Re: [PATCH] SSL: respect session timeout in configs without session cache.

2013-10-10 Thread Maxim Dounin
Hello! On Wed, Oct 09, 2013 at 02:21:08PM -0700, Piotr Sikora wrote: > # HG changeset patch > # User Piotr Sikora > # Date 1381353349 25200 > # Wed Oct 09 14:15:49 2013 -0700 > # Node ID 6d1d1c6d346839d3ccdca92cee32bc9887c19841 > # Parent 5483d9e77b3287b00b1104a07688bda37bc7351e > SSL: res

Disallowing multiple http {} blocks in nginx.conf?

2013-10-10 Thread Yichun Zhang (agentzh)
Hello guys! Some Nginx users use multiple http {} blocks in their nginx.conf, which causing issues because following http {} blocks override previous http modules' main_conf leading inconsistencies in calls like ngx_http_conf_get_module_main_conf and ngx_http_cycle_get_module_main_conf in global h

Re: [PATCH] SSL: respect session timeout in configs without session cache.

2013-10-10 Thread Piotr Sikora
Hey Maxim, > I don't see a real reason for the API change, and direct use of > SSL_CTX_set_timeout() in http/mail ssl modules. What about this > instead: While your patch fixes the issue, I personally don't like the fact that session timeout is being set within code block responsible for session

Re: Disallowing multiple http {} blocks in nginx.conf?

2013-10-10 Thread Maxim Dounin
Hello! On Thu, Oct 10, 2013 at 12:46:03PM -0700, Yichun Zhang (agentzh) wrote: > Hello guys! > > Some Nginx users use multiple http {} blocks in their nginx.conf, which > causing issues because following http {} blocks override previous http > modules' main_conf leading inconsistencies in calls

Re: Disallowing multiple http {} blocks in nginx.conf?

2013-10-10 Thread Yichun Zhang (agentzh)
Hello! On Thu, Oct 10, 2013 at 1:21 PM, Maxim Dounin wrote: > > I don't thinks that it's a good idea to disallow configurations > with multiple http{} blocks. While this wasn't claimed to be > supported, it allows fun things like running multiple > configuration isolated, and e.g. makes merging c

Re: Disallowing multiple http {} blocks in nginx.conf?

2013-10-10 Thread Maxim Dounin
Hello! On Thu, Oct 10, 2013 at 02:39:45PM -0700, Yichun Zhang (agentzh) wrote: > Hello! > > On Thu, Oct 10, 2013 at 1:21 PM, Maxim Dounin wrote: > > > > I don't thinks that it's a good idea to disallow configurations > > with multiple http{} blocks. While this wasn't claimed to be > > supported

Re: [PATCH] SSL: respect session timeout in configs without session cache.

2013-10-10 Thread Maxim Dounin
Hello! On Thu, Oct 10, 2013 at 01:17:14PM -0700, Piotr Sikora wrote: > Hey Maxim, > > > I don't see a real reason for the API change, and direct use of > > SSL_CTX_set_timeout() in http/mail ssl modules. What about this > > instead: > > While your patch fixes the issue, I personally don't like

Re: [PATCH] SSL: added support for TLS Session Tickets (RFC5077).

2013-10-10 Thread Piotr Sikora
# HG changeset patch # User Piotr Sikora # Date 1381446441 25200 # Thu Oct 10 16:07:21 2013 -0700 # Node ID 7132c555e445419008520563da63d3b122772b97 # Parent 5483d9e77b3287b00b1104a07688bda37bc7351e SSL: added ability to set keys used for Session Tickets (RFC5077). In order to support key r

Re: [PATCH] SSL: added support for TLS Session Tickets (RFC5077).

2013-10-10 Thread Piotr Sikora
Oops, one line was 81 chars long... Fixed patch below. # HG changeset patch # User Piotr Sikora # Date 1381447913 25200 # Thu Oct 10 16:31:53 2013 -0700 # Node ID 4617733b2d7130313241253ef22958790d6fc902 # Parent 5483d9e77b3287b00b1104a07688bda37bc7351e SSL: added ability to set keys used f

Re: [PATCH] SSL: respect session timeout in configs without session cache.

2013-10-10 Thread Piotr Sikora
Hey Maxim, > Huh? > > The SSL_CTX_set_timeout is a function which is documented to > "manipulate timeout values for session caching" [1], and it looks > quite reasonable for me to be set in a block responsible for > session cache logic. > > I would rather think about TLS Session Tickets as a speci

Re: [PATCH] Proxy remote server SSL certificate verification

2013-10-10 Thread Maxim Dounin
Hello! On Wed, Oct 09, 2013 at 07:32:52PM +0300, Aviram Cohen wrote: > Hello!, > > I've made the necessary fixes. A few comments about those: > - Name validation > - Unlike Apache, in this patch, the configuration must contain the name > to verify. In most cases, this should be se