s6-networking/src/sbearssl/deps-lib, branch 2.5.0.0 UCSPI TCP implementation and other networking utilities https://git.skarnet.org/cgit/s6-networking/atom/src/sbearssl/deps-lib?h=2.5.0.0 2021-06-02T01:15:12Z Debug session. Now works. 2021-06-02T01:15:12Z Laurent Bercot ska-skaware@skarnet.org 2021-06-02T01:15:12Z urn:sha1:a6c4fb25b60cbc83a4b8bdb756fcf9c69310e6ae The environment given to the application still needs to be cleaned up of SNI variables. Add all the missing pieces for sni_policy 2021-06-01T11:27:05Z Laurent Bercot ska-skaware@skarnet.org 2021-06-01T11:27:05Z urn:sha1:a84b9b4e5d985a5d8a37268a76e1d35210fd31c5 sbearssl_server_init_and_run is yet unchanged, the next step is to rewrite it using the new primitives. Start work on bearssl server-side sni 2021-05-30T09:19:26Z Laurent Bercot ska-skaware@skarnet.org 2021-05-30T09:19:26Z urn:sha1:e763c3ef1485404585b923365f93314aab4e8dd6 Add an x509 engine wrapping minimal. NOT FUNCTIONAL, FOR TESTING. 2021-05-20T10:55:18Z Laurent Bercot ska-skaware@skarnet.org 2021-05-20T10:55:18Z urn:sha1:4aae040b1a8aecddcd0e1e959c77bb262fe6b850 Prepare for 2.4.2.0; implement client certificates with bearssl 2021-05-18T11:19:19Z Laurent Bercot ska-skaware@skarnet.org 2021-05-18T11:19:19Z urn:sha1:6780eee3e0dbe37640f72ed1e37a95c506e23f8c Also send a bit more environment with libtls Add SSL_PROTOCOL and SSL_CIPHER support, fix some bugs 2020-11-22T15:46:34Z Laurent Bercot ska-skaware@skarnet.org 2020-11-22T15:46:34Z urn:sha1:4fb917263ac30373cb3e5dfe3e207369eb238def Privs can only be dropped after reading key files. 2020-11-21T02:22:09Z Laurent Bercot ska-skaware@skarnet.org 2020-11-21T02:22:09Z urn:sha1:5c2880becc94141b8035b3488b6bd60696011308 Refactor tls code to support ucspi-tls 2020-11-20T23:24:29Z Laurent Bercot ska-skaware@skarnet.org 2020-11-20T23:24:29Z urn:sha1:5715c21a077ee1c2fe8957cb4adcea14fd2eda6b That includes: - new architecture: the tls binary is now a child of the app instead of the other way around - the sbearssl_run engine now takes a post-handshake callback. This allows s6-tlsc and s6-tlsd to only exec into the app when the handshake succeeds (which was already the case with libressl). - new binaries s6-tlsc-io and s6-tlsd-io encapsulate the crypto code; they init and run the engine, connecting to 4 already open fds (stdin/stdout = network, argv[1] and argv[2] = local) - s6-tlsc is now a simple wrapper around s6-tlsc-io - s6-tlsd is now a simple wrapper around s6-tlsd-io - new binary: s6-ucspitlsd, which is also a wrapper around s6-tlsd-io, but differently: the parent execs the app which should be ucspi-tls-aware, the child waits for a command from the parent and execs into s6-tlsd-io if it receives it. Fix case where s6-tls[cd] would sometimes not detect an application and remain there forever with its zombie, both condemned to err in limbo for all eternity, the living and the dead, hand in hand 2017-03-22T21:37:30Z Laurent Bercot ska-skaware@skarnet.org 2017-03-22T21:37:30Z urn:sha1:dddbfab568d42e443f102d35c84432824cc59fee Types fix, first pass 2017-01-10T02:17:16Z Laurent Bercot ska-skaware@skarnet.org 2017-01-10T02:17:16Z urn:sha1:334d807b924427434b42d4fbae745d3d1b38a218 XXX marks what must change when skalibs changes. Also started writing functions for client certificate support in sbearssl, but it's not working yet (need more high-level support from BearSSL before it can work)