CVS log for loncom/lonssl.pm

Up to [LON-CAPA] / loncom

Request diff between arbitrary revisions

Keyword substitution: kv
Default branch: MAIN

- Include verification of common name when creating SSL tunnel unless
  connecting to/from pre-2.12 node.
- $IO::Socket::SSL::DEBUG is set to current $DEBUG value so debugging
  from IO/Socket/SSL.pm is written to lond_errors or lonc_errors.

- Typo in rev. 1.22

- Support Certificate Revocation List checking.
  - Change order of args in lonssl::Read_Connect_Config() as third arg used
    by call from lond (for Server) but not from LondConnection (Client)

- Verification of CN when creating SSL tunnel on multi-domain servers.
  CN is default lonid, i.e., one listed last for the node's hostname in
  hosts.tab and/or dns_hosts.tab.

- Use three-argument open() to separate file mode from the filename.
- Remove some trailing whitespace.

- Reverse unneeded rev 1.17 changes in args passed to Read_Connect_Config(),
  (init of %crlchecked() occurs in LondConnection::ReadConfig() instead).

- Compatibility with pre-2.12 LON-CAPA versions of loncnew.

- Support Certificate Revocation List checking when using SSL channel
  for key exchange during negotiation of connection to remote lond.

- Include verification of common name when creating SSL tunnel. Fall back
  to insecure connection (if allowed) if verification fails.

- Use of LON-CAPA SSL certificates to create secure channel for exchange of
  encryption key between LON-CAPA nodes can be set to: "no", "yes", "req"
  (i.e., required) separately for outbound (i.e., lonc) and inbound connections
  (i.e., lond) in domain config (default domain only on a multi-domain server).
- Can differentiate between connections between nodes in same domain, nodes
  in same "internet" domain. and nodes in neither.
- Supercedes use of loncAllowInsecure and londAllowInsecure from loncapa.conf
  on each node.
- Run /home/httpd/perl/loncron --justreload (as www) after changing domain config

- Eliminate warnings in lonc_errors where SSL is in use for internal
  LON-CAPA communication and distro has IO::Socket::SSL rev. 1.79 or
  newer.

- Typo (same change as in rev 1.12).

- Typo.

- Fix typos.

- more bad syntax bug#4975

Turn down the logging volume now that the ssl stuff looks like it's functional.

Debug ssl based key exchange support

Fix up parameter passingot match Guy's standards.

- Accept arguments according to loncapa coding standard
- Retabinate.

Fix an error in a comment

Got a good compile out of it.

- style police

Add coded versions of:

     PromoteClientSocket
     PromoteServerSocket
     Close

Who knows if I commit often enough, maybe I'll win!!

This file will contain common and useful code used by lond and lonc
when negotiating a  secure exchange of the session key
via an ssl tunnel.