449 Commits (3b24b1d082da28da15dc5e3aeaa0ebebe7758f2f)

Author	SHA1	Message	Date
Lee Clagett	3b24b1d082	Added support for "noise" over I1P/Tor to mask Tx transmission.	5 years ago
Lee Clagett	bdfc63ae4d	Add ref-counted buffer byte_slice. Currently used for sending TCP data.	5 years ago
Jethro Grassie	30779de39d	fix feature not introduced until boost 1.66	5 years ago
moneromooo-monero	eeca5ca0c8	epee: support unicode in parsed strings	5 years ago
luigi1111	8a0711f2f2	Merge pull request #5674 ... fcbf7b3 p2p: propagate out peers limit to payload handler (moneromooo-monero) 098aadf p2p: close the right number of connections on setting max in/out peers (moneromooo-monero)	5 years ago
luigi1111	df064eaa36	Merge pull request #5649 ... a182df2 Bans for RPC connections (hyc)	5 years ago
Thomas Winget	155475d971	Add IPv6 support ... new cli options (RPC ones also apply to wallet): --p2p-bind-ipv6-address (default = "::") --p2p-bind-port-ipv6 (default same as ipv4 port for given nettype) --rpc-bind-ipv6-address (default = "::1") --p2p-use-ipv6 (default false) --rpc-use-ipv6 (default false) --p2p-require-ipv4 (default true, if ipv4 bind fails and this is true, will not continue even if ipv6 bind successful) --rpc-require-ipv4 (default true, description as above) ipv6 addresses are to be specified as "[xx:xx:xx::xx:xx]:port" except in the cases of the cli args for bind address. For those the square braces can be omitted.	5 years ago
luigi1111	38e0e58a95	Merge pull request #5531 ... 9a6006b abstract_tcp_server2: move some things out of a lock (moneromooo-monero)	5 years ago
luigi1111	e579fe4ae0	Merge pull request #5530 ... 6abaaaa remove obsolete save_graph skeleton code (moneromooo-monero)	5 years ago
luigi1111	8774384ace	Merge pull request #5528 ... f61a315 net_utils: fix m_ssl type from time_t to bool (moneromooo-monero)	5 years ago
moneromooo-monero	65c4004963	allow blocking whole subnets	5 years ago
moneromooo-monero	098aadf084	p2p: close the right number of connections on setting max in/out peers	5 years ago
Howard Chu	a182df21d0	Bans for RPC connections ... Make bans control RPC sessions too. And auto-ban some bad requests. Drops HTTP connections whenever response code is 500.	5 years ago
moneromooo-monero	bc09766bf9	abstract_tcp_server2: improve DoS resistance	5 years ago
moneromooo-monero	39169ace09	epee: basic sanity check on allocation size from untrusted source ... Reported by guidov	5 years ago
luigi1111	9c0e9c40ec	Merge pull request #5618 ... b0a04f7 epee: fix SSL autodetect on reconnection (xiphon)	5 years ago
xiphon	b0a04f7d45	epee: fix SSL autodetect on reconnection	5 years ago
moneromooo-monero	35c20c4332	Fix GCC 9.1 build warnings ... GCC wants operator= aand copy ctor to be both defined, or neither	5 years ago
Lee Clagett	3544596f9f	Add ssl_options support to monerod's rpc mode.	5 years ago
moneromooo-monero	9a6006bad8	abstract_tcp_server2: move some things out of a lock ... The lock is meant for the network throttle object only, and this should help coverity get unconfused	5 years ago
moneromooo-monero	6abaaaa994	remove obsolete save_graph skeleton code	5 years ago
moneromooo-monero	f61a315e8b	net_utils: fix m_ssl type from time_t to bool	5 years ago
Riccardo Spagni	c0bc6d96cd	Merge pull request #5509 ... a62e0725 net_ssl: SSL config tweaks for compatibility and security (moneromooo-monero)	5 years ago
Riccardo Spagni	2d04b0e500	Merge pull request #5499 ... a4c4a2d8 blockchain: keep a rolling long term block weight median (moneromooo-monero)	5 years ago
moneromooo-monero	a62e072571	net_ssl: SSL config tweaks for compatibility and security ... add two RSA based ciphers for Windows/depends compatibility also enforce server cipher ordering also set ECDH to auto because vtnerd says it is good :) When built with the depends system, openssl does not include any cipher on the current whitelist, so add this one, which fixes the problem, and does seem sensible.	5 years ago
moneromooo-monero	a4c4a2d8aa	blockchain: keep a rolling long term block weight median	5 years ago
moneromooo-monero	5e0da6fb68	change SSL certificate fingerprint whitelisting from SHA1 to SHA-256 ... SHA1 is too close to bruteforceable	5 years ago
Riccardo Spagni	5d09e39174	Merge pull request #5482 ... 9956500d net_helper: clear recv buffer on eof (moneromooo-monero)	5 years ago
Riccardo Spagni	d86dd5fa7c	Merge pull request #5479 ... edbae2d0 levin_protocol_handler_async: tune down preallocation a fair bit (moneromooo-monero)	5 years ago
moneromooo-monero	9956500d14	net_helper: clear recv buffer on eof	5 years ago
moneromooo-monero	edbae2d05b	levin_protocol_handler_async: tune down preallocation a fair bit ... It can allocate a lot when getting a lot of connections (in particular, the stress test on windows apparently pushes that memory to actual use, rather than just allocated)	5 years ago
moneromooo-monero	7a9316ebef	serialization: set default log category	5 years ago
moneromooo-monero	b672d4d6e5	epee: use boost/timer/timer.hpp, boost/timer.hpp is deprecated	5 years ago
Riccardo Spagni	c8ce4217cf	Merge pull request #5445 ... b18f0b10 wallet: new --offline option (moneromooo-monero)	5 years ago
Riccardo Spagni	e9527f5eed	Merge pull request #5436 ... 61d63900 net_helper: avoid unnecessary memcpy (moneromooo-monero)	5 years ago
moneromooo-monero	b18f0b1051	wallet: new --offline option ... It will avoid connecting to a daemon (so useful for cold signing using a RPC wallet), and not perform DNS queries.	5 years ago
moneromooo-monero	61d63900b9	net_helper: avoid unnecessary memcpy	5 years ago
moneromooo-monero	c3cf930f75	abstract_tcp_server2: fix timeout on exit ... When closing connections due to exiting, the IO service is already gone, so the data exchange needed for a gracious SSL shutdown cannot happen. We just close the socket in that case.	5 years ago
moneromooo-monero	4b3bb829c2	epee: init a new ssl related variable in ctor	5 years ago
moneromooo-monero	9f8dc4ce51	simplewallet: new net_stats command ... displays total sent and received bytes	5 years ago
Lee Clagett	2e578b8214	Enabling daemon-rpc SSL now requires non-system CA verification ... If `--daemon-ssl enabled` is set in the wallet, then a user certificate, fingerprint, or onion/i2p address must be provided.	5 years ago
Lee Clagett	d58f368289	Require manual override for user chain certificates. ... An override for the wallet to daemon connection is provided, but not for other SSL contexts. The intent is to prevent users from supplying a system CA as the "user" whitelisted certificate, which is less secure since the key is controlled by a third party.	5 years ago
Lee Clagett	eca0fea45a	Perform RFC 2818 hostname verification in client SSL handshakes ... If the verification mode is `system_ca`, clients will now do hostname verification. Thus, only certificates from expected hostnames are allowed when SSL is enabled. This can be overridden by forcible setting the SSL mode to autodetect. Clients will also send the hostname even when `system_ca` is not being performed. This leaks possible metadata, but allows servers providing multiple hostnames to respond with the correct certificate. One example is cloudflare, which getmonero.org is currently using.	5 years ago
Lee Clagett	0416764cae	Require server verification when SSL is enabled. ... If SSL is "enabled" via command line without specifying a fingerprint or certificate, the system CA list is checked for server verification and _now_ fails the handshake if that check fails. This change was made to remain consistent with standard SSL/TLS client behavior. This can still be overridden by using the allow any certificate flag. If the SSL behavior is autodetect, the system CA list is still checked but a warning is logged if this fails. The stream is not rejected because a re-connect will be attempted - its better to have an unverified encrypted stream than an unverified + unencrypted stream.	5 years ago
Lee Clagett	21eb1b0725	Pass SSL arguments via one class and use shared_ptr instead of reference	5 years ago
Lee Clagett	a3b0284837	Change SSL certificate file list to OpenSSL builtin load_verify_location ... Specifying SSL certificates for peer verification does an exact match, making it a not-so-obvious alias for the fingerprints option. This changes the checks to OpenSSL which loads concatenated certificate(s) from a single file and does a certificate-authority (chain of trust) check instead. There is no drop in security - a compromised exact match fingerprint has the same worse case failure. There is increased security in allowing separate long-term CA key and short-term SSL server keys. This also removes loading of the system-default CA files if a custom CA file or certificate fingerprint is specified.	5 years ago
Riccardo Spagni	0baf26c8d6	Merge pull request #5375 ... 1569776a Add missing include (Leon Klingele)	5 years ago
Riccardo Spagni	38317f384c	Merge pull request #5348 ... 59776a64 epee: some more minor JSON parsing speedup (moneromooo-monero)	5 years ago
Riccardo Spagni	1ed6441925	Merge pull request #5327 ... c23ea796 New interactive daemon command 'print_net_stats': Global traffic stats (rbrunner7)	5 years ago
Riccardo Spagni	87840192dd	Merge pull request #5309 ... 43042a28 Implement array_entry_t copy constructor (Guido Vranken)	5 years ago