- 12 Dec, 2022 1 commit
-
-
Yossi Gottlieb authored
Use SSL_shutdown(), in a best-effort manner, when closing a TLS connection. This change better supports OpenSSL 3.x clients that will not silently ignore the socket-level EOF. (cherry picked from commit 45ae6053)
-
- 27 Apr, 2022 1 commit
-
-
Yossi Gottlieb authored
* Drop obsolete initialization calls. * Use decoder API for DH parameters. * Enable auto DH parameters if not explicitly used, which should be the preferred configuration going forward. (cherry picked from commit 3881f785)
-
- 04 Oct, 2021 1 commit
-
-
David CARLIER authored
(cherry picked from commit 418c2e79)
-
- 21 Jul, 2021 1 commit
-
-
Yossi Gottlieb authored
(cherry picked from commit 277e4dc2)
-
- 22 Mar, 2021 1 commit
-
-
Yossi Gottlieb authored
-
- 03 Mar, 2021 1 commit
-
-
Yossi Gottlieb authored
This solves the problem of /dev/random and /dev/urandom open file descriptors leaking to childs with some versions of OpenSSL.
-
- 08 Feb, 2021 1 commit
-
-
Huang Zw authored
Fix typo and some out of date comments
-
- 13 Dec, 2020 1 commit
-
-
Madelyn Olson authored
-
- 11 Dec, 2020 1 commit
-
-
Yossi Gottlieb authored
This adds a new `tls-client-cert-file` and `tls-client-key-file` configuration directives which make it possible to use different certificates for the TLS-server and TLS-client functions of Redis. This is an optional directive. If it is not specified the `tls-cert-file` and `tls-key-file` directives are used for TLS client functions as well. Also, `utils/gen-test-certs.sh` now creates additional server-only and client-only certs and will skip intensive operations if target files already exist.
-
- 07 Dec, 2020 1 commit
-
-
filipe oliveira authored
-
- 11 Oct, 2020 1 commit
-
-
Yossi Gottlieb authored
This API function makes it possible to retrieve the X.509 certificate used by clients to authenticate TLS connections.
-
- 29 Sep, 2020 1 commit
-
-
Yossi Gottlieb authored
The tls-ca-cert or tls-ca-cert-dir configuration parameters are only used when Redis needs to authenticate peer certificates, in one of these scenarios: 1. Incoming clients or replicas, with `tls-auth-clients` enabled. 2. A replica authenticating the master's peer certificate. 3. Cluster nodes authenticating other nodes when establishing the bus protocol connection.
-
- 23 Sep, 2020 1 commit
-
-
Oran Agra authored
-
- 22 Sep, 2020 1 commit
-
-
yixiang authored
-
- 17 Aug, 2020 1 commit
-
-
Yossi Gottlieb authored
The `REDISMODULE_CLIENTINFO_FLAG_SSL` flag was already a part of the `RedisModuleClientInfo` structure but was not implemented.
-
- 28 Jul, 2020 2 commits
-
-
Yossi Gottlieb authored
The connection API may create an accepted connection object in an error state, and callers are expected to check it before attempting to use it. Co-authored-by:
mrpre <mrpre@163.com>
-
Jiayuan Chen authored
Adds an `optional` value to the previously boolean `tls-auth-clients` configuration keyword. Co-authored-by:
Yossi Gottlieb <yossigo@gmail.com>
-
- 10 Jul, 2020 2 commits
-
-
Yossi Gottlieb authored
* TLS: Session caching configuration support. * TLS: Remove redundant config initialization.
-
Yossi Gottlieb authored
-
- 27 May, 2020 1 commit
-
-
Kevin Fwu authored
This impacts client verification for chained certificates (such as Lets Encrypt certificates). Client Verify requires the full chain in order to properly verify the certificate.
-
- 14 May, 2020 1 commit
-
-
antirez authored
Related to #7234.
-
- 10 May, 2020 1 commit
-
-
Yossi Gottlieb authored
This is really required only for older OpenSSL versions. Also, at the moment Redis does not use OpenSSL from multiple threads so this will only be useful if modules end up doing that.
-
- 22 Apr, 2020 1 commit
-
-
Theo Buehler authored
There is no ssl in this scope, so the build breaks. All the other options are set directly on the ctx.
-
- 20 Apr, 2020 1 commit
-
-
Yossi Gottlieb authored
-
- 08 Oct, 2019 1 commit
-
-
Yossi Gottlieb authored
This adds support for explicit configuration of a CA certs directory (in addition to the previously supported bundle file). For redis-cli, if no explicit CA configuration is supplied the system-wide default configuration will be adopted.
-
- 07 Oct, 2019 4 commits
-
-
Yossi Gottlieb authored
Add configuration options for TLS protocol versions, ciphers/cipher suites selection, etc.
-
Oran Agra authored
-
Oran Agra authored
misc: - handle SSL_has_pending by iterating though these in beforeSleep, and setting timeout of 0 to aeProcessEvents - fix issue with epoll signaling EPOLLHUP and EPOLLERR only to the write handlers. (needed to detect the rdb pipe was closed) - add key-load-delay config for testing - trim connShutdown which is no longer needed - rioFdsetWrite -> rioFdWrite - simplified since there's no longer need to write to multiple FDs - don't detect rdb child exited (don't call wait3) until we detect the pipe is closed - Cleanup bad optimization from rio.c, add another one
-
Yossi Gottlieb authored
* Introduce a connection abstraction layer for all socket operations and integrate it across the code base. * Provide an optional TLS connections implementation based on OpenSSL. * Pull a newer version of hiredis with TLS support. * Tests, redis-cli updates for TLS support.
-