aolserver-commits — AOLserver Commit Notifications

[AOLSERVER-COMMITS] nsopenssl dh2048.h,NONE,1.1

[Scott S. G. <sc...@us...>]

Update of /cvsroot/aolserver/nsopenssl
In directory sfp-cvs-1.v30.ch3.sourceforge.com:/tmp/cvs-serv25869

Added Files:
	dh2048.h 
Log Message:
Forgot to add the 2048 bit ECDH .c file.


--- NEW FILE: dh2048.h ---
/* 2048-bit DH params from OpenSSL 1.1.0c apps/dh2048.pem */
#ifndef HEADER_DH_H
#include <openssl/dh.h>
#endif
DH *get_dh2048()
	{
	static unsigned char dh2048_p[]={
		0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xC9,0x0F,0xDA,0xA2,
		0x21,0x68,0xC2,0x34,0xC4,0xC6,0x62,0x8B,0x80,0xDC,0x1C,0xD1,
		0x29,0x02,0x4E,0x08,0x8A,0x67,0xCC,0x74,0x02,0x0B,0xBE,0xA6,
		0x3B,0x13,0x9B,0x22,0x51,0x4A,0x08,0x79,0x8E,0x34,0x04,0xDD,
		0xEF,0x95,0x19,0xB3,0xCD,0x3A,0x43,0x1B,0x30,0x2B,0x0A,0x6D,
		0xF2,0x5F,0x14,0x37,0x4F,0xE1,0x35,0x6D,0x6D,0x51,0xC2,0x45,
		0xE4,0x85,0xB5,0x76,0x62,0x5E,0x7E,0xC6,0xF4,0x4C,0x42,0xE9,
		0xA6,0x37,0xED,0x6B,0x0B,0xFF,0x5C,0xB6,0xF4,0x06,0xB7,0xED,
		0xEE,0x38,0x6B,0xFB,0x5A,0x89,0x9F,0xA5,0xAE,0x9F,0x24,0x11,
		0x7C,0x4B,0x1F,0xE6,0x49,0x28,0x66,0x51,0xEC,0xE4,0x5B,0x3D,
		0xC2,0x00,0x7C,0xB8,0xA1,0x63,0xBF,0x05,0x98,0xDA,0x48,0x36,
		0x1C,0x55,0xD3,0x9A,0x69,0x16,0x3F,0xA8,0xFD,0x24,0xCF,0x5F,
		0x83,0x65,0x5D,0x23,0xDC,0xA3,0xAD,0x96,0x1C,0x62,0xF3,0x56,
		0x20,0x85,0x52,0xBB,0x9E,0xD5,0x29,0x07,0x70,0x96,0x96,0x6D,
		0x67,0x0C,0x35,0x4E,0x4A,0xBC,0x98,0x04,0xF1,0x74,0x6C,0x08,
		0xCA,0x18,0x21,0x7C,0x32,0x90,0x5E,0x46,0x2E,0x36,0xCE,0x3B,
		0xE3,0x9E,0x77,0x2C,0x18,0x0E,0x86,0x03,0x9B,0x27,0x83,0xA2,
		0xEC,0x07,0xA2,0x8F,0xB5,0xC5,0x5D,0xF0,0x6F,0x4C,0x52,0xC9,
		0xDE,0x2B,0xCB,0xF6,0x95,0x58,0x17,0x18,0x39,0x95,0x49,0x7C,
		0xEA,0x95,0x6A,0xE5,0x15,0xD2,0x26,0x18,0x98,0xFA,0x05,0x10,
		0x15,0x72,0x8E,0x5A,0x8A,0xAC,0xAA,0x68,0xFF,0xFF,0xFF,0xFF,
		0xFF,0xFF,0xFF,0xFF,
		};
	static unsigned char dh2048_g[]={
		0x02,
		};
	DH *dh;

	if ((dh=DH_new()) == NULL) return(NULL);
	dh->p=BN_bin2bn(dh2048_p,sizeof(dh2048_p),NULL);
	dh->g=BN_bin2bn(dh2048_g,sizeof(dh2048_g),NULL);
	if ((dh->p == NULL) || (dh->g == NULL))
		{ DH_free(dh); return(NULL); }
	return(dh);
	}

[AOLSERVER-COMMITS] nsopenssl ChangeLog, 1.120, 1.121 README, 1.6, 1.7 sslcontext.c, 1.14, 1.15

[Scott S. G. <sc...@us...>]

Update of /cvsroot/aolserver/nsopenssl
In directory sfp-cvs-1.v30.ch3.sourceforge.com:/tmp/cvs-serv25785

Modified Files:
	ChangeLog README sslcontext.c 
Log Message:
Changed ECDH to use 2048 bit ECDH parameters as 1024 bit or less parameters are
now considered weak and insecure and can subject your site to the LOGJAM
attack. The 1024 bit ECDH included code is commented out; what bit size
parameters one sets up may become a configuration option in the future.

See: https://weakdh.org

Turned on preference for enforcing server cipher order
(SSL_OP_CIPHER_SERVER_PREFERENCE) to prevent a client from using a lower
security cipher suite if a higher security one is available on both ends
(though I think you can set the order manually via the CipherSuite parameter
and set a less secure cipher suite order). This is hard-coded for now but may
become an option in the future with a reasonable default.

Updated README ns_param for Protocols and CipherSuites to be more secure
examples.



Index: README
===================================================================
RCS file: /cvsroot/aolserver/nsopenssl/README,v
retrieving revision 1.6
retrieving revision 1.7
diff -C2 -d -r1.6 -r1.7
*** README	25 Aug 2004 21:33:47 -0000	1.6
--- README	18 Dec 2016 19:21:47 -0000	1.7
***************
*** 134,139 ****
  ns_param CADir                 ca-client/dir
  ns_param CAFile                ca-client/ca-client.crt
! ns_param Protocols             "SSLv3, TLSv1"
! ns_param CipherSuite           "ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:++EXP"
  ns_param PeerVerify            false
  ns_param PeerVerifyDepth       3
--- 134,140 ----
  ns_param CADir                 ca-client/dir
  ns_param CAFile                ca-client/ca-client.crt
! ns_param Protocols             "-SSLv2 -SSLv3 TLSv1 TLSv1.1 TLSv1.2"
! ns_param CipherSuite           "kEECDH+ECDSA:kEECDH:kEDH:HIGH:+SHA:+RC4:RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!DSS:!PSK:!SRP:!kECDH:!CAMELLIA:!IDEA:!SEED"
! #ns_param CipherSuite           "ALL:!ADH:RC4+RSA:+HIGH:-MEDIUM:-LOW:-EXP"
  ns_param PeerVerify            false
  ns_param PeerVerifyDepth       3

Index: sslcontext.c
===================================================================
RCS file: /cvsroot/aolserver/nsopenssl/sslcontext.c,v
retrieving revision 1.14
retrieving revision 1.15
diff -C2 -d -r1.14 -r1.15
*** sslcontext.c	18 Dec 2016 18:21:58 -0000	1.14
--- sslcontext.c	18 Dec 2016 19:21:47 -0000	1.15
***************
*** 39,42 ****
--- 39,43 ----
  #include "nsopenssl.h"
  #include "dh1024.h"
+ #include "dh2048.h"
  
  Tcl_HashTable NsOpenSSLServers;
***************
*** 212,215 ****
--- 213,218 ----
  NsOpenSSLContextInit(char *server, NsOpenSSLContext *sslcontext)
  {
+     const char * dh_bits = "2048";
+ 
      if (sslcontext == NULL) {
          Ns_Log(Error, "%s (%s): SSL context is NULL", MODULE, server);
***************
*** 228,231 ****
--- 231,237 ----
      if (sslcontext->role) {
          sslcontext->sslctx = SSL_CTX_new(SSLv23_server_method());
+         SSL_CTX_set_options(sslcontext->sslctx, SSL_OP_CIPHER_SERVER_PREFERENCE);
+         Ns_Log(Notice, "%s (%s): '%s' prefer server cipher set to on",
+             MODULE, server, sslcontext->name);
      } else {
          sslcontext->sslctx = SSL_CTX_new(SSLv23_client_method());
***************
*** 267,277 ****
       */
  
!     DH *dh = get_dh1024();
      if (dh == NULL || SSL_CTX_set_tmp_dh(sslcontext->sslctx, dh) == 0) {
!         Ns_Log(Error, "%s (%s): failed to set DH parameters - some ciphers will not be available", 
!             MODULE, server);
      } else {
!         Ns_Log(Notice, "%s (%s): DH parameters (1024 bit) set", 
!             MODULE, server);
  	/*
           * Necessary for OpenSSL 1.0.2 - 1.0.2e to fix vulnerability.
--- 273,283 ----
       */
  
!     DH *dh = get_dh2048();
      if (dh == NULL || SSL_CTX_set_tmp_dh(sslcontext->sslctx, dh) == 0) {
!         Ns_Log(Error, "%s (%s): '%s' failed to set DH parameters - some ciphers will not be available", 
!             MODULE, server, sslcontext->name);
      } else {
!         Ns_Log(Notice, "%s (%s): '%s' DH parameters (%s bit) set", 
!             MODULE, server, sslcontext->name, dh_bits);
  	/*
           * Necessary for OpenSSL 1.0.2 - 1.0.2e to fix vulnerability.
***************
*** 294,303 ****
  
      EC_KEY *ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
!     if (ecdh == NULL || SSL_CTX_set_tmp_ecdh(sslcontext->sslctx, ecdh) != 1) {
!         Ns_Log(Error, "%s (%s): failed to set ECDH parameters - some ciphers will not be available",
!             MODULE, server);
      } else {
!         Ns_Log(Notice, "%s (%s): ECDH parameters set using the prime256v1 curve", 
!             MODULE, server);
      }
      EC_KEY_free (ecdh);
--- 300,309 ----
  
      EC_KEY *ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
!     if (ecdh == NULL || SSL_CTX_set_tmp_ecdh(sslcontext->sslctx, ecdh) == 0) {
!         Ns_Log(Error, "%s (%s): '%s' failed to set ECDH parameters - some ciphers will not be available",
!             MODULE, server, sslcontext->name);
      } else {
!         Ns_Log(Notice, "%s (%s): '%s' ECDH parameters set using the prime256v1 curve", 
!             MODULE, server, sslcontext->name);
      }
      EC_KEY_free (ecdh);

Index: ChangeLog
===================================================================
RCS file: /cvsroot/aolserver/nsopenssl/ChangeLog,v
retrieving revision 1.120
retrieving revision 1.121
diff -C2 -d -r1.120 -r1.121
*** ChangeLog	18 Dec 2016 18:21:58 -0000	1.120
--- ChangeLog	18 Dec 2016 19:21:47 -0000	1.121
***************
*** 1,2 ****
--- 1,23 ----
+ 2016-12-19  Scott S. Goodwin <sc...@sc...>
+ 
+ 	* sslcontext.c: Changed ECDH to use 2048 bit ECDH parameters as 1024
+ 	  bit or less parameters are now considered weak and insecure and can
+ 	  subject your site to the LOGJAM attack. The 1024 bit ECDH included
+ 	  code is commented out; what bit size parameters one sets up may
+ 	  become a configuration option in the future.
+ 
+ 	  See: https://weakdh.org
+ 
+ 	  Turned on preference for enforcing server cipher order
+ 	  (SSL_OP_CIPHER_SERVER_PREFERENCE) to prevent a client from using a
+ 	  lower security cipher suite if a higher security one is available on
+ 	  both ends (though I think you can set the order manually via the
+ 	  CipherSuite parameter and set a less secure cipher suite order). This
+ 	  is hard-coded for now but may become an option in the future with a
+ 	  reasonable default.
+ 
+ 	* README: Updated ns_param for Protocols and CipherSuites to be more
+ 	  secure examples.
+ 
  2016-12-18  Scott S. Goodwin <sc...@sc...>
  

[AOLSERVER-COMMITS] nsopenssl ChangeLog, 1.119, 1.120 defaults.h, 1.4, 1.5 sslcontext.c, 1.13, 1.14

[Scott S. G. <sc...@us...>]

Update of /cvsroot/aolserver/nsopenssl
In directory sfp-cvs-1.v30.ch3.sourceforge.com:/tmp/cvs-serv22782

Modified Files:
	ChangeLog defaults.h sslcontext.c 
Log Message:
* sslcontext.c: Fixed Protocols string processing and setting of
SSL/TLS protocols. The existing code wasn't doing the right things, and is now
processing the Protocols string properly. Added the TLSv1.1 and TLSv1.2
protocols as options.  The 'All' parameter in the Protocols string is dangerous
as it will silently turn on SSLv2 and SSLv3, so better logging information has
been added.  Needs to be refactored to simplify the code (will do that another
time).  Also fixed the ECDH notice about failing to set ECDH parameters when
they were actually set successfully.

* defaults.h: Updated DEFAULT_PROTOCOLS to be more secure. SSLv2 and
SSLv3 are not secure and we take them out up front. We don't use the "All"
parameter.

ns_param Protocols "-SSLv2 -SSLv3 TLSv1 TLSv1.1 TLSv1.2"


Index: sslcontext.c
===================================================================
RCS file: /cvsroot/aolserver/nsopenssl/sslcontext.c,v
retrieving revision 1.13
retrieving revision 1.14
diff -C2 -d -r1.13 -r1.14
*** sslcontext.c	17 Dec 2016 22:55:49 -0000	1.13
--- sslcontext.c	18 Dec 2016 18:21:58 -0000	1.14
***************
*** 294,298 ****
  
      EC_KEY *ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
!     if (ecdh == NULL || SSL_CTX_set_tmp_ecdh(sslcontext->sslctx, ecdh) == 1) {
          Ns_Log(Error, "%s (%s): failed to set ECDH parameters - some ciphers will not be available",
              MODULE, server);
--- 294,298 ----
  
      EC_KEY *ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
!     if (ecdh == NULL || SSL_CTX_set_tmp_ecdh(sslcontext->sslctx, ecdh) != 1) {
          Ns_Log(Error, "%s (%s): failed to set ECDH parameters - some ciphers will not be available",
              MODULE, server);
***************
*** 1858,1890 ****
      char *lprotocols = NULL;
  
!     bits = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1;
      if (sslcontext->protocols == NULL) {
!         Ns_Log(Notice, "%s (%s): '%s' protocol parameter not set; using all protocols: SSLv2, SSLv3 and TLSv1",
!                 MODULE, sslcontext->server, sslcontext->name);
          bits &= ~bits;
!     } else {
!         lprotocols = ns_strdup(sslcontext->protocols);
!         lprotocols = Ns_StrToLower(lprotocols);
!         if (strstr(lprotocols, "all") != NULL) {
!             Ns_Log(Notice, "%s (%s): '%s' using all protocols: SSLv2, SSLv3 and TLSv1",
!                     MODULE, sslcontext->server, sslcontext->name);
!             bits &= ~bits;
!         } else {
!             if (strstr(lprotocols, "sslv2") != NULL) {
!                 Ns_Log(Notice, "%s (%s): '%s' using SSLv2 protocol", MODULE, sslcontext->server, sslcontext->name);
!                 bits &= ~SSL_OP_NO_SSLv2;
!             }
!             if (strstr(lprotocols, "sslv3") != NULL) {
!                 Ns_Log(Notice, "%s (%s): '%s' using SSLv3 protocol", MODULE, sslcontext->server, sslcontext->name);
!                 bits &= ~SSL_OP_NO_SSLv3;
!             }
!             if (strstr(lprotocols, "tlsv1") != NULL) {
!                 Ns_Log(Notice, "%s (%s): '%s' using TLSv1 protocol",
!                         MODULE, sslcontext->server, sslcontext->name);
!                 bits &= ~SSL_OP_NO_TLSv1;
!             }
!         }
!         ns_free(lprotocols);
      }
      if (SSL_CTX_set_options(sslcontext->sslctx, bits) == 0) {
          Ns_Log(Error, "%s (%s): protocol initialization failed",
--- 1858,1927 ----
      char *lprotocols = NULL;
  
!     /* Turn off all protocols to start with */
!     bits = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1 | SSL_OP_NO_TLSv1_2;
! 
!     /* This should always be set when the context is initialized, but just in case ... */
      if (sslcontext->protocols == NULL) {
!         sslcontext->protocols = DEFAULT_PROTOCOLS;
!         Ns_Log(Notice, "%s (%s): '%s' no Protocols string is set in the config file - using the default: %s",
!                 MODULE, sslcontext->server, sslcontext->name, DEFAULT_PROTOCOLS);
!     }
! 
!     lprotocols = Ns_StrToLower(ns_strdup(sslcontext->protocols));
! 
!     if (strstr(lprotocols, "all") != NULL) {
          bits &= ~bits;
!         Ns_Log(Warning, "%s (%s): '%s' enabling all protocols; ensure you turn off SSLv2 and SSLv3 in config Protocols string as they are insecure",
!                 MODULE, sslcontext->server, sslcontext->name);
!         Ns_Log(Notice, "%s (%s): '%s' you are using this Protocols string: %s",
!                 MODULE, sslcontext->server, sslcontext->name, sslcontext->protocols);
!         Ns_Log(Notice, "%s (%s): '%s' consider using this Protocols string instead: %s",
!                 MODULE, sslcontext->server, sslcontext->name, "ALL -SSLv2 -SSLv3");
      }
+ 
+     if (strstr(lprotocols, "-sslv2") != NULL) {
+         Ns_Log(Notice, "%s (%s): '%s' disabling SSLv2 protocol", MODULE, sslcontext->server, sslcontext->name);
+         bits |= SSL_OP_NO_SSLv2;
+     } else if (strstr(lprotocols, "sslv2") != NULL) {
+         Ns_Log(Warning, "%s (%s): '%s' enabling SSLv2 protocol - SSLv2 is insecure and should not be used", 
+             MODULE, sslcontext->server, sslcontext->name);
+         bits &= ~SSL_OP_NO_SSLv2;
+     }
+ 
+     if (strstr(lprotocols, "-sslv3") != NULL) {
+         Ns_Log(Notice, "%s (%s): '%s' disabling SSLv3 protocol", MODULE, sslcontext->server, sslcontext->name);
+         bits |= SSL_OP_NO_SSLv3;
+     } else if (strstr(lprotocols, "sslv3") != NULL) {
+         Ns_Log(Warning, "%s (%s): '%s' enabling SSLv3 protocol - SSLv3 is insecure and should not be used", 
+             MODULE, sslcontext->server, sslcontext->name);
+         bits &= ~SSL_OP_NO_SSLv3;
+     }
+ 
+     if (strstr(lprotocols, "-tlsv1") != NULL) {
+         Ns_Log(Notice, "%s (%s): '%s' disabling TLSv1 protocol", MODULE, sslcontext->server, sslcontext->name);
+         bits |= SSL_OP_NO_TLSv1;
+     } else if (strstr(lprotocols, "tlsv1") != NULL) {
+         Ns_Log(Notice, "%s (%s): '%s' enabling TLSv1 protocol", MODULE, sslcontext->server, sslcontext->name);
+         bits &= ~SSL_OP_NO_TLSv1;
+     }
+ 
+     if (strstr(lprotocols, "-tlsv1.1") != NULL) {
+         Ns_Log(Notice, "%s (%s): '%s' disabling TLSv1.1 protocol", MODULE, sslcontext->server, sslcontext->name);
+         bits |= SSL_OP_NO_TLSv1_1;
+     } else if (strstr(lprotocols, "tlsv1.1") != NULL) {
+         Ns_Log(Notice, "%s (%s): '%s' enabling TLSv1.1 protocol", MODULE, sslcontext->server, sslcontext->name);
+         bits &= ~SSL_OP_NO_TLSv1_1;
+     }
+ 
+     if (strstr(lprotocols, "-tlsv1.2") != NULL) {
+         Ns_Log(Notice, "%s (%s): '%s' disabling TLSv1.2 protocol", MODULE, sslcontext->server, sslcontext->name);
+         bits |= SSL_OP_NO_TLSv1_2;
+     } else if (strstr(lprotocols, "tlsv1.2") != NULL) {
+         Ns_Log(Notice, "%s (%s): '%s' enabling TLSv1.2 protocol", MODULE, sslcontext->server, sslcontext->name);
+         bits &= ~SSL_OP_NO_TLSv1_2;
+     }
+ 
+     ns_free(lprotocols);
+     
      if (SSL_CTX_set_options(sslcontext->sslctx, bits) == 0) {
          Ns_Log(Error, "%s (%s): protocol initialization failed",

Index: defaults.h
===================================================================
RCS file: /cvsroot/aolserver/nsopenssl/defaults.h,v
retrieving revision 1.4
retrieving revision 1.5
diff -C2 -d -r1.4 -r1.5
*** defaults.h	24 Jun 2004 03:29:37 -0000	1.4
--- defaults.h	18 Dec 2016 18:21:58 -0000	1.5
***************
*** 10,14 ****
  #define SERVER_ROLE                    1
  #define CLIENT_ROLE                    0
! #define DEFAULT_PROTOCOLS              "All"
  #define DEFAULT_CIPHER_LIST            SSL_DEFAULT_CIPHER_LIST
  //#define DEFAULT_CERT_FILE              "certificate.pem"
--- 10,14 ----
  #define SERVER_ROLE                    1
  #define CLIENT_ROLE                    0
! #define DEFAULT_PROTOCOLS              "-SSLv2 -SSLv3 TLSv1 TLSv1.1 TLSv1.2"
  #define DEFAULT_CIPHER_LIST            SSL_DEFAULT_CIPHER_LIST
  //#define DEFAULT_CERT_FILE              "certificate.pem"

Index: ChangeLog
===================================================================
RCS file: /cvsroot/aolserver/nsopenssl/ChangeLog,v
retrieving revision 1.119
retrieving revision 1.120
diff -C2 -d -r1.119 -r1.120
*** ChangeLog	17 Dec 2016 22:55:49 -0000	1.119
--- ChangeLog	18 Dec 2016 18:21:58 -0000	1.120
***************
*** 1,14 ****
! 2016-12-17  Scott S. Goodwin <sc...@sc...>
  
! 	* sslcontext.c: Set up ECDH parameters to enable the use of ciphers
! 	  that require these parameters, some of which provide for forward
! 	  secrecy. Without configured ECDH paramaters, OpenSSL silently ignores
! 	  ciphers that require them, even if you expliticly add them to the
! 	  CipherSuite configuration string. Also minor cleanup of the DH code
! 	  committed yesterday.
  
! 	  See: https://wiki.openssl.org/index.php/Elliptic_Curve_Diffie_Hellman
  
! 2016-12-16  Scott S. Goodwin <sc...@sc...>
  
  	* sslcontext.c: Set up ECDH parameters to enable the use of ciphers
--- 1,21 ----
! 2016-12-18  Scott S. Goodwin <sc...@sc...>
  
! 	* sslcontext.c: Fixed Protocols string processing and setting of
! 	  SSL/TLS protocols. The existing code wasn't doing the right things,
! 	  and is now processing the Protocols string properly. Added the
! 	  TLSv1.1 and TLSv1.2 protocols as options.  The 'All' parameter in the
! 	  Protocols string is dangerous as it will silently turn on SSLv2 and
! 	  SSLv3, so better logging information has been added.  Needs to be
! 	  refactored to simplify the code (will do that another time).  Also
! 	  fixed the ECDH notice about failing to set ECDH parameters when they
! 	  were actually set successfully.
  
! 	* defaults.h: Updated DEFAULT_PROTOCOLS to be more secure. SSLv2 and
! 	  SSLv3 are not secure and we take them out up front. We don't use the
! 	  "All" parameter.
  
! 	  ns_param Protocols "-SSLv2 -SSLv3 TLSv1 TLSv1.1 TLSv1.2"
! 
! 2016-12-17  Scott S. Goodwin <sc...@sc...>
  
  	* sslcontext.c: Set up ECDH parameters to enable the use of ciphers
***************
*** 16,20 ****
  	  secrecy. Without configured ECDH paramaters, OpenSSL silently ignores
  	  ciphers that require them, even if you expliticly add them to the
! 	  CipherSuite configuration string.
  
  	  See: https://wiki.openssl.org/index.php/Elliptic_Curve_Diffie_Hellman
--- 23,28 ----
  	  secrecy. Without configured ECDH paramaters, OpenSSL silently ignores
  	  ciphers that require them, even if you expliticly add them to the
! 	  CipherSuite configuration string. Also minor cleanup of the DH code
! 	  committed yesterday.
  
  	  See: https://wiki.openssl.org/index.php/Elliptic_Curve_Diffie_Hellman

[AOLSERVER-COMMITS] nsopenssl ChangeLog, 1.118, 1.119 sslcontext.c, 1.12, 1.13

[Scott S. G. <sc...@us...>]

Update of /cvsroot/aolserver/nsopenssl
In directory sfp-cvs-1.v30.ch3.sourceforge.com:/tmp/cvs-serv6781

Modified Files:
	ChangeLog sslcontext.c 
Log Message:
Set up ECDH parameters to enable the use of ciphers that require these
parameters, some of which provide for forward secrecy. Without configured ECDH
paramaters, OpenSSL silently ignores ciphers that require them, even if you
expliticly add them to the CipherSuite configuration string. Also minor cleanup
of the DH code committed yesterday.

See: https://wiki.openssl.org/index.php/Elliptic_Curve_Diffie_Hellman


Index: sslcontext.c
===================================================================
RCS file: /cvsroot/aolserver/nsopenssl/sslcontext.c,v
retrieving revision 1.12
retrieving revision 1.13
diff -C2 -d -r1.12 -r1.13
*** sslcontext.c	16 Dec 2016 16:45:41 -0000	1.12
--- sslcontext.c	17 Dec 2016 22:55:49 -0000	1.13
***************
*** 267,281 ****
       */
  
!     DH *dh = get_dh1024 ();
!     if (SSL_CTX_set_tmp_dh(sslcontext->sslctx, dh) == 1) {
          Ns_Log(Notice, "%s (%s): DH parameters (1024 bit) set", 
              MODULE, server);
!         /* This apparently prevents some sort of DH attack */
          SSL_CTX_set_options(sslcontext->sslctx, SSL_OP_SINGLE_DH_USE);
      } else {
!         Ns_Log(Error, "%s (%s): failed to set DH parameters - some ciphers will not be available", 
              MODULE, server);
      }
!     DH_free (dh);
  
      /*
--- 267,305 ----
       */
  
!     DH *dh = get_dh1024();
!     if (dh == NULL || SSL_CTX_set_tmp_dh(sslcontext->sslctx, dh) == 0) {
!         Ns_Log(Error, "%s (%s): failed to set DH parameters - some ciphers will not be available", 
!             MODULE, server);
!     } else {
          Ns_Log(Notice, "%s (%s): DH parameters (1024 bit) set", 
              MODULE, server);
! 	/*
!          * Necessary for OpenSSL 1.0.2 - 1.0.2e to fix vulnerability.
!          * Works in OpenSSL < 1.0.2 to prevent using same DH params repeatedly.
!          * No effect in OpenSSL > 1.0.2e which forces it on regardless.
!          */
          SSL_CTX_set_options(sslcontext->sslctx, SSL_OP_SINGLE_DH_USE);
+     }
+     DH_free(dh);
+ 
+     /*
+      * Set up ECDH parameters to enable the use of ciphers that require these
+      * parameters, some of which provide for forward secrecy. Without
+      * configured ECDH paramaters, OpenSSL silently ignores ciphers that
+      * require them, even if you expliticly add them to the CipherSuite
+      * configuration string. 
+      *
+      * See: https://wiki.openssl.org/index.php/Elliptic_Curve_Diffie_Hellman
+      */
+ 
+     EC_KEY *ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
+     if (ecdh == NULL || SSL_CTX_set_tmp_ecdh(sslcontext->sslctx, ecdh) == 1) {
+         Ns_Log(Error, "%s (%s): failed to set ECDH parameters - some ciphers will not be available",
+             MODULE, server);
      } else {
!         Ns_Log(Notice, "%s (%s): ECDH parameters set using the prime256v1 curve", 
              MODULE, server);
      }
!     EC_KEY_free (ecdh);
  
      /*

Index: ChangeLog
===================================================================
RCS file: /cvsroot/aolserver/nsopenssl/ChangeLog,v
retrieving revision 1.118
retrieving revision 1.119
diff -C2 -d -r1.118 -r1.119
*** ChangeLog	16 Dec 2016 16:45:41 -0000	1.118
--- ChangeLog	17 Dec 2016 22:55:49 -0000	1.119
***************
*** 1,2 ****
--- 1,23 ----
+ 2016-12-17  Scott S. Goodwin <sc...@sc...>
+ 
+ 	* sslcontext.c: Set up ECDH parameters to enable the use of ciphers
+ 	  that require these parameters, some of which provide for forward
+ 	  secrecy. Without configured ECDH paramaters, OpenSSL silently ignores
+ 	  ciphers that require them, even if you expliticly add them to the
+ 	  CipherSuite configuration string. Also minor cleanup of the DH code
+ 	  committed yesterday.
+ 
+ 	  See: https://wiki.openssl.org/index.php/Elliptic_Curve_Diffie_Hellman
+ 
+ 2016-12-16  Scott S. Goodwin <sc...@sc...>
+ 
+ 	* sslcontext.c: Set up ECDH parameters to enable the use of ciphers
+ 	  that require these parameters, some of which provide for forward
+ 	  secrecy. Without configured ECDH paramaters, OpenSSL silently ignores
+ 	  ciphers that require them, even if you expliticly add them to the
+ 	  CipherSuite configuration string.
+ 
+ 	  See: https://wiki.openssl.org/index.php/Elliptic_Curve_Diffie_Hellman
+ 
  2016-12-16  Scott S. Goodwin <sc...@sc...>
  
***************
*** 9,12 ****
--- 30,47 ----
  	  distribution in apps/dh1024.pem.
  
+ 	  We create the .h file this way:
+ 
+ 	  $OPENSSL dhparam -inform PEM -in $DH_PEM_FILE -C -noout >> $DH_C_FILE
+ 
+ 	  Where:
+ 
+ 	  DH_PEM_FILE -> OpenSSL source dist apps/dh1024.pem file
+ 	  DH_C_FILE -> dh1024.h in the nsopenssl distribution directory
+ 
+ 	  The source dh1024.pem file might be regenerated and a new one supplied
+ 	  with each release of OpenSSL.
+ 
+ 	  See: https://wiki.openssl.org/index.php/Diffie-Hellman_parameters
+ 
  2004-11-20  tag v3_0beta26
  

[AOLSERVER-COMMITS] nsopenssl dh1024.h, NONE, 1.1 ChangeLog, 1.117, 1.118 sslcontext.c, 1.11, 1.12

[Scott S. G. <sc...@us...>]

Update of /cvsroot/aolserver/nsopenssl
In directory sfp-cvs-1.v30.ch3.sourceforge.com:/tmp/cvs-serv29122

Modified Files:
	ChangeLog sslcontext.c 
Added Files:
	dh1024.h 
Log Message:
sslcontext.c, dh1024.h:

Added 1024 bit DH parameters so that ciphers that utilize DH parameters can be
configured. If DH parameters are not available, any ciphers that require them
are silently ignored by OpenSSL even if you've explicitly specified them in the
CipherSuite configuration string. Some of these ciphers provide for forward
secrecy. The parameters come from the OpenSSL distribution in apps/dh1024.pem.


Index: sslcontext.c
===================================================================
RCS file: /cvsroot/aolserver/nsopenssl/sslcontext.c,v
retrieving revision 1.11
retrieving revision 1.12
diff -C2 -d -r1.11 -r1.12
*** sslcontext.c	28 Mar 2006 17:56:30 -0000	1.11
--- sslcontext.c	16 Dec 2016 16:45:41 -0000	1.12
***************
*** 38,41 ****
--- 38,42 ----
  
  #include "nsopenssl.h"
+ #include "dh1024.h"
  
  Tcl_HashTable NsOpenSSLServers;
***************
*** 247,257 ****
      SSL_CTX_set_options(sslcontext->sslctx, SSL_OP_ALL);
  
-     /* This apparently prevents some sort of DH attack */
-     SSL_CTX_set_options(sslcontext->sslctx, SSL_OP_SINGLE_DH_USE);
- 
      /* Temporary key callback required for 40-bit export browsers */
      SSL_CTX_set_tmp_rsa_callback(sslcontext->sslctx, IssueTmpRSAKey);
  
      /*
       * Failure in one of these will cause SSL context to be left uninitialized.
       */
--- 248,283 ----
      SSL_CTX_set_options(sslcontext->sslctx, SSL_OP_ALL);
  
      /* Temporary key callback required for 40-bit export browsers */
      SSL_CTX_set_tmp_rsa_callback(sslcontext->sslctx, IssueTmpRSAKey);
  
      /*
+      * Set up DH parameters to enable use of some forward secrecy ciphers.
+      * For now we will only use 1024 bit DH params generated by the latest
+      * OpenSSL release. We create the .h file this way:
+      *
+      * $OPENSSL dhparam -inform PEM -in $DH_PEM_FILE -C -noout >> $DH_C_FILE
+      *
+      * DH_PEM_FILE -> OpenSSL source dist apps/dh1024.pem file
+      * DH_C_FILE -> dh1024.h in the nsopenssl distribution directory
+      *
+      * The source dh1024.pem file might be regenerated and a new one supplied
+      * with each release of OpenSSL.
+      *
+      * See: https://wiki.openssl.org/index.php/Diffie-Hellman_parameters
+      */
+ 
+     DH *dh = get_dh1024 ();
+     if (SSL_CTX_set_tmp_dh(sslcontext->sslctx, dh) == 1) {
+         Ns_Log(Notice, "%s (%s): DH parameters (1024 bit) set", 
+             MODULE, server);
+         /* This apparently prevents some sort of DH attack */
+         SSL_CTX_set_options(sslcontext->sslctx, SSL_OP_SINGLE_DH_USE);
+     } else {
+         Ns_Log(Error, "%s (%s): failed to set DH parameters - some ciphers will not be available", 
+             MODULE, server);
+     }
+     DH_free (dh);
+ 
+     /*
       * Failure in one of these will cause SSL context to be left uninitialized.
       */

Index: ChangeLog
===================================================================
RCS file: /cvsroot/aolserver/nsopenssl/ChangeLog,v
retrieving revision 1.117
retrieving revision 1.118
diff -C2 -d -r1.117 -r1.118
*** ChangeLog	20 Nov 2004 06:43:51 -0000	1.117
--- ChangeLog	16 Dec 2016 16:45:41 -0000	1.118
***************
*** 1,2 ****
--- 1,12 ----
+ 2016-12-16  Scott S. Goodwin <sc...@sc...>
+ 
+ 	* sslcontext.c, dh1024.h: Added 1024 bit DH parameters so that 
+ 	  ciphers that utilize DH parameters can be configured. If DH
+ 	  parameters are not available, any ciphers that require them are
+ 	  silently ignored by OpenSSL even if you've explicitly specified them
+ 	  in the CipherSuite configuration string. Some of these ciphers
+ 	  provide for forward secrecy. The parameters come from the OpenSSL
+ 	  distribution in apps/dh1024.pem.
+ 
  2004-11-20  tag v3_0beta26
  

--- NEW FILE: dh1024.h ---
/* 1024-bit DH params from OpenSSL 1.0.1j apps/dh1024.pem */
#ifndef HEADER_DH_H
#include <openssl/dh.h>
#endif
DH *get_dh1024()
	{
	static unsigned char dh1024_p[]={
		0xF4,0x88,0xFD,0x58,0x4E,0x49,0xDB,0xCD,0x20,0xB4,0x9D,0xE4,
		0x91,0x07,0x36,0x6B,0x33,0x6C,0x38,0x0D,0x45,0x1D,0x0F,0x7C,
		0x88,0xB3,0x1C,0x7C,0x5B,0x2D,0x8E,0xF6,0xF3,0xC9,0x23,0xC0,
		0x43,0xF0,0xA5,0x5B,0x18,0x8D,0x8E,0xBB,0x55,0x8C,0xB8,0x5D,
		0x38,0xD3,0x34,0xFD,0x7C,0x17,0x57,0x43,0xA3,0x1D,0x18,0x6C,
		0xDE,0x33,0x21,0x2C,0xB5,0x2A,0xFF,0x3C,0xE1,0xB1,0x29,0x40,
		0x18,0x11,0x8D,0x7C,0x84,0xA7,0x0A,0x72,0xD6,0x86,0xC4,0x03,
		0x19,0xC8,0x07,0x29,0x7A,0xCA,0x95,0x0C,0xD9,0x96,0x9F,0xAB,
		0xD0,0x0A,0x50,0x9B,0x02,0x46,0xD3,0x08,0x3D,0x66,0xA4,0x5D,
		0x41,0x9F,0x9C,0x7C,0xBD,0x89,0x4B,0x22,0x19,0x26,0xBA,0xAB,
		0xA2,0x5E,0xC3,0x55,0xE9,0x2F,0x78,0xC7,
		};
	static unsigned char dh1024_g[]={
		0x02,
		};
	DH *dh;

	if ((dh=DH_new()) == NULL) return(NULL);
	dh->p=BN_bin2bn(dh1024_p,sizeof(dh1024_p),NULL);
	dh->g=BN_bin2bn(dh1024_g,sizeof(dh1024_g),NULL);
	if ((dh->p == NULL) || (dh->g == NULL))
		{ DH_free(dh); return(NULL); }
	return(dh);
	}

[AOLSERVER-COMMITS] aolserver/nsd tclcache.c,1.5,1.6

[Jeff R. <dv...@us...>]

Update of /cvsroot/aolserver/aolserver/nsd
In directory sfp-cvs-1.v30.ch3.sourceforge.com:/tmp/cvs-serv18266

Modified Files:
	tclcache.c 
Log Message:
Fixed panic when running against a tcl build with TCL_COMPILE_DEBUG.

A SetFromAny proc should not invalidate an existing stringrep, which 
SetCacheFromAny was doing.  


Index: tclcache.c
===================================================================
RCS file: /cvsroot/aolserver/aolserver/nsd/tclcache.c,v
retrieving revision 1.5
retrieving revision 1.6
diff -C2 -d -r1.5 -r1.6
*** tclcache.c	5 Jul 2011 18:37:47 -0000	1.5
--- tclcache.c	8 Jul 2014 02:07:38 -0000	1.6
***************
*** 730,735 ****
      objPtr->typePtr = &cacheType;
      objPtr->internalRep.otherValuePtr = cachePtr;
-     Tcl_InvalidateStringRep(objPtr);
-     objPtr->length = 0;  /* ensure there's no stumbling */
      return TCL_OK;
  }
--- 730,733 ----

[AOLSERVER-COMMITS] nsopenssl nsopenssl.c,1.77,1.78

[gustafn <gne...@us...>]

Update of /cvsroot/aolserver/nsopenssl
In directory sfp-cvs-1.v30.ch3.sourceforge.com:/tmp/cvs-serv6368/nsopenssl

Modified Files:
	nsopenssl.c 
Log Message:
- fixing visibility for nssha1, nscache and nsopenssl


Index: nsopenssl.c
===================================================================
RCS file: /cvsroot/aolserver/nsopenssl/nsopenssl.c,v
retrieving revision 1.77
retrieving revision 1.78
diff -C2 -d -r1.77 -r1.78
*** nsopenssl.c	20 Nov 2004 06:42:54 -0000	1.77
--- nsopenssl.c	27 Jun 2014 10:00:27 -0000	1.78
***************
*** 60,64 ****
  static void     LoadSSLDrivers(char *server);
  
! int Ns_ModuleVersion = 1;
  
  
--- 60,64 ----
  static void     LoadSSLDrivers(char *server);
  
! NS_EXPORT int Ns_ModuleVersion = 1;
  
  
***************
*** 78,82 ****
   */
  
! int
  Ns_ModuleInit(char *server, char *module)
  {
--- 78,82 ----
   */
  
! NS_EXPORT int
  Ns_ModuleInit(char *server, char *module)
  {

[AOLSERVER-COMMITS] aolserver/nsd sockcallback.c,1.17,1.18

[Jeff R. <dv...@us...>]

Update of /cvsroot/aolserver/aolserver/nsd
In directory sfp-cvs-1.v30.ch3.sourceforge.com:/tmp/cvs-serv12129

Modified Files:
	sockcallback.c 
Log Message:
fix size of reallocation unit (many thanks to Wolfgang Winkler for 
pointing this out)
(copied from Naviserver)


Index: sockcallback.c
===================================================================
RCS file: /cvsroot/aolserver/aolserver/nsd/sockcallback.c,v
retrieving revision 1.17
retrieving revision 1.18
diff -C2 -d -r1.17 -r1.18
*** sockcallback.c	13 Apr 2006 19:06:41 -0000	1.17
--- sockcallback.c	21 Nov 2013 21:43:35 -0000	1.18
***************
*** 354,358 ****
  	if (max <= table.numEntries) {
  	    max  = table.numEntries + 100;
! 	    pfds = ns_realloc(pfds, (size_t)max);
  	}
  	nfds = 1;
--- 354,358 ----
  	if (max <= table.numEntries) {
  	    max  = table.numEntries + 100;
! 	    pfds = ns_realloc(pfds, sizeof(struct pollfd) * max);
  	}
  	nfds = 1;

[AOLSERVER-COMMITS] aolserver/nsd quotehtml.c,1.5,1.6

[Jeff R. <dv...@us...>]

Update of /cvsroot/aolserver/aolserver/nsd
In directory sfp-cvs-1.v30.ch3.sourceforge.com:/tmp/cvs-serv11617

Modified Files:
	quotehtml.c 
Log Message:
fix to avoid creating invalid strings when quoting empty string


Index: quotehtml.c
===================================================================
RCS file: /cvsroot/aolserver/aolserver/nsd/quotehtml.c,v
retrieving revision 1.5
retrieving revision 1.6
diff -C2 -d -r1.5 -r1.6
*** quotehtml.c	18 Jul 2005 23:33:23 -0000	1.5
--- quotehtml.c	21 Nov 2013 21:37:00 -0000	1.6
***************
*** 62,66 ****
  
      end = string + strlen(string);
!     do {
  	next = Tcl_UtfNext(string);
          switch (*string) {
--- 62,66 ----
  
      end = string + strlen(string);
!     while (string < end) {
  	next = Tcl_UtfNext(string);
          switch (*string) {
***************
*** 90,94 ****
          }
  	string = next;
!     } while (string < end);
  }
  
--- 90,94 ----
          }
  	string = next;
!     };
  }
  

[AOLSERVER-COMMITS] aolserver/nsd init.tcl,1.37.2.2,1.37.2.3

[Jeff R. <dv...@us...>]

Update of /cvsroot/aolserver/aolserver/nsd
In directory vz-cvs-4.sog:/tmp/cvs-serv20320/nsd

Modified Files:
      Tag: aolserver_v45_r2
	init.tcl 
Log Message:
merge trunk changes to release branch

Index: init.tcl
===================================================================
RCS file: /cvsroot/aolserver/aolserver/nsd/init.tcl,v
retrieving revision 1.37.2.2
retrieving revision 1.37.2.3
diff -C2 -d -r1.37.2.2 -r1.37.2.3
*** init.tcl	11 May 2012 17:13:37 -0000	1.37.2.2
--- init.tcl	18 Sep 2012 00:29:50 -0000	1.37.2.3
***************
*** 327,333 ****
      foreach n $nslist {
          foreach {ns_script ns_import} [_ns_getscript $n] {
!             append script [list namespace eval $n $ns_script] \n
              if {$ns_import != ""} {
!                 append import [list namespace eval $n $ns_import] \n
              }
          }
--- 327,333 ----
      foreach n $nslist {
          foreach {ns_script ns_import} [_ns_getscript $n] {
!             append script [list ::namespace eval $n $ns_script] \n
              if {$ns_import != ""} {
!                 append import [list ::namespace eval $n $ns_import] \n
              }
          }
***************
*** 429,432 ****
--- 429,434 ----
      lappend list $top
      foreach c [namespace children $top] {
+ 	# skip built-in namespaces
+         if {$c in {::oo}} continue
          _ns_getnamespaces list $c
      }
***************
*** 457,463 ****
      proc _ns_create_or_config_ensemble {cmd cfg} {
         if {[info command $cmd] eq $cmd && [namespace ensemble exists $cmd]} {
!          uplevel 1 [list namespace ensemble configure $cmd {*}$cfg]
         } else {
!          uplevel 1 [list namespace ensemble create -command $cmd {*}$cfg]
         }
      }
--- 459,465 ----
      proc _ns_create_or_config_ensemble {cmd cfg} {
         if {[info command $cmd] eq $cmd && [namespace ensemble exists $cmd]} {
!          uplevel 1 [list ::namespace ensemble configure $cmd {*}$cfg]
         } else {
!          uplevel 1 [list ::namespace ensemble create -command $cmd {*}$cfg]
         }
      }
***************
*** 468,472 ****
              ::unset _cfg(-namespace)
              ::set _encmd [::list ::_ns_create_or_config_ensemble $cmd [::array get _cfg]]
!             return [::list namespace eval $_enns $_encmd]\n
          }
      }
--- 470,474 ----
              ::unset _cfg(-namespace)
              ::set _encmd [::list ::_ns_create_or_config_ensemble $cmd [::array get _cfg]]
!             return [::list ::namespace eval $_enns $_encmd]\n
          }
      }
***************
*** 573,577 ****
              } else {
                  # procedure imported from other namespace
!                 ::append _import [::list namespace import -force $_orig] \n
  		# renamed after import
  		::if {[::namespace tail $_orig] != $_proc} {
--- 575,579 ----
              } else {
                  # procedure imported from other namespace
!                 ::append _import [::list ::namespace import -force $_orig] \n
  		# renamed after import
  		::if {[::namespace tail $_orig] != $_proc} {
***************
*** 589,593 ****
              ::if {[::info exists _prcs($_cmnd)] == 0 
                      && $_orig != [::namespace which -command $_cmnd]} {
!                 ::append _import [::list namespace import -force $_orig] \n
              }
  	    ::append _import [_ns_getensemble $_cmnd]
--- 591,595 ----
              ::if {[::info exists _prcs($_cmnd)] == 0 
                      && $_orig != [::namespace which -command $_cmnd]} {
!                 ::append _import [::list ::namespace import -force $_orig] \n
              }
  	    ::append _import [_ns_getensemble $_cmnd]
***************
*** 601,605 ****
          ::set _exp [::namespace export]
          if {[::llength $_exp]} {
!             ::append _script [::concat namespace export $_exp] \n
          }
  
--- 603,607 ----
          ::set _exp [::namespace export]
          if {[::llength $_exp]} {
!             ::append _script [::concat ::namespace export $_exp] \n
          }
  

[AOLSERVER-COMMITS] aolserver ChangeLog,1.406.2.2,1.406.2.3

[Jeff R. <dv...@us...>]

Update of /cvsroot/aolserver/aolserver
In directory vz-cvs-4.sog:/tmp/cvs-serv20288

Modified Files:
      Tag: aolserver_v45_r2
	ChangeLog 
Log Message:
merge trunk changes to release branch

Index: ChangeLog
===================================================================
RCS file: /cvsroot/aolserver/aolserver/ChangeLog,v
retrieving revision 1.406.2.2
retrieving revision 1.406.2.3
diff -C2 -d -r1.406.2.2 -r1.406.2.3
*** ChangeLog	11 May 2012 17:13:21 -0000	1.406.2.2
--- ChangeLog	18 Sep 2012 00:29:40 -0000	1.406.2.3
***************
*** 1,2 ****
--- 1,12 ----
+ 2012-09-17 Jeff Rogers <dv...@di...>
+ 	* include/nsthread.h: update definition of NS_EXPORT to use modern GCC
+ 	visibility attributes
+ 	* include/ns.h: add an automatic export for ModInit proc to avoid 
+ 	forcing all modules to change for visibility.
+ 	* include/ns.mak.in: add NS_MODINIT define when compiling modules
+ 	to pull in automatic export
+ 	* nsd/init.tcl: make sure to fully qualify 'namespace'.  Omit 
+ 	'::oo' from namespace traversal until tcloo is better understood.
+ 
  2012-05-11 Jeff Rogers <dv...@di...>
  	* nsd/init.tcl: fix previous version that had renaming logic twice

[AOLSERVER-COMMITS] aolserver/nsd init.tcl,1.39,1.40

[Jeff R. <dv...@us...>]

Update of /cvsroot/aolserver/aolserver/nsd
In directory vz-cvs-4.sog:/tmp/cvs-serv32082/nsd

Modified Files:
	init.tcl 
Log Message:
qualified some namespace calls. 
Omit '::oo' (tclOO) from namespace traversal until I better understand
the right way to re-create those objects.


Index: init.tcl
===================================================================
RCS file: /cvsroot/aolserver/aolserver/nsd/init.tcl,v
retrieving revision 1.39
retrieving revision 1.40
diff -C2 -d -r1.39 -r1.40
*** init.tcl	11 May 2012 17:22:04 -0000	1.39
--- init.tcl	17 Sep 2012 20:48:49 -0000	1.40
***************
*** 327,333 ****
      foreach n $nslist {
          foreach {ns_script ns_import} [_ns_getscript $n] {
!             append script [list namespace eval $n $ns_script] \n
              if {$ns_import != ""} {
!                 append import [list namespace eval $n $ns_import] \n
              }
          }
--- 327,333 ----
      foreach n $nslist {
          foreach {ns_script ns_import} [_ns_getscript $n] {
!             append script [list ::namespace eval $n $ns_script] \n
              if {$ns_import != ""} {
!                 append import [list ::namespace eval $n $ns_import] \n
              }
          }
***************
*** 429,432 ****
--- 429,434 ----
      lappend list $top
      foreach c [namespace children $top] {
+ 	# skip built-in namespaces
+         if {$c in {::oo}} continue
          _ns_getnamespaces list $c
      }
***************
*** 457,463 ****
      proc _ns_create_or_config_ensemble {cmd cfg} {
         if {[info command $cmd] eq $cmd && [namespace ensemble exists $cmd]} {
!          uplevel 1 [list namespace ensemble configure $cmd {*}$cfg]
         } else {
!          uplevel 1 [list namespace ensemble create -command $cmd {*}$cfg]
         }
      }
--- 459,465 ----
      proc _ns_create_or_config_ensemble {cmd cfg} {
         if {[info command $cmd] eq $cmd && [namespace ensemble exists $cmd]} {
!          uplevel 1 [list ::namespace ensemble configure $cmd {*}$cfg]
         } else {
!          uplevel 1 [list ::namespace ensemble create -command $cmd {*}$cfg]
         }
      }
***************
*** 468,472 ****
              ::unset _cfg(-namespace)
              ::set _encmd [::list ::_ns_create_or_config_ensemble $cmd [::array get _cfg]]
!             return [::list namespace eval $_enns $_encmd]\n
          }
      }
--- 470,474 ----
              ::unset _cfg(-namespace)
              ::set _encmd [::list ::_ns_create_or_config_ensemble $cmd [::array get _cfg]]
!             return [::list ::namespace eval $_enns $_encmd]\n
          }
      }
***************
*** 573,577 ****
              } else {
                  # procedure imported from other namespace
!                 ::append _import [::list namespace import -force $_orig] \n
  		# renamed after import
  		::if {[::namespace tail $_orig] != $_proc} {
--- 575,579 ----
              } else {
                  # procedure imported from other namespace
!                 ::append _import [::list ::namespace import -force $_orig] \n
  		# renamed after import
  		::if {[::namespace tail $_orig] != $_proc} {
***************
*** 589,593 ****
              ::if {[::info exists _prcs($_cmnd)] == 0 
                      && $_orig != [::namespace which -command $_cmnd]} {
!                 ::append _import [::list namespace import -force $_orig] \n
              }
  	    ::append _import [_ns_getensemble $_cmnd]
--- 591,595 ----
              ::if {[::info exists _prcs($_cmnd)] == 0 
                      && $_orig != [::namespace which -command $_cmnd]} {
!                 ::append _import [::list ::namespace import -force $_orig] \n
              }
  	    ::append _import [_ns_getensemble $_cmnd]
***************
*** 601,605 ****
          ::set _exp [::namespace export]
          if {[::llength $_exp]} {
!             ::append _script [::concat namespace export $_exp] \n
          }
  
--- 603,607 ----
          ::set _exp [::namespace export]
          if {[::llength $_exp]} {
!             ::append _script [::concat ::namespace export $_exp] \n
          }
  

[AOLSERVER-COMMITS] aolserver ChangeLog,1.409,1.410

[Jeff R. <dv...@us...>]

Update of /cvsroot/aolserver/aolserver
In directory vz-cvs-4.sog:/tmp/cvs-serv32057

Modified Files:
	ChangeLog 
Log Message:
added automatic export for modules


Index: ChangeLog
===================================================================
RCS file: /cvsroot/aolserver/aolserver/ChangeLog,v
retrieving revision 1.409
retrieving revision 1.410
diff -C2 -d -r1.409 -r1.410
*** ChangeLog	17 Sep 2012 18:38:25 -0000	1.409
--- ChangeLog	17 Sep 2012 20:47:35 -0000	1.410
***************
*** 1,6 ****
  2012-09-17 Jeff Rogers <dv...@di...>
! 	* include/nsthread.h:
! 	* include/ns.h: update definition of NS_EXPORT to use modern GCC
  	visibility attributes
  
  2012-05-11 Jeff Rogers <dv...@di...>
--- 1,11 ----
  2012-09-17 Jeff Rogers <dv...@di...>
! 	* include/nsthread.h: update definition of NS_EXPORT to use modern GCC
  	visibility attributes
+ 	* include/ns.h: add an automatic export for ModInit proc to avoid 
+ 	forcing all modules to change for visibility.
+ 	* include/ns.mak.in: add NS_MODINIT define when compiling modules
+ 	to pull in automatic export
+ 	* nsd/init.tcl: make sure to fully qualify 'namespace'.  Omit 
+ 	'::oo' from namespace traversal until tcloo is better understood.
  
  2012-05-11 Jeff Rogers <dv...@di...>

[AOLSERVER-COMMITS] aolserver ChangeLog,1.408,1.409

[Jeff R. <dv...@us...>]

Update of /cvsroot/aolserver/aolserver
In directory vz-cvs-4.sog:/tmp/cvs-serv15977

Modified Files:
	ChangeLog 
Log Message:
Change NS_EXPORT to use gcc visibility attributes so that -fvisibility=hidden
doesn't hide all library symbols


Index: ChangeLog
===================================================================
RCS file: /cvsroot/aolserver/aolserver/ChangeLog,v
retrieving revision 1.408
retrieving revision 1.409
diff -C2 -d -r1.408 -r1.409
*** ChangeLog	11 May 2012 17:21:51 -0000	1.408
--- ChangeLog	17 Sep 2012 18:38:25 -0000	1.409
***************
*** 1,2 ****
--- 1,7 ----
+ 2012-09-17 Jeff Rogers <dv...@di...>
+ 	* include/nsthread.h:
+ 	* include/ns.h: update definition of NS_EXPORT to use modern GCC
+ 	visibility attributes
+ 
  2012-05-11 Jeff Rogers <dv...@di...>
  	* nsd/init.tcl: fix previous version that had renaming logic twice

[AOLSERVER-COMMITS] aolserver/nsd init.tcl,1.38,1.39

[Jeff R. <dv...@us...>]

Update of /cvsroot/aolserver/aolserver/nsd
In directory vz-cvs-4.sog:/tmp/cvs-serv7638/nsd

Modified Files:
	init.tcl 
Log Message:
merge patch



Index: init.tcl
===================================================================
RCS file: /cvsroot/aolserver/aolserver/nsd/init.tcl,v
retrieving revision 1.38
retrieving revision 1.39
diff -C2 -d -r1.38 -r1.39
*** init.tcl	13 Dec 2011 22:51:13 -0000	1.38
--- init.tcl	11 May 2012 17:22:04 -0000	1.39
***************
*** 590,597 ****
                      && $_orig != [::namespace which -command $_cmnd]} {
                  ::append _import [::list namespace import -force $_orig] \n
- 		# renamed after import
- 		::if {[::namespace tail $_orig] != [::namespace tail $_cmnd]} {
- 		    ::append _import [::list rename [::namespace current]::[::namespace tail $_orig] $_cmnd] \n
- 		}
              }
  	    ::append _import [_ns_getensemble $_cmnd]
--- 590,593 ----

[AOLSERVER-COMMITS] aolserver ChangeLog,1.407,1.408

[Jeff R. <dv...@us...>]

Update of /cvsroot/aolserver/aolserver
In directory vz-cvs-4.sog:/tmp/cvs-serv7609

Modified Files:
	ChangeLog 
Log Message:
merge patch


Index: ChangeLog
===================================================================
RCS file: /cvsroot/aolserver/aolserver/ChangeLog,v
retrieving revision 1.407
retrieving revision 1.408
diff -C2 -d -r1.407 -r1.408
*** ChangeLog	13 Dec 2011 22:51:04 -0000	1.407
--- ChangeLog	11 May 2012 17:21:51 -0000	1.408
***************
*** 1,2 ****
--- 1,5 ----
+ 2012-05-11 Jeff Rogers <dv...@di...>
+ 	* nsd/init.tcl: fix previous version that had renaming logic twice
+ 
  2011-12-13 Jeff Rogers <dv...@di...>
  	* nsd/init.tcl: add logic to handle commands imported from a namespace

[AOLSERVER-COMMITS] aolserver/nsd init.tcl,1.37.2.1,1.37.2.2

[Jeff R. <dv...@us...>]

Update of /cvsroot/aolserver/aolserver/nsd
In directory vz-cvs-4.sog:/tmp/cvs-serv5739/nsd

Modified Files:
      Tag: aolserver_v45_r2
	init.tcl 
Log Message:
Fix renaming logic in init.tcl



Index: init.tcl
===================================================================
RCS file: /cvsroot/aolserver/aolserver/nsd/init.tcl,v
retrieving revision 1.37.2.1
retrieving revision 1.37.2.2
diff -C2 -d -r1.37.2.1 -r1.37.2.2
*** init.tcl	13 Dec 2011 22:37:07 -0000	1.37.2.1
--- init.tcl	11 May 2012 17:13:37 -0000	1.37.2.2
***************
*** 590,597 ****
                      && $_orig != [::namespace which -command $_cmnd]} {
                  ::append _import [::list namespace import -force $_orig] \n
- 		# renamed after import
- 		::if {[::namespace tail $_orig] != [::namespace tail $_cmnd]} {
- 		    ::append _import [::list rename [::namespace current]::[::namespace tail $_orig] $_cmnd] \n
- 		}
              }
  	    ::append _import [_ns_getensemble $_cmnd]
--- 590,593 ----

[AOLSERVER-COMMITS] aolserver ChangeLog,1.406.2.1,1.406.2.2

[Jeff R. <dv...@us...>]

Update of /cvsroot/aolserver/aolserver
In directory vz-cvs-4.sog:/tmp/cvs-serv5679

Modified Files:
      Tag: aolserver_v45_r2
	ChangeLog 
Log Message:
Fix renaming logic in init.tcl


Index: ChangeLog
===================================================================
RCS file: /cvsroot/aolserver/aolserver/ChangeLog,v
retrieving revision 1.406.2.1
retrieving revision 1.406.2.2
diff -C2 -d -r1.406.2.1 -r1.406.2.2
*** ChangeLog	13 Dec 2011 22:36:52 -0000	1.406.2.1
--- ChangeLog	11 May 2012 17:13:21 -0000	1.406.2.2
***************
*** 1,2 ****
--- 1,5 ----
+ 2012-05-11 Jeff Rogers <dv...@di...>
+ 	* nsd/init.tcl: fix previous version that had renaming logic twice
+ 
  2011-12-13 Jeff Rogers <dv...@di...>
  	* nsd/init.tcl: add logic to handle commands imported from a namespace

[AOLSERVER-COMMITS] aolserver/nsd init.tcl,1.37,1.38

[Jeff R. <dv...@us...>]

Update of /cvsroot/aolserver/aolserver/nsd
In directory vz-cvs-4.sog:/tmp/cvs-serv16138/nsd

Modified Files:
	init.tcl 
Log Message:
merge changes from 4.5.2 branch

Index: init.tcl
===================================================================
RCS file: /cvsroot/aolserver/aolserver/nsd/init.tcl,v
retrieving revision 1.37
retrieving revision 1.38
diff -C2 -d -r1.37 -r1.38
*** init.tcl	28 May 2011 00:35:47 -0000	1.37
--- init.tcl	13 Dec 2011 22:51:13 -0000	1.38
***************
*** 574,577 ****
--- 574,581 ----
                  # procedure imported from other namespace
                  ::append _import [::list namespace import -force $_orig] \n
+ 		# renamed after import
+ 		::if {[::namespace tail $_orig] != $_proc} {
+ 		    ::append _import [::list rename [::namespace tail $_orig] $_proc] \n
+ 		}
              }
          }
***************
*** 586,589 ****
--- 590,597 ----
                      && $_orig != [::namespace which -command $_cmnd]} {
                  ::append _import [::list namespace import -force $_orig] \n
+ 		# renamed after import
+ 		::if {[::namespace tail $_orig] != [::namespace tail $_cmnd]} {
+ 		    ::append _import [::list rename [::namespace current]::[::namespace tail $_orig] $_cmnd] \n
+ 		}
              }
  	    ::append _import [_ns_getensemble $_cmnd]

[AOLSERVER-COMMITS] aolserver ChangeLog,1.406,1.407

[Jeff R. <dv...@us...>]

Update of /cvsroot/aolserver/aolserver
In directory vz-cvs-4.sog:/tmp/cvs-serv16122

Modified Files:
	ChangeLog 
Log Message:
merge changes from 4.5.2 branch

Index: ChangeLog
===================================================================
RCS file: /cvsroot/aolserver/aolserver/ChangeLog,v
retrieving revision 1.406
retrieving revision 1.407
diff -C2 -d -r1.406 -r1.407
*** ChangeLog	26 Oct 2011 06:23:52 -0000	1.406
--- ChangeLog	13 Dec 2011 22:51:04 -0000	1.407
***************
*** 1,2 ****
--- 1,6 ----
+ 2011-12-13 Jeff Rogers <dv...@di...>
+ 	* nsd/init.tcl: add logic to handle commands imported from a namespace
+ 	and then renamed (some tcllib packages do this)
+ 
  2011-10-25 tag aolserver_v45_r2
  

[AOLSERVER-COMMITS] aolserver/nsd init.tcl,1.37,1.37.2.1

[Jeff R. <dv...@us...>]

Update of /cvsroot/aolserver/aolserver/nsd
In directory vz-cvs-4.sog:/tmp/cvs-serv14103/nsd

Modified Files:
      Tag: aolserver_v45_r2
	init.tcl 
Log Message:
add logic to ini.tcl to handle imported/renamed commands



Index: init.tcl
===================================================================
RCS file: /cvsroot/aolserver/aolserver/nsd/init.tcl,v
retrieving revision 1.37
retrieving revision 1.37.2.1
diff -C2 -d -r1.37 -r1.37.2.1
*** init.tcl	28 May 2011 00:35:47 -0000	1.37
--- init.tcl	13 Dec 2011 22:37:07 -0000	1.37.2.1
***************
*** 574,577 ****
--- 574,581 ----
                  # procedure imported from other namespace
                  ::append _import [::list namespace import -force $_orig] \n
+ 		# renamed after import
+ 		::if {[::namespace tail $_orig] != $_proc} {
+ 		    ::append _import [::list rename [::namespace tail $_orig] $_proc] \n
+ 		}
              }
          }
***************
*** 586,589 ****
--- 590,597 ----
                      && $_orig != [::namespace which -command $_cmnd]} {
                  ::append _import [::list namespace import -force $_orig] \n
+ 		# renamed after import
+ 		::if {[::namespace tail $_orig] != [::namespace tail $_cmnd]} {
+ 		    ::append _import [::list rename [::namespace current]::[::namespace tail $_orig] $_cmnd] \n
+ 		}
              }
  	    ::append _import [_ns_getensemble $_cmnd]

[AOLSERVER-COMMITS] aolserver ChangeLog,1.406,1.406.2.1

[Jeff R. <dv...@us...>]

Update of /cvsroot/aolserver/aolserver
In directory vz-cvs-4.sog:/tmp/cvs-serv14059

Modified Files:
      Tag: aolserver_v45_r2
	ChangeLog 
Log Message:
add logic to ini.tcl to handle imported/renamed commands


Index: ChangeLog
===================================================================
RCS file: /cvsroot/aolserver/aolserver/ChangeLog,v
retrieving revision 1.406
retrieving revision 1.406.2.1
diff -C2 -d -r1.406 -r1.406.2.1
*** ChangeLog	26 Oct 2011 06:23:52 -0000	1.406
--- ChangeLog	13 Dec 2011 22:36:52 -0000	1.406.2.1
***************
*** 1,2 ****
--- 1,6 ----
+ 2011-12-13 Jeff Rogers <dv...@di...>
+ 	* nsd/init.tcl: add logic to handle commands imported from a namespace
+ 	and then renamed (some tcllib packages do this)
+ 
  2011-10-25 tag aolserver_v45_r2
  

[AOLSERVER-COMMITS] aolserver ChangeLog,1.405,1.406

[Jeff R. <dv...@us...>]

Update of /cvsroot/aolserver/aolserver
In directory vz-cvs-4.sog:/tmp/cvs-serv32103

Modified Files:
	ChangeLog 
Log Message:
poke changelog

Index: ChangeLog
===================================================================
RCS file: /cvsroot/aolserver/aolserver/ChangeLog,v
retrieving revision 1.405
retrieving revision 1.406
diff -C2 -d -r1.405 -r1.406
*** ChangeLog	26 Oct 2011 06:20:15 -0000	1.405
--- ChangeLog	26 Oct 2011 06:23:52 -0000	1.406
***************
*** 1,2 ****
--- 1,4 ----
+ 2011-10-25 tag aolserver_v45_r2
+ 
  2011-10-25 Jeff Rogers <dv...@di...>
  	* nsd/nsd.h: set patchlevel to 4.5.2

[AOLSERVER-COMMITS] aolserver/include ns.h,1.93,1.94

[Jeff R. <dv...@us...>]

Update of /cvsroot/aolserver/aolserver/include
In directory vz-cvs-4.sog:/tmp/cvs-serv30693/include

Modified Files:
	ns.h 
Log Message:
set patchlevel to 4.5.2


Index: ns.h
===================================================================
RCS file: /cvsroot/aolserver/aolserver/include/ns.h,v
retrieving revision 1.93
retrieving revision 1.94
diff -C2 -d -r1.93 -r1.94
*** ns.h	11 Oct 2011 08:03:09 -0000	1.93
--- ns.h	26 Oct 2011 06:20:15 -0000	1.94
***************
*** 42,51 ****
  #define NS_MAJOR_VERSION	4
  #define NS_MINOR_VERSION	5
! #define NS_RELEASE_SERIAL	1
  #define NS_VERSION_NUM          (NS_MAJOR_VERSION * 10000 \
                                  + NS_MINOR_VERSION * 100 \
                                  + NS_RELEASE_SERIAL)
  #define NS_VERSION		"4.5"
! #define NS_PATCH_LEVEL		"4.5.1"
  
  #define NS_ALPHA_RELEASE	0
--- 42,51 ----
  #define NS_MAJOR_VERSION	4
  #define NS_MINOR_VERSION	5
! #define NS_RELEASE_SERIAL	2
  #define NS_VERSION_NUM          (NS_MAJOR_VERSION * 10000 \
                                  + NS_MINOR_VERSION * 100 \
                                  + NS_RELEASE_SERIAL)
  #define NS_VERSION		"4.5"
! #define NS_PATCH_LEVEL		"4.5.2"
  
  #define NS_ALPHA_RELEASE	0

[AOLSERVER-COMMITS] aolserver/nsd driver.c, 1.63, 1.64 nsd.h, 1.125, 1.126

[Jeff R. <dv...@us...>]

Update of /cvsroot/aolserver/aolserver/nsd
In directory vz-cvs-4.sog:/tmp/cvs-serv17891/nsd

Modified Files:
	driver.c nsd.h 
Log Message:
add tuning tweak and config variable to let 
driver accept more than one connection per spin.  
SF RFE #1014273




Index: driver.c
===================================================================
RCS file: /cvsroot/aolserver/aolserver/nsd/driver.c,v
retrieving revision 1.63
retrieving revision 1.64
diff -C2 -d -r1.63 -r1.64
*** driver.c	11 Oct 2011 08:03:27 -0000	1.63
--- driver.c	13 Oct 2011 23:42:24 -0000	1.64
***************
*** 410,413 ****
--- 410,417 ----
      }
      drvPtr->keepwait = _MAX(n, 0); /* NB: 0 for no keepalive. */
+     if (!Ns_ConfigGetInt(path, "maxaccept", &n)) {
+         n = 10;         /* accept up to 10 connections per driver spin */
+     }
+     drvPtr->maxaccept = _MAX(n, 0); /* NB: 0 for no max. */
      if (!Ns_ConfigGetInt(path, "maxreaders", &n) || n < 1) {
          n = 10;         /* Max of 10 threads for non-event driven I/O. */
***************
*** 1335,1344 ****
  	 */
  
!   	if (!stop && lidx >= 0 && PollIn(&pdata, lidx)
!                 && ((sockPtr = SockAccept(lsock, drvPtr)) != NULL)) {
!     	    sockPtr->acceptTime = now;
! 	    sockPtr->connPtr = AllocConn(drvPtr, &now, sockPtr);
! 	    SockWait(sockPtr, &now, drvPtr->recvwait, &waitPtr);
! 	    ++drvPtr->stats.accepts;
  	}
  
--- 1339,1352 ----
  	 */
  
!   	if (!stop && lidx >= 0 && PollIn(&pdata, lidx)) {
! 	    int naccept = 0;
! 	    while (drvPtr->freeSockPtr != NULL &&
! 	           (drvPtr->maxaccept == 0 || naccept++ < drvPtr->maxaccept) &&
! 		   (sockPtr = SockAccept(lsock, drvPtr)) != NULL) {
! 		sockPtr->acceptTime = now;
! 		sockPtr->connPtr = AllocConn(drvPtr, &now, sockPtr);
! 		SockWait(sockPtr, &now, drvPtr->recvwait, &waitPtr);
! 		++drvPtr->stats.accepts;
! 	    }
  	}
  

Index: nsd.h
===================================================================
RCS file: /cvsroot/aolserver/aolserver/nsd/nsd.h,v
retrieving revision 1.125
retrieving revision 1.126
diff -C2 -d -r1.125 -r1.126
*** nsd.h	11 Oct 2011 08:03:27 -0000	1.125
--- nsd.h	13 Oct 2011 23:42:24 -0000	1.126
***************
*** 322,325 ****
--- 322,326 ----
      int          port;		    /* Port in location. */
      int		 backlog;	    /* listen() backlog. */
+     int		 maxaccept;	    /* connections to accept per spin. */
      
      int          maxline;           /* Maximum request line length to read. */