aboutsummaryrefslogtreecommitdiffstats
path: root/src/sbearssl
Commit message (Collapse)AuthorAgeFilesLines
* bugfix: sbearssl_run adapted to new allread() APILaurent Bercot2022-10-071-2/+6
| | | | Signed-off-by: Laurent Bercot <ska@appnovation.com>
* Add workaround to bearssl regression with BR_FEATURE_X509_TIME_CALLBACKLaurent Bercot2022-10-076-8/+61
| | | | Signed-off-by: Laurent Bercot <ska@appnovation.com>
* sbearssl_sni_policy_vtable: use the COPY macro for ec as wellLaurent Bercot2022-08-121-3/+3
| | | | Signed-off-by: Laurent Bercot <ska@appnovation.com>
* Fix allread errno managementLaurent Bercot2022-07-181-0/+1
| | | | Signed-off-by: Laurent Bercot <ska@appnovation.com>
* Prepare for 2.5.1.1; adapt to skalibs-2.12.0.0Laurent Bercot2022-04-092-4/+2
| | | | Signed-off-by: Laurent Bercot <ska@appnovation.com>
* Add sbearssl_*_set_tain(n)_g convenience macrosLaurent Bercot2021-11-192-2/+2
| | | | Signed-off-by: Laurent Bercot <ska@appnovation.com>
* Allow SNI wildcarding for *.example.comLaurent Bercot2021-11-181-5/+27
| | | | Signed-off-by: Laurent Bercot <ska@appnovation.com>
* SNI matches are case-insensitiveLaurent Bercot2021-11-181-2/+2
| | | | Signed-off-by: Laurent Bercot <ska@appnovation.com>
* Fix error path in add_keypair_file for sbearssl SNI policyLaurent Bercot2021-11-091-1/+1
| | | | Signed-off-by: Laurent Bercot <ska@appnovation.com>
* Fix error message in sbearssl server initLaurent Bercot2021-11-091-1/+1
| | | | Signed-off-by: Laurent Bercot <ska@appnovation.com>
* No need for twice the workaround ^^'Laurent Bercot2021-11-081-1/+0
| | | | Signed-off-by: Laurent Bercot <ska@appnovation.com>
* Workaround for a bearssl bug in do_signLaurent Bercot2021-10-191-0/+1
| | | | | | Credit to Erico Nogueira for reporting and helping find the bug. Signed-off-by: Laurent Bercot <ska@appnovation.com>
* Fix error case in readbigpemLaurent Bercot2021-10-181-5/+6
| | | | Signed-off-by: Laurent Bercot <ska@appnovation.com>
* Fix sbearssl send_environment protocolLaurent Bercot2021-09-241-1/+1
| | | | Signed-off-by: Laurent Bercot <ska@appnovation.com>
* Adapt to skalibs-2.11.0.0Laurent Bercot2021-08-104-5/+5
| | | | Signed-off-by: Laurent Bercot <ska@appnovation.com>
* CosmeticsLaurent Bercot2021-06-032-3/+2
|
* Inline functionsLaurent Bercot2021-06-031-2/+2
|
* Don't hardcode ecdsa signature implementation in sni_policyLaurent Bercot2021-06-031-1/+1
|
* Debug session. Now works.Laurent Bercot2021-06-026-46/+53
| | | | | The environment given to the application still needs to be cleaned up of SNI variables.
* Add servername to storagedevLaurent Bercot2021-06-014-5/+8
|
* Make stuff buildLaurent Bercot2021-06-012-52/+74
| | | | Still not working: we need to add servername to the storage
* Add all the missing pieces for sni_policyLaurent Bercot2021-06-0118-119/+316
| | | | | sbearssl_server_init_and_run is yet unchanged, the next step is to rewrite it using the new primitives.
* Start work on bearssl server-side sniLaurent Bercot2021-05-309-0/+340
|
* All good, remove debug instructionsLaurent Bercot2021-05-273-20/+1
|
* Remove backtraces; add verification impls to server enginesLaurent Bercot2021-05-272-9/+2
|
* Add backtrace invocation to debug spurious get_pkey callLaurent Bercot2021-05-271-1/+10
|
* More debug commandsLaurent Bercot2021-05-252-4/+11
|
* Debugging iterationLaurent Bercot2021-05-201-1/+1
|
* Add an x509 engine wrapping minimal. NOT FUNCTIONAL, FOR TESTING.Laurent Bercot2021-05-209-50/+256
|
* Prepare for 2.4.2.0; implement client certificates with bearsslLaurent Bercot2021-05-187-73/+173
| | | | Also send a bit more environment with libtls
* sbearssl cosmetic fixesLaurent Bercot2021-05-082-3/+5
|
* Remove SSL_TLS_SNI_SERVERNAME (instead of defined but empty) if no SNILaurent Bercot2021-01-281-3/+10
|
* Prepare for 2.4.1.0; add SSL_TLS_SNI_SERVERNAMELaurent Bercot2021-01-281-0/+3
|
* Implement handshake timeout for libtls backendLaurent Bercot2021-01-131-4/+7
|
* Change -K semantics: timeout *during handshake*, not afterwardsLaurent Bercot2020-12-071-3/+7
| | | | | | | | | | | | | | - the TLS tunnel itself should be transparent so it has no business shutting down the connection no matter how long the app takes - there's still an undetectable situation on some kernels where EOF doesn't get transmitted from the network, and the engine is in the handshake, and it can't do anything but wait forever. A timeout is useful here: dawg, your peer is never going to send any more data, you should just give up. - if the situation happens after the handshake, the *app* should have a timeout and die. The tunnel will follow suit. - libtls has a blocking tls_handshake() blackbox, we cannot give it a timeout. Too bad, use bearssl.
* Convert to new exec.h syntaxLaurent Bercot2020-11-261-1/+1
|
* That exit condition is really hard to get right >.>Laurent Bercot2020-11-261-1/+1
|
* Fix engine exit condition for sbearsslLaurent Bercot2020-11-261-4/+5
|
* Fix more bugs; disable renegociation in bearssl clientLaurent Bercot2020-11-232-12/+17
|
* Fix a few bugs. sbearssl appears to be working.Laurent Bercot2020-11-221-15/+15
|
* Add SSL_PROTOCOL and SSL_CIPHER support, fix some bugsLaurent Bercot2020-11-226-2/+319
|
* Add documentation, fix tiny privdrop bugLaurent Bercot2020-11-221-2/+2
|
* Privs can only be dropped after reading key files.Laurent Bercot2020-11-215-0/+30
|
* Refactor tls code to support ucspi-tlsLaurent Bercot2020-11-206-152/+59
| | | | | | | | | | | | | | | | | | That includes: - new architecture: the tls binary is now a child of the app instead of the other way around - the sbearssl_run engine now takes a post-handshake callback. This allows s6-tlsc and s6-tlsd to only exec into the app when the handshake succeeds (which was already the case with libressl). - new binaries s6-tlsc-io and s6-tlsd-io encapsulate the crypto code; they init and run the engine, connecting to 4 already open fds (stdin/stdout = network, argv[1] and argv[2] = local) - s6-tlsc is now a simple wrapper around s6-tlsc-io - s6-tlsd is now a simple wrapper around s6-tlsd-io - new binary: s6-ucspitlsd, which is also a wrapper around s6-tlsd-io, but differently: the parent execs the app which should be ucspi-tls-aware, the child waits for a command from the parent and execs into s6-tlsd-io if it receives it.
* Adapt to skalibs/posixishard.hLaurent Bercot2019-02-202-2/+8
|
* Adapt to skalibs-2.7.0.0, prepare for 2.3.0.3Laurent Bercot2018-07-211-11/+7
|
* Moderately big hammer: force kill on s6-tlsd when it has nothing to write ↵Laurent Bercot2017-08-281-1/+5
| | | | to the network
* Revert big hammer. Data still needs to be flushed to the network even when ↵Laurent Bercot2017-08-281-5/+1
| | | | the local app dies.
* Optimize to xpathexec ; prepare for 2.3.0.2Laurent Bercot2017-08-221-1/+1
|
* Explicitly make s6-tls[cd] die when the app diesLaurent Bercot2017-05-111-1/+5
| | | | | I have no explanation for the fact that they sometimes survive their app, and I'm fed up with it, so it's time to use the big hammer.
generated by cgit v1.3.1 (git 2.54.0) at 2026-07-16 22:01:08 +0000