default valuemoneromooo-monero1-0/+2
2020-01-26network: log traffic and add a simple traffic analysis scriptmoneromooo-monero1-5/+43
2019-12-16abstract_tcp_server2: guard against negative timeoutsmoneromooo-monero1-5/+16
2019-12-03ssl: server-side: allow multiple version of TLSBertrand Jacquin1-1/+1
boost::asio::ssl::context is created using specifically TLSv1.2, which blocks the ability to use superior version of TLS like TLSv1.3. Filtering is also made specially later in the code to remove unsafe version for TLS such SSLv2, SSLv3 etc.. This change is removing double filtering to allow TLSv1.2 and above to be used. testssl.sh 3.0rc5 now reports the following (please note monerod was built with USE_EXTRA_EC_CERT): $ ./testssl.sh --openssl=/usr/bin/openssl \ --each-cipher --cipher-per-proto \ --server-defaults --server-preference \ --vulnerable --heartbleed --ccs --ticketbleed \ --robot --renegotiation --compression --breach \ --poodle --tls-fallback --sweet32 --beast --lucky13 \ --freak --logjam --drown --pfs --rc4 --full \ --wide --hints 127.0.0.1:38081 Using "OpenSSL 1.1.1d 10 Sep 2019" [~80 ciphers] on ip-10-97-15-6:/usr/bin/openssl (built: "Dec 3 21:14:51 2019", platform: "linux-x86_64") Start 2019-12-03 21:51:25 -->> 127.0.0.1:38081 (127.0.0.1) <<-- rDNS (127.0.0.1): -- Service detected: HTTP Testing protocols via sockets except NPN+ALPN SSLv2 not offered (OK) SSLv3 not offered (OK) TLS 1 not offered TLS 1.1 not offered TLS 1.2 offered (OK) TLS 1.3 offered (OK): final NPN/SPDY not offered ALPN/HTTP2 not offered Testing for server implementation bugs No bugs found. Testing cipher categories NULL ciphers (no encryption) not offered (OK) Anonymous NULL Ciphers (no authentication) not offered (OK) Export ciphers (w/o ADH+NULL) not offered (OK) LOW: 64 Bit + DES, RC[2,4] (w/o export) not offered (OK) Triple DES Ciphers / IDEA not offered (OK) Average: SEED + 128+256 Bit CBC ciphers not offered Strong encryption (AEAD ciphers) offered (OK) Testing robust (perfect) forward secrecy, (P)FS -- omitting Null Authentication/Encryption, 3DES, RC4 PFS is offered (OK), ciphers follow (client/browser support is important here) Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC) ----------------------------------------------------------------------------------------------------------------------------- x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 xc02c ECDHE-ECDSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 xcca9 ECDHE-ECDSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 xc02b ECDHE-ECDSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 Elliptic curves offered: prime256v1 secp384r1 secp521r1 X25519 X448 Testing server preferences Has server cipher order? yes (OK) Negotiated protocol TLSv1.3 Negotiated cipher TLS_AES_256_GCM_SHA384, 253 bit ECDH (X25519) Cipher order TLSv1.2: ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256 TLSv1.3: TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256 Testing server defaults (Server Hello) TLS extensions (standard) "renegotiation info/#65281" "EC point formats/#11" "supported versions/#43" "key share/#51" "max fragment length/#1" "extended master secret/#23" Session Ticket RFC 5077 hint no -- no lifetime advertised SSL Session ID support yes Session Resumption Tickets no, ID: no TLS clock skew Random values, no fingerprinting possible Server Certificate #1 (in response to request w/o SNI) Signature Algorithm SHA256 with RSA Server key size RSA 4096 bits Server key usage -- Server extended key usage -- Serial / Fingerprints 01 / SHA1 132E42981812F5575FA0AE64922B18A81B38C03F SHA256 EBA3CC4AA09DEF26706E64A70DB4BC8D723533BB67EAE12B503A845019FB61DC Common Name (CN) (no CN field in subject) subjectAltName (SAN) missing (NOT ok) -- Browsers are complaining Issuer Trust (hostname) certificate does not match supplied URI Chain of trust NOT ok (self signed) EV cert (experimental) no "eTLS" (visibility info) not present Certificate Validity (UTC) 181 >= 60 days (2019-12-03 21:51 --> 2020-06-02 21:51) # of certificates provided 1 Certificate Revocation List -- OCSP URI -- NOT ok -- neither CRL nor OCSP URI provided OCSP stapling not offered OCSP must staple extension -- DNS CAA RR (experimental) not offered Certificate Transparency -- Server Certificate #2 (in response to request w/o SNI) Signature Algorithm ECDSA with SHA256 Server key size EC 256 bits Server key usage -- Server extended key usage -- Serial / Fingerprints 01 / SHA1 E17B765DD8124525B1407E827B89A31FB167647D SHA256 AFB7F44B1C33831F521357E5AEEB813044CB02532143E92D35650A3FF792A7C3 Common Name (CN) (no CN field in subject) subjectAltName (SAN) missing (NOT ok) -- Browsers are complaining Issuer Trust (hostname) certificate does not match supplied URI Chain of trust NOT ok (self signed) EV cert (experimental) no "eTLS" (visibility info) not present Certificate Validity (UTC) 181 >= 60 days (2019-12-03 21:51 --> 2020-06-02 21:51) # of certificates provided 1 Certificate Revocation List -- OCSP URI -- NOT ok -- neither CRL nor OCSP URI provided OCSP stapling not offered OCSP must staple extension -- DNS CAA RR (experimental) not offered Certificate Transparency -- Testing HTTP header response @ "/" HTTP Status Code 404 Not found (Hint: supply a path which doesn't give a "404 Not found") HTTP clock skew Got no HTTP time, maybe try different URL? Strict Transport Security not offered Public Key Pinning -- Server banner Epee-based Application banner -- Cookie(s) (none issued at "/") -- maybe better try target URL of 30x Security headers -- Reverse Proxy banner -- Testing vulnerabilities Heartbleed (CVE-2014-0160) not vulnerable (OK), no heartbeat extension CCS (CVE-2014-0224) not vulnerable (OK) Ticketbleed (CVE-2016-9244), experiment. not vulnerable (OK), no session ticket extension ROBOT Server does not support any cipher suites that use RSA key transport Secure Renegotiation (CVE-2009-3555) not vulnerable (OK) Secure Client-Initiated Renegotiation not vulnerable (OK) CRIME, TLS (CVE-2012-4929) not vulnerable (OK) BREACH (CVE-2013-3587) no HTTP compression (OK) - only supplied "/" tested POODLE, SSL (CVE-2014-3566) not vulnerable (OK) TLS_FALLBACK_SCSV (RFC 7507) No fallback possible, no protocol below TLS 1.2 offered (OK) SWEET32 (CVE-2016-2183, CVE-2016-6329) not vulnerable (OK) FREAK (CVE-2015-0204) not vulnerable (OK) DROWN (CVE-2016-0800, CVE-2016-0703) not vulnerable on this host and port (OK) make sure you don't use this certificate elsewhere with SSLv2 enabled services https://censys.io/ipv4?q=EBA3CC4AA09DEF26706E64A70DB4BC8D723533BB67EAE12B503A845019FB61DC could help you to find out LOGJAM (CVE-2015-4000), experimental not vulnerable (OK): no DH EXPORT ciphers, no DH key detected with <= TLS 1.2 BEAST (CVE-2011-3389) no SSL3 or TLS1 (OK) LUCKY13 (CVE-2013-0169), experimental not vulnerable (OK) RC4 (CVE-2013-2566, CVE-2015-2808) no RC4 ciphers detected (OK) Testing ciphers per protocol via OpenSSL plus sockets against the server, ordered by encryption strength Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC) ----------------------------------------------------------------------------------------------------------------------------- SSLv2 SSLv3 TLS 1 TLS 1.1 TLS 1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 xc02c ECDHE-ECDSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 xcca9 ECDHE-ECDSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 xc02b ECDHE-ECDSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS 1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256 x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256 Running client simulations (HTTP) via sockets Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy ------------------------------------------------------------------------------------------------ Android 4.2.2 No connection Android 4.4.2 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256) Android 5.0.0 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 256 bit ECDH (P-256) Android 6.0 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 256 bit ECDH (P-256) Android 7.0 TLSv1.2 ECDHE-RSA-CHACHA20-POLY1305 253 bit ECDH (X25519) Android 8.1 (native) No connection Android 9.0 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) Chrome 65 Win 7 TLSv1.2 ECDHE-RSA-CHACHA20-POLY1305 253 bit ECDH (X25519) Chrome 74 (Win 10) No connection Firefox 62 Win 7 TLSv1.2 ECDHE-RSA-CHACHA20-POLY1305 253 bit ECDH (X25519) Firefox 66 (Win 8.1/10) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) IE 6 XP No connection IE 7 Vista No connection IE 8 Win 7 No connection IE 8 XP No connection IE 11 Win 7 No connection IE 11 Win 8.1 No connection IE 11 Win Phone 8.1 No connection IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256) Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 253 bit ECDH (X25519) Edge 17 (Win 10) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 253 bit ECDH (X25519) Opera 60 (Win 10) No connection Safari 9 iOS 9 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256) Safari 9 OS X 10.11 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256) Safari 10 OS X 10.12 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256) Apple ATS 9 iOS 9 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256) Tor 17.0.9 Win 7 No connection Java 6u45 No connection Java 7u25 No connection Java 8u161 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 256 bit ECDH (P-256) Java 9.0.4 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 256 bit ECDH (P-256) OpenSSL 1.0.1l TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 256 bit ECDH (P-256) OpenSSL 1.0.2e TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 256 bit ECDH (P-256) OpenSSL 1.1.0j (Debian) TLSv1.2 ECDHE-RSA-CHACHA20-POLY1305 253 bit ECDH (X25519) OpenSSL 1.1.1b (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519) Thunderbird (60.6) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519)
2019-11-26net_ssl: load default certificates in CA mode on Windowsmoneromooo-monero1-0/+42
Because it always does things wonkily doens't it
2019-11-25epee: reorder a couple init list fields to match declarationmoneromooo-monero2-2/+2
This is a bug waiting to happen
2019-11-15epee: set application/json MIME type on json errorsmoneromooo-monero1-0/+2
2019-11-14epee: fix peer ids being truncated on displaymoneromooo-monero1-1/+3
2019-11-13Replace memset with memwipe.Bert Peters1-1/+1
2019-11-12epee: fix console_handlers_binder race, wait for thread to finishxiphon1-1/+8
2019-11-11epee: close connection when the peer has done somoneromooo-monero1-1/+7
This fixes rapid reconnections failing as the peer hasn't yet worked out the other side is gone, and will reject "duplicate" connections until a timeout.
2019-11-04Improved performance for epee serialization:Lee Clagett6-56/+53
- Removed copy of field names in binary deserialization - Removed copy of array values in binary deserialization - Removed copy of string values in json deserialization - Removed unhelpful allocation in json string value parsing - Removed copy of blob data on binary and json serialization
2019-11-02Adding support for hidden (anonymity) txpoolLee Clagett1-1/+2
2019-11-01epee: allow a random component in once_a_time timeoutsmoneromooo-monero1-4/+16
2019-10-25daemon, wallet: new pay for RPC use systemmoneromooo-monero5-8/+51
Daemons intended for public use can be set up to require payment in the form of hashes in exchange for RPC service. This enables public daemons to receive payment for their work over a large number of calls. This system behaves similarly to a pool, so payment takes the form of valid blocks every so often, yielding a large one off payment, rather than constant micropayments. This system can also be used by third parties as a "paywall" layer, where users of a service can pay for use by mining Monero to the service provider's address. An example of this for web site access is Primo, a Monero mining based website "paywall": https://github.com/selene-kovri/primo This has some advantages: - incentive to run a node providing RPC services, thereby promoting the availability of third party nodes for those who can't run their own - incentive to run your own node instead of using a third party's, thereby promoting decentralization - decentralized: payment is done between a client and server, with no third party needed - private: since the system is "pay as you go", you don't need to identify yourself to claim a long lived balance - no payment occurs on the blockchain, so there is no extra transactional load - one may mine with a beefy server, and use those credits from a phone, by reusing the client ID (at the cost of some privacy) - no barrier to entry: anyone may run a RPC node, and your expected revenue depends on how much work you do - Sybil resistant: if you run 1000 idle RPC nodes, you don't magically get more revenue - no large credit balance maintained on servers, so they have no incentive to exit scam - you can use any/many node(s), since there's little cost in switching servers - market based prices: competition between servers to lower costs - incentive for a distributed third party node system: if some public nodes are overused/slow, traffic can move to others - increases network security - helps counteract mining pools' share of the network hash rate - zero incentive for a payer to "double spend" since a reorg does not give any money back to the miner And some disadvantages: - low power clients will have difficulty mining (but one can optionally mine in advance and/or with a faster machine) - payment is "random", so a server might go a long time without a block before getting one - a public node's overall expected payment may be small Public nodes are expected to compete to find a suitable level for cost of service. The daemon can be set up this way to require payment for RPC services: monerod --rpc-payment-address 4xxxxxx \ --rpc-payment-credits 250 --rpc-payment-difficulty 1000 These values are an example only. The --rpc-payment-difficulty switch selects how hard each "share" should be, similar to a mining pool. The higher the difficulty, the fewer shares a client will find. The --rpc-payment-credits switch selects how many credits are awarded for each share a client finds. Considering both options, clients will be awarded credits/difficulty credits for every hash they calculate. For example, in the command line above, 0.25 credits per hash. A client mining at 100 H/s will therefore get an average of 25 credits per second. For reference, in the current implementation, a credit is enough to sync 20 blocks, so a 100 H/s client that's just starting to use Monero and uses this daemon will be able to sync 500 blocks per second. The wallet can be set to automatically mine if connected to a daemon which requires payment for RPC usage. It will try to keep a balance of 50000 credits, stopping mining when it's at this level, and starting again as credits are spent. With the example above, a new client will mine this much credits in about half an hour, and this target is enough to sync 500000 blocks (currently about a third of the monero blockchain). There are three new settings in the wallet: - credits-target: this is the amount of credits a wallet will try to reach before stopping mining. The default of 0 means 50000 credits. - auto-mine-for-rpc-payment-threshold: this controls the minimum credit rate which the wallet considers worth mining for. If the daemon credits less than this ratio, the wallet will consider mining to be not worth it. In the example above, the rate is 0.25 - persistent-rpc-client-id: if set, this allows the wallet to reuse a client id across runs. This means a public node can tell a wallet that's connecting is the same as one that connected previously, but allows a wallet to keep their credit balance from one run to the other. Since the wallet only mines to keep a small credit balance, this is not normally worth doing. However, someone may want to mine on a fast server, and use that credit balance on a low power device such as a phone. If left unset, a new client ID is generated at each wallet start, for privacy reasons. To mine and use a credit balance on two different devices, you can use the --rpc-client-secret-key switch. A wallet's client secret key can be found using the new rpc_payments command in the wallet. Note: anyone knowing your RPC client secret key is able to use your credit balance. The wallet has a few new commands too: - start_mining_for_rpc: start mining to acquire more credits, regardless of the auto mining settings - stop_mining_for_rpc: stop mining to acquire more credits - rpc_payments: display information about current credits with the currently selected daemon The node has an extra command: - rpc_payments: display information about clients and their balances The node will forget about any balance for clients which have been inactive for 6 months. Balances carry over on node restart.
2019-10-22epee: use SO_REUSEADDR on non-Windows targetsxiphon1-2/+6
2019-10-21Support median block size > 4 GBmoneromooo-monero3-1/+53
add a 128/64 division routine so we can use a > 32 bit median block size in calculations
2019-10-18epee: fix SSL server handshake, run_one() can block, use poll_one()xiphon2-2/+11
2019-10-15levin: armour against some "should not happen" casemoneromooo-monero1-0/+5
If adding a response handler after the protocol is released, they could never be cancelled again, and would end up keeping a ref that never goes away
2019-10-14abstract_tcp_server2: move "Trying to connect" from error to debugmoneromooo-monero1-1/+1
and fix the message grammar
2019-10-02epee: tcp server - set SO_LINGER instead of SO_REUSEADDR optionxiphon1-4/+2
2019-09-27abstract_tcp_server2: log pointer, not contents, where appropriatemoneromooo-monero1-1/+1
2019-09-26build: fix MinGW GUI dependencies buildxiphon1-2/+2
2019-09-24epee: misc_log_ex.h can now be used in C codemoneromooo-monero2-11/+51
use mfatal/merror/mwarning/minfo/mdebug/mtrace
2019-09-17epee: implement handshake timeout for SSL connectionsxiphon3-5/+30
2019-09-16epee: fix network timeouts in blocked_mode_clientxiphon1-1/+2
2019-09-16Properly format multiline logsmoneromooo-monero2-22/+58
As a side effect, colouring on Windows should now work regardless of version
2019-09-12abstract_tcp_server2: fix lingering connectionsmoneromooo-monero1-0/+5
Resetting the timer after shutdown was initiated would keep a reference to the object inside ASIO, which would keep the connection alive until the timer timed out
2019-09-08depends: fix MacOS build with Clang 3.7.1Lee Clagett1-1/+1
2019-09-08epee: abstract_tcp_server2: resolve CID 203919 (DC.WEAK_CRYPTO)anonimal1-1/+13
The problem actually exists in two parts: 1. When sending chunks over a connection, if the queue size is greater than N, the seed is predictable across every monero node. >"If rand() is used before any calls to srand(), rand() behaves as if it was seeded with srand(1). Each time rand() is seeded with the same seed, it must produce the same sequence of values." 2. The CID speaks for itself: "'rand' should not be used for security-related applications, because linear congruential algorithms are too easy to break." *But* this is an area of contention. One could argue that a CSPRNG is warranted in order to fully mitigate any potential timing attacks based on crafting chunk responses. Others could argue that the existing LCG, or even an MTG, would suffice (if properly seeded). As a compromise, I've used an MTG with a full bit space. This should give a healthy balance of security and speed without relying on the existing crypto library (which I'm told might break on some systems since epee is not (shouldn't be) dependent upon the existing crypto library).
2019-09-07depends: attempt to fix readlineiDunk54001-2/+2
Make readline actually compile, and make ncurses use existing terminfo data (if available).
2019-09-06epee: connection_basic: resolve CID 203916 (UNINIT_CTOR)anonimal1-0/+1
2019-09-06epee: connection_basic: resolve CID 203920 (UNINIT_CTOR)anonimal1-0/+1
2019-09-04Fix IP address serialization on big endianmoneromooo-monero1-1/+15
IP addresses are stored in network byte order even on little endian hosts
2019-09-04storages: fix "portable" storage on big endianmoneromooo-monero4-3/+99
2019-09-04storages: fix writing varints on big endianmoneromooo-monero1-1/+1
2019-09-04epee: fix local/loopback checks on big endianmoneromooo-monero1-0/+7
IPv4 addresses are kept in network byte order in memory
2019-08-28simplewallet: lock console on inactivitymoneromooo-monero3-13/+88
2019-08-23syncobj.h no longer defines shared_guard, so remove those define'sTom Smeding1-3/+0
The removed preprocessor macro's refer to types that are not defined in the file anymore; the only other place where shared_guard is defined is in winobj.h, which also defines the same macro's. Therefore, this change is safe. (Side note is that these macro's weren't used at all anyway, but that is orthogonal to the issue.)
2019-08-20fix feature not introduced until boost 1.66Jethro Grassie1-1/+1
2019-08-19epee: fix connections not being properly closed in some instancesmoneromooo-monero1-1/+1
Fixed by Fixed by crCr62U0
2019-08-16epee: support unicode in parsed stringsmoneromooo-monero2-22/+61
2019-08-15Remove unused code under WINDWOS_PLATFORM guardTom Smeding1-88/+0
This code has been present, unchanged, ever since the original move to github in 2014 with commit 296ae46ed.
2019-07-31Add IPv6 supportThomas Winget8-67/+461
new cli options (RPC ones also apply to wallet): --p2p-bind-ipv6-address (default = "::") --p2p-bind-port-ipv6 (default same as ipv4 port for given nettype) --rpc-bind-ipv6-address (default = "::1") --p2p-use-ipv6 (default false) --rpc-use-ipv6 (default false) --p2p-require-ipv4 (default true, if ipv4 bind fails and this is true, will not continue even if ipv6 bind successful) --rpc-require-ipv4 (default true, description as above) ipv6 addresses are to be specified as "[xx:xx:xx::xx:xx]:port" except in the cases of the cli args for bind address. For those the square braces can be omitted.
2019-07-17Added support for "noise" over I1P/Tor to mask Tx transmission.Lee Clagett10-64/+289
2019-07-16Add ref-counted buffer byte_slice. Currently used for sending TCP data.Lee Clagett10-149/+445
2019-07-16allow blocking whole subnetsmoneromooo-monero3-2/+67
2019-06-19p2p: close the right number of connections on setting max in/out peersmoneromooo-monero1-0/+24
2019-06-16Bans for RPC connectionsHoward Chu2-2/+6
Make bans control RPC sessions too. And auto-ban some bad requests. Drops HTTP connections whenever response code is 500.
2019-06-14ensure no NULL is passed to memcpymoneromooo-monero2-6/+14
NULL is valid when size is 0, but memcpy uses nonnull attributes, so let's not poke the bear
2019-06-14abstract_tcp_server2: improve DoS resistancemoneromooo-monero1-4/+5
2019-06-14epee: basic sanity check on allocation size from untrusted sourcemoneromooo-monero1-0/+1
Reported by guidov
2019-06-10epee: fix SSL autodetect on reconnectionxiphon1-6/+4
2019-06-09Fix GCC 9.1 build warningsmoneromooo-monero1-0/+5
GCC wants operator= aand copy ctor to be both defined, or neither
2019-05-22Add ssl_options support to monerod's rpc mode.Lee Clagett1-0/+38
2019-05-10abstract_tcp_server2: move some things out of a lockmoneromooo-monero1-4/+8
The lock is meant for the network throttle object only, and this should help coverity get unconfused
2019-05-10remove obsolete save_graph skeleton codemoneromooo-monero2-5/+0
2019-05-10net_utils: fix m_ssl type from time_t to boolmoneromooo-monero1-1/+1
2019-05-10net_ssl: free certs after setting them upmoneromooo-monero1-2/+2
2019-05-07net_ssl: SSL config tweaks for compatibility and securitymoneromooo-monero2-4/+128
add two RSA based ciphers for Windows/depends compatibility also enforce server cipher ordering also set ECDH to auto because vtnerd says it is good :) When built with the depends system, openssl does not include any cipher on the current whitelist, so add this one, which fixes the problem, and does seem sensible.
2019-05-06mlog: default to not showing SSL errorsmoneromooo-monero1-1/+1
2019-05-02blockchain: keep a rolling long term block weight medianmoneromooo-monero1-0/+236
2019-04-26change SSL certificate fingerprint whitelisting from SHA1 to SHA-256moneromooo-monero2-1/+3
SHA1 is too close to bruteforceable
2019-04-23net_helper: clear recv buffer on eofmoneromooo-monero1-0/+1
2019-04-22levin_protocol_handler_async: tune down preallocation a fair bitmoneromooo-monero1-1/+1
It can allocate a lot when getting a lot of connections (in particular, the stress test on windows apparently pushes that memory to actual use, rather than just allocated)
2019-04-21serialization: set default log categorymoneromooo-monero3-1/+7
2019-04-18epee: use boost/timer/timer.hpp, boost/timer.hpp is deprecatedmoneromooo-monero1-1/+1
2019-04-15wallet: new --offline optionmoneromooo-monero1-0/+12
It will avoid connecting to a daemon (so useful for cold signing using a RPC wallet), and not perform DNS queries.
2019-04-13net_helper: avoid unnecessary memcpymoneromooo-monero1-3/+4
2019-04-12abstract_tcp_server2: fix timeout on exitmoneromooo-monero2-2/+9
When closing connections due to exiting, the IO service is already gone, so the data exchange needed for a gracious SSL shutdown cannot happen. We just close the socket in that case.
2019-04-11epee: init a new ssl related variable in ctormoneromooo-monero1-0/+1
2019-04-11simplewallet: new net_stats commandmoneromooo-monero2-2/+30
displays total sent and received bytes
2019-04-07Enabling daemon-rpc SSL now requires non-system CA verificationLee Clagett2-0/+22
If `--daemon-ssl enabled` is set in the wallet, then a user certificate, fingerprint, or onion/i2p address must be provided.
2019-04-07Require manual override for user chain certificates.Lee Clagett2-1/+5
An override for the wallet to daemon connection is provided, but not for other SSL contexts. The intent is to prevent users from supplying a system CA as the "user" whitelisted certificate, which is less secure since the key is controlled by a third party.
2019-04-07Only check top-level certificate against fingerprint list.Lee Clagett1-2/+4
This allows "chain" certificates to be used with the fingerprint whitelist option. A user can get a system-ca signature as backup while clients explicitly whitelist the server certificate. The user specified CA can also be combined with fingerprint whitelisting.
2019-04-07Call `use_certificate_chain_file` instead of `use_certificate_file`Lee Clagett1-1/+1
The former has the same behavior with single self signed certificates while allowing the server to have separate short-term authentication keys with long-term authorization keys.
2019-04-07Perform RFC 2818 hostname verification in client SSL handshakesLee Clagett3-5/+26
If the verification mode is `system_ca`, clients will now do hostname verification. Thus, only certificates from expected hostnames are allowed when SSL is enabled. This can be overridden by forcible setting the SSL mode to autodetect. Clients will also send the hostname even when `system_ca` is not being performed. This leaks possible metadata, but allows servers providing multiple hostnames to respond with the correct certificate. One example is cloudflare, which getmonero.org is currently using.
2019-04-07Require server verification when SSL is enabled.Lee Clagett2-11/+16
If SSL is "enabled" via command line without specifying a fingerprint or certificate, the system CA list is checked for server verification and _now_ fails the handshake if that check fails. This change was made to remain consistent with standard SSL/TLS client behavior. This can still be overridden by using the allow any certificate flag. If the SSL behavior is autodetect, the system CA list is still checked but a warning is logged if this fails. The stream is not rejected because a re-connect will be attempted - its better to have an unverified encrypted stream than an unverified + unencrypted stream.
2019-04-07Add `verify_fail_if_no_cert` option for proper client authenticationLee Clagett1-1/+1
Using `verify_peer` on server side requests a certificate from the client. If no certificate is provided, the server silently accepts the connection and rejects if the client sends an unexpected certificate. Adding `verify_fail_if_no_cert` has no affect on client and for server requires that the peer sends a certificate or fails the handshake. This is the desired behavior when the user specifies a fingerprint or CA file.
2019-04-07Pass SSL arguments via one class and use shared_ptr instead of referenceLee Clagett9-167/+229
2019-04-06Do not require client certificate unless server has some whitelisted.Lee Clagett1-12/+27
Currently a client must provide a certificate, even if the server is configured to allow all certificates. This drops that requirement from the client - unless the server is configured to use a CA file or fingerprint(s) for verification - which is the standard behavior for SSL servers. The "system-wide" CA is not being used as a "fallback" to verify clients before or after this patch.
2019-04-06Change SSL certificate file list to OpenSSL builtin load_verify_locationLee Clagett7-76/+65
Specifying SSL certificates for peer verification does an exact match, making it a not-so-obvious alias for the fingerprints option. This changes the checks to OpenSSL which loads concatenated certificate(s) from a single file and does a certificate-authority (chain of trust) check instead. There is no drop in security - a compromised exact match fingerprint has the same worse case failure. There is increased security in allowing separate long-term CA key and short-term SSL server keys. This also removes loading of the system-default CA files if a custom CA file or certificate fingerprint is specified.
2019-03-31Add missing includeLeon Klingele1-0/+1
2019-03-27No longer use deprecated RSA_generate_key in favor ofMartijn Otto1-7/+40
RSA_generate_key_ex
2019-03-25epee: some more minor JSON parsing speedupmoneromooo-monero4-8/+11
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-16 23:37:22 +0000