Codebase list kopanocore / 8830122
Committing svn revision 39666: Merged [39537] [39539] [39631] : Fixes ZCP-11212 john 11 years ago
15 changed file(s) with 99 addition(s) and 19 deletion(s). Raw diff Collapse all Expand all
+1
-0
caldav/CalDAV.cpp less more
219219 { "log_timestamp", "1" },
220220 { "ssl_private_key_file", "/etc/zarafa/ical/privkey.pem" },
221221 { "ssl_certificate_file", "/etc/zarafa/ical/cert.pem" },
222 { "ssl_enable_v2", "no" },
222223 { "ssl_verify_client", "no" },
223224 { "ssl_verify_file", "" },
224225 { "ssl_verify_path", "" },
+5
-1
common/ECChannel.cpp less more
4949 #include "platform.h"
5050
5151 #include "ECChannel.h"
52 #include "stringutil.h"
5253 #include <sys/types.h>
5354 #include <sys/select.h>
5455 #include <sys/socket.h>
103104
104105 SSL_library_init();
105106 SSL_load_error_strings();
106 lpCTX = SSL_CTX_new(SSLv23_server_method());
107 if (parseBool(lpConfig->GetSetting("ssl_enable_v2", "", "no")))
108 lpCTX = SSL_CTX_new(SSLv23_server_method());
109 else
110 lpCTX = SSL_CTX_new(SSLv3_server_method());
107111 SSL_CTX_set_options(lpCTX, SSL_OP_ALL);
108112 SSL_CTX_set_default_verify_paths(lpCTX);
109113
+5
-1
common/SSLUtil.cpp less more
7979 void ssl_threading_setup() {
8080 if (ssl_locks)
8181 return;
82 pthread_mutexattr_t mattr;
83 // make recursive, because of openssl bug http://rt.openssl.org/Ticket/Display.html?id=2813&user=guest&pass=guest
84 pthread_mutexattr_init(&mattr);
85 pthread_mutexattr_settype(&mattr, PTHREAD_MUTEX_RECURSIVE);
8286 ssl_locks = new pthread_mutex_t[CRYPTO_num_locks()];
8387 for (int i=0; i < CRYPTO_num_locks(); i++)
84 pthread_mutex_init(&ssl_locks[i], NULL);
88 pthread_mutex_init(&ssl_locks[i], &mattr);
8589 CRYPTO_set_locking_callback(ssl_lock);
8690 // no need to set on win32 (or maybe use GetCurrentThreadId)
8791 CRYPTO_set_id_callback(ssl_id_function);
+17
-17
common/ecversion.h less more
4646 *
4747 */
4848
49 #define PROJECT_VERSION_SERVER 7,1,3,39277
50 #define PROJECT_VERSION_SERVER_STR "7,1,3,39277"
51 #define PROJECT_VERSION_CLIENT 7,1,3,39277
52 #define PROJECT_VERSION_CLIENT_STR "7,1,3,39277"
53 #define PROJECT_VERSION_EXT_STR "7,1,3,39277"
54 #define PROJECT_VERSION_SPOOLER_STR "7,1,3,39277"
55 #define PROJECT_VERSION_GATEWAY_STR "7,1,3,39277"
56 #define PROJECT_VERSION_CALDAV_STR "7,1,3,39277"
57 #define PROJECT_VERSION_DAGENT_STR "7,1,3,39277"
58 #define PROJECT_VERSION_PROFADMIN_STR "7,1,3,39277"
59 #define PROJECT_VERSION_MONITOR_STR "7,1,3,39277"
60 #define PROJECT_VERSION_PASSWD_STR "7,1,3,39277"
61 #define PROJECT_VERSION_FBSYNCER_STR "7,1,3,39277"
62 #define PROJECT_VERSION_SEARCH_STR "7,1,3,39277"
63 #define PROJECT_VERSION_ARCHIVER_STR "7,1,3,39277"
49 #define PROJECT_VERSION_SERVER 7,1,3,39666
50 #define PROJECT_VERSION_SERVER_STR "7,1,3,39666"
51 #define PROJECT_VERSION_CLIENT 7,1,3,39666
52 #define PROJECT_VERSION_CLIENT_STR "7,1,3,39666"
53 #define PROJECT_VERSION_EXT_STR "7,1,3,39666"
54 #define PROJECT_VERSION_SPOOLER_STR "7,1,3,39666"
55 #define PROJECT_VERSION_GATEWAY_STR "7,1,3,39666"
56 #define PROJECT_VERSION_CALDAV_STR "7,1,3,39666"
57 #define PROJECT_VERSION_DAGENT_STR "7,1,3,39666"
58 #define PROJECT_VERSION_PROFADMIN_STR "7,1,3,39666"
59 #define PROJECT_VERSION_MONITOR_STR "7,1,3,39666"
60 #define PROJECT_VERSION_PASSWD_STR "7,1,3,39666"
61 #define PROJECT_VERSION_FBSYNCER_STR "7,1,3,39666"
62 #define PROJECT_VERSION_SEARCH_STR "7,1,3,39666"
63 #define PROJECT_VERSION_ARCHIVER_STR "7,1,3,39666"
6464 #define PROJECT_VERSION_DOT_STR "7.1.3"
6565 #define PROJECT_SPECIALBUILD "beta"
66 #define PROJECT_SVN_REV_STR "39277"
66 #define PROJECT_SVN_REV_STR "39666"
6767 #define PROJECT_VERSION_MAJOR 7
6868 #define PROJECT_VERSION_MINOR 1
69 #define PROJECT_VERSION_REVISION 39277
69 #define PROJECT_VERSION_REVISION 39666
+29
-0
doc/manual.xml less more
41224122 </listitem>
41234123 </varlistentry>
41244124
4125 <varlistentry>
4126 <term><option>server_ssl_enable_v2</option></term>
4127 <listitem>
4128 <para>Incoming SSL connections normally are v3.</para>
4129 <para>Default: <replaceable>no</replaceable>
4130 </para>
4131 </listitem>
4132 </varlistentry>
4133
41254134 </variablelist>
41264135 </refsection>
41274136
79397948 <para>The path with the files to verify the clients
79407949 certificates with.</para>
79417950 <para>Default: value not set.</para>
7951 </listitem>
7952 </varlistentry>
7953
7954 <varlistentry>
7955 <term><option>ssl_enable_v2</option></term>
7956 <listitem>
7957 <para>Accept SSLv2 only connections. SSLv2 is considered
7958 unsafe, and these connections should not be
7959 accepted.</para>
7960 <para>Default: <replaceable>no</replaceable></para>
79427961 </listitem>
79437962 </varlistentry>
79447963
99389957 </varlistentry>
99399958
99409959 <varlistentry>
9960 <term><option>ssl_enable_v2</option></term>
9961 <listitem>
9962 <para>Accept SSLv2 only connections. SSLv2 is considered
9963 unsafe, and these connections should not be
9964 accepted.</para>
9965 <para>Default: <replaceable>no</replaceable></para>
9966 </listitem>
9967 </varlistentry>
9968
9969 <varlistentry>
99419970 <term><option>log_method</option></term>
99429971 <listitem>
99439972 <para>The method which should be used for logging. Valid
+8
-0
doc/zarafa-gateway.cfg.5 less more
303303 Default: value not set\&.
304304 .RE
305305 .PP
306 \fBssl_enable_v2\fR
307 .RS 4
308 Accept SSLv2 only connections\&. SSLv2 is considered unsafe, and these connections should not be accepted\&.
309 .sp
310 Default:
311 \fIno\fR
312 .RE
313 .PP
306314 \fBlog_method\fR
307315 .RS 4
308316 The method which should be used for logging\&. Valid values are:
+8
-0
doc/zarafa-ical.cfg.5 less more
198198 Default: value not set\&.
199199 .RE
200200 .PP
201 \fBssl_enable_v2\fR
202 .RS 4
203 Accept SSLv2 only connections\&. SSLv2 is considered unsafe, and these connections should not be accepted\&.
204 .sp
205 Default:
206 \fIno\fR
207 .RE
208 .PP
201209 \fBlog_method\fR
202210 .RS 4
203211 The method which should be used for logging\&. Valid values are:
+8
-0
doc/zarafa-server.cfg.5 less more
545545 Default:
546546 \fI/etc/zarafa/sslkeys\fR
547547 .RE
548 .PP
549 \fBserver_ssl_enable_v2\fR
550 .RS 4
551 Incoming SSL connections normally are v3\&.
552 .sp
553 Default:
554 \fIno\fR
555 .RE
548556 .SH "EXPLANATION OF THE THREADING PARAMETERS"
549557 .PP
550558 \fBthreads\fR
+1
-0
gateway/Gateway.cpp less more
361361 { "ssl_verify_client", "no" },
362362 { "ssl_verify_file", "" },
363363 { "ssl_verify_path", "" },
364 { "ssl_enable_v2", "no" },
364365 { "log_method", "file" },
365366 { "log_file", "-" },
366367 { "log_level", "2", CONFIGSETTING_RELOADABLE },
+3
-0
installer/linux/gateway.cfg less more
7474 ssl_verify_file =
7575 ssl_verify_path =
7676
77 # Accept SSLv2 only incoming connections
78 ssl_enable_v2 = no
79
7780 # Process model, using pthreads (thread) or processes (fork)
7881 process_model = fork
7982
+3
-0
installer/linux/ical.cfg less more
6565 ssl_verify_file =
6666 ssl_verify_path =
6767
68 # Accept SSLv2 only incoming connections
69 ssl_enable_v2 = no
70
6871 ##############################################################
6972 # OTHER ICAL SETTINGS
7073
+3
-0
installer/linux/server.cfg less more
152152
153153 # Path with CA certificates, e.g. /etc/ssl/certs
154154 server_ssl_ca_path =
155
156 # Accept SSLv2 only connections. Normally v3 connections are used.
157 server_ssl_enable_v2 = no
155158
156159 # Path of SSL Public keys of clients
157160 sslkeys_path = /etc/zarafa/sslkeys
+3
-0
provider/common/SOAPSock.cpp less more
133133 soap_set_omode(lpCmd->soap, iSoapoMode);
134134
135135 lpCmd->endpoint = strdup(strServerPath.c_str());
136
137 // override the gsoap default v23 method to the force safer v3 only method.
138 lpCmd->soap->ctx = SSL_CTX_new(SSLv3_method());
136139
137140 #ifdef WITH_OPENSSL
138141 if (strncmp("https:", lpCmd->endpoint, 6) == 0) {
+1
-0
provider/server/ECServer.cpp less more
887887 { "server_ssl_key_pass", "server", CONFIGSETTING_EXACT },
888888 { "server_ssl_ca_file", "/etc/zarafa/ssl/cacert.pem" },
889889 { "server_ssl_ca_path", "" },
890 { "server_ssl_enable_v2", "no" },
890891 { "sslkeys_path", "/etc/zarafa/sslkeys" }, // login keys
891892 // Database options
892893 { "database_engine", "mysql" },
+4
-0
provider/server/ECSoapServerConnection.cpp less more
268268 er = ZARAFA_E_CALL_FAILED;
269269 goto exit;
270270 }
271
272 // disable SSLv2 support
273 if (!parseBool(m_lpConfig->GetSetting("server_ssl_enable_v2", "", "no")))
274 SSL_CTX_set_options(lpsSoap->ctx, SSL_OP_NO_SSLv2);
271275
272276 // request certificate from client, is OK if not present.
273277 SSL_CTX_set_verify(lpsSoap->ctx, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, NULL);