s6-networking/src/include, branch v2.4.1.0UCSPI TCP implementation and other networking utilitieshttp://git.skarnet.org/cgit/s6-networking/atom/src/include?h=v2.4.1.02021-01-13T11:36:16Z Implement handshake timeout for libtls backend2021-01-13T11:36:16ZLaurent Bercotska-skaware@skarnet.org2021-01-13T11:36:16Zurn:sha1:cc7dccb1858e73176814c3a8457ff6f94ff45662 Change -K semantics: timeout *during handshake*, not afterwards2020-12-07T12:53:54ZLaurent Bercotska-skaware@skarnet.org2020-12-07T12:53:54Zurn:sha1:f7e676abdc799fcee5138807447b5e91ab05508f
- the TLS tunnel itself should be transparent so it has no business
shutting down the connection no matter how long the app takes
- there's still an undetectable situation on some kernels where
EOF doesn't get transmitted from the network, and the engine is in
the handshake, and it can't do anything but wait forever. A timeout
is useful here: dawg, your peer is never going to send any more data,
you should just give up.
- if the situation happens after the handshake, the *app* should
have a timeout and die. The tunnel will follow suit.
- libtls has a blocking tls_handshake() blackbox, we cannot give it
a timeout. Too bad, use bearssl.
Add SSL_PROTOCOL and SSL_CIPHER support, fix some bugs2020-11-22T15:46:34ZLaurent Bercotska-skaware@skarnet.org2020-11-22T15:46:34Zurn:sha1:4fb917263ac30373cb3e5dfe3e207369eb238def Refactor tls code to support ucspi-tls2020-11-20T23:24:29ZLaurent Bercotska-skaware@skarnet.org2020-11-20T23:24:29Zurn:sha1:5715c21a077ee1c2fe8957cb4adcea14fd2eda6b
That includes:
- new architecture: the tls binary is now a child of the app
instead of the other way around
- the sbearssl_run engine now takes a post-handshake callback.
This allows s6-tlsc and s6-tlsd to only exec into the app when
the handshake succeeds (which was already the case with libressl).
- new binaries s6-tlsc-io and s6-tlsd-io encapsulate the crypto
code; they init and run the engine, connecting to 4 already open
fds (stdin/stdout = network, argv[1] and argv[2] = local)
- s6-tlsc is now a simple wrapper around s6-tlsc-io
- s6-tlsd is now a simple wrapper around s6-tlsd-io
- new binary: s6-ucspitlsd, which is also a wrapper around
s6-tlsd-io, but differently: the parent execs the app which should
be ucspi-tls-aware, the child waits for a command from the parent
and execs into s6-tlsd-io if it receives it.
Fix case where s6-tls[cd] would sometimes not detect an application and remain there forever with its zombie, both condemned to err in limbo for all eternity, the living and the dead, hand in hand2017-03-22T21:37:30ZLaurent Bercotska-skaware@skarnet.org2017-03-22T21:37:30Zurn:sha1:dddbfab568d42e443f102d35c84432824cc59fee Adapt to skalibs-2.5.0.02017-03-12T19:39:01ZLaurent Bercotska-skaware@skarnet.org2017-03-12T19:39:01Zurn:sha1:53091e3bce487ee82e2805a0231e780551561717 Delay client cert support, but make s6-networking build against bearssl-0.32017-01-30T19:03:02ZLaurent Bercotska-skaware@skarnet.org2017-01-30T19:03:02Zurn:sha1:f85b8a70f3b44510a5cf3895bf7357ae90655f65 Types fix, first pass2017-01-10T02:17:16ZLaurent Bercotska-skaware@skarnet.org2017-01-10T02:17:16Zurn:sha1:334d807b924427434b42d4fbae745d3d1b38a218
XXX marks what must change when skalibs changes.
Also started writing functions for client certificate support
in sbearssl, but it's not working yet (need more high-level
support from BearSSL before it can work)
Remove s6-tls* dependency to libs6net. Improve gen-deps to make dynlinking easier.2016-12-04T13:44:23ZLaurent Bercotska-skaware@skarnet.org2016-12-04T13:44:23Zurn:sha1:5d38ea056c82221a0ddc206cd57dd7c1852a3159 sbearssl: allow DER-encoded certificates in TA directory2016-11-30T16:00:29ZLaurent Bercotska-skaware@skarnet.org2016-11-30T16:00:29Zurn:sha1:cc08be523a2a647a999dcf82dcce9dee62b4162c