s6-networking/src/include, branch dev UCSPI TCP implementation and other networking utilities http://git.skarnet.org/cgit/s6-networking/atom/src/include?h=dev 2021-06-01T21:28:12Z Add servername to storage 2021-06-01T21:28:12Z Laurent Bercot ska-skaware@skarnet.org 2021-06-01T21:28:12Z urn:sha1:1191557c30af6326fc5fae7f02167375043bb293 Add all the missing pieces for sni_policy 2021-06-01T11:27:05Z Laurent Bercot ska-skaware@skarnet.org 2021-06-01T11:27:05Z urn:sha1:a84b9b4e5d985a5d8a37268a76e1d35210fd31c5 sbearssl_server_init_and_run is yet unchanged, the next step is to rewrite it using the new primitives. Start work on bearssl server-side sni 2021-05-30T09:19:26Z Laurent Bercot ska-skaware@skarnet.org 2021-05-30T09:19:26Z urn:sha1:e763c3ef1485404585b923365f93314aab4e8dd6 Debugging iteration 2021-05-20T15:09:19Z Laurent Bercot ska-skaware@skarnet.org 2021-05-20T15:09:19Z urn:sha1:91130797f3267a4fe26cadd786ab4dca122eaa5f Add an x509 engine wrapping minimal. NOT FUNCTIONAL, FOR TESTING. 2021-05-20T10:55:18Z Laurent Bercot ska-skaware@skarnet.org 2021-05-20T10:55:18Z urn:sha1:4aae040b1a8aecddcd0e1e959c77bb262fe6b850 Prepare for 2.4.2.0; implement client certificates with bearssl 2021-05-18T11:19:19Z Laurent Bercot ska-skaware@skarnet.org 2021-05-18T11:19:19Z urn:sha1:6780eee3e0dbe37640f72ed1e37a95c506e23f8c Also send a bit more environment with libtls Implement handshake timeout for libtls backend 2021-01-13T11:36:16Z Laurent Bercot ska-skaware@skarnet.org 2021-01-13T11:36:16Z urn:sha1:cc7dccb1858e73176814c3a8457ff6f94ff45662 Change -K semantics: timeout *during handshake*, not afterwards 2020-12-07T12:53:54Z Laurent Bercot ska-skaware@skarnet.org 2020-12-07T12:53:54Z urn:sha1:f7e676abdc799fcee5138807447b5e91ab05508f - the TLS tunnel itself should be transparent so it has no business shutting down the connection no matter how long the app takes - there's still an undetectable situation on some kernels where EOF doesn't get transmitted from the network, and the engine is in the handshake, and it can't do anything but wait forever. A timeout is useful here: dawg, your peer is never going to send any more data, you should just give up. - if the situation happens after the handshake, the *app* should have a timeout and die. The tunnel will follow suit. - libtls has a blocking tls_handshake() blackbox, we cannot give it a timeout. Too bad, use bearssl. Add SSL_PROTOCOL and SSL_CIPHER support, fix some bugs 2020-11-22T15:46:34Z Laurent Bercot ska-skaware@skarnet.org 2020-11-22T15:46:34Z urn:sha1:4fb917263ac30373cb3e5dfe3e207369eb238def Refactor tls code to support ucspi-tls 2020-11-20T23:24:29Z Laurent Bercot ska-skaware@skarnet.org 2020-11-20T23:24:29Z urn:sha1:5715c21a077ee1c2fe8957cb4adcea14fd2eda6b That includes: - new architecture: the tls binary is now a child of the app instead of the other way around - the sbearssl_run engine now takes a post-handshake callback. This allows s6-tlsc and s6-tlsd to only exec into the app when the handshake succeeds (which was already the case with libressl). - new binaries s6-tlsc-io and s6-tlsd-io encapsulate the crypto code; they init and run the engine, connecting to 4 already open fds (stdin/stdout = network, argv[1] and argv[2] = local) - s6-tlsc is now a simple wrapper around s6-tlsc-io - s6-tlsd is now a simple wrapper around s6-tlsd-io - new binary: s6-ucspitlsd, which is also a wrapper around s6-tlsd-io, but differently: the parent execs the app which should be ucspi-tls-aware, the child waits for a command from the parent and execs into s6-tlsd-io if it receives it.