s6-networking/src/stls/stls_run.c, branch 2.5.0.0 UCSPI TCP implementation and other networking utilities https://git.skarnet.org/cgit/s6-networking/atom/src/stls/stls_run.c?h=2.5.0.0 2020-12-07T12:53:54Z Change -K semantics: timeout *during handshake*, not afterwards 2020-12-07T12:53:54Z Laurent Bercot ska-skaware@skarnet.org 2020-12-07T12:53:54Z urn:sha1:f7e676abdc799fcee5138807447b5e91ab05508f - the TLS tunnel itself should be transparent so it has no business shutting down the connection no matter how long the app takes - there's still an undetectable situation on some kernels where EOF doesn't get transmitted from the network, and the engine is in the handshake, and it can't do anything but wait forever. A timeout is useful here: dawg, your peer is never going to send any more data, you should just give up. - if the situation happens after the handshake, the *app* should have a timeout and die. The tunnel will follow suit. - libtls has a blocking tls_handshake() blackbox, we cannot give it a timeout. Too bad, use bearssl. Fix a few bugs. sbearssl appears to be working. 2020-11-22T21:49:58Z Laurent Bercot ska-skaware@skarnet.org 2020-11-22T21:49:58Z urn:sha1:bae11b88357db72b19413cd05c62ac9242b9b597 Refactor tls code to support ucspi-tls 2020-11-20T23:24:29Z Laurent Bercot ska-skaware@skarnet.org 2020-11-20T23:24:29Z urn:sha1:5715c21a077ee1c2fe8957cb4adcea14fd2eda6b That includes: - new architecture: the tls binary is now a child of the app instead of the other way around - the sbearssl_run engine now takes a post-handshake callback. This allows s6-tlsc and s6-tlsd to only exec into the app when the handshake succeeds (which was already the case with libressl). - new binaries s6-tlsc-io and s6-tlsd-io encapsulate the crypto code; they init and run the engine, connecting to 4 already open fds (stdin/stdout = network, argv[1] and argv[2] = local) - s6-tlsc is now a simple wrapper around s6-tlsc-io - s6-tlsd is now a simple wrapper around s6-tlsd-io - new binary: s6-ucspitlsd, which is also a wrapper around s6-tlsd-io, but differently: the parent execs the app which should be ucspi-tls-aware, the child waits for a command from the parent and execs into s6-tlsd-io if it receives it. Moderately big hammer: force kill on s6-tlsd when it has nothing to write to the network 2017-08-28T21:10:03Z Laurent Bercot ska-skaware@skarnet.org 2017-08-28T21:10:03Z urn:sha1:5691bc64df8444cfbebe7a97480f49f79497b19b Revert big hammer. Data still needs to be flushed to the network even when the local app dies. 2017-08-28T20:30:00Z Laurent Bercot ska-skaware@skarnet.org 2017-08-28T20:30:00Z urn:sha1:d594db1b68d6a2c890d385087799dd8cdf6dc966 Explicitly make s6-tls[cd] die when the app dies 2017-05-11T16:29:01Z Laurent Bercot ska-skaware@skarnet.org 2017-05-11T16:29:01Z urn:sha1:4b632a08e4b58140b9946b644c7884d3f0294c09 I have no explanation for the fact that they sometimes survive their app, and I'm fed up with it, so it's time to use the big hammer. Fix case where s6-tls[cd] would sometimes not detect an application and remain there forever with its zombie, both condemned to err in limbo for all eternity, the living and the dead, hand in hand 2017-03-22T21:37:30Z Laurent Bercot ska-skaware@skarnet.org 2017-03-22T21:37:30Z urn:sha1:dddbfab568d42e443f102d35c84432824cc59fee Cleanup superfluous includes 2017-03-14T09:07:27Z Laurent Bercot ska-skaware@skarnet.org 2017-03-14T09:07:27Z urn:sha1:6126e9c49f01b315c82cae340caaa1d8f588c0e7 Adapt to skalibs-2.5.0.0 2017-03-12T19:39:01Z Laurent Bercot ska-skaware@skarnet.org 2017-03-12T19:39:01Z urn:sha1:53091e3bce487ee82e2805a0231e780551561717 Types fix, first pass 2017-01-10T02:17:16Z Laurent Bercot ska-skaware@skarnet.org 2017-01-10T02:17:16Z urn:sha1:334d807b924427434b42d4fbae745d3d1b38a218 XXX marks what must change when skalibs changes. Also started writing functions for client certificate support in sbearssl, but it's not working yet (need more high-level support from BearSSL before it can work)