aboutsummaryrefslogtreecommitdiffstats
path: root/src/stls
Commit message (Collapse)AuthorAgeFilesLines
* Catch obscure busyloop in stls_runLaurent Bercot2025-09-091-0/+5
|
* Fix stls_run; sbearssl_run needs a rewriteLaurent Bercot2023-11-171-47/+23
| | | | Signed-off-by: Laurent Bercot <ska@appnovation.com>
* Add -J and -j to the TLS tools to check for peer close_notify.Laurent Bercot2023-11-163-176/+189
| | | | | | | | Also, and more importantly, significantly rewrite stls_run() for better full-duplex support. This implementation isn't fully tested yet. Signed-off-by: Laurent Bercot <ska@appnovation.com>
* New and fixed version of sbearssl_runLaurent Bercot2023-11-111-3/+3
| | | | Signed-off-by: Laurent Bercot <ska@appnovation.com>
* Fix tls_error invocationLaurent Bercot2023-11-051-1/+1
| | | | Signed-off-by: Laurent Bercot <ska@appnovation.com>
* Autoset INTERNAL_LIBSLaurent Bercot2023-02-151-1/+1
| | | | Signed-off-by: Laurent Bercot <ska@appnovation.com>
* Prepare for 2.5.1.2Laurent Bercot2022-11-295-5/+5
| | | | Signed-off-by: Laurent Bercot <ska@appnovation.com>
* Fix sbearssl send_environment protocolLaurent Bercot2021-09-241-1/+0
| | | | Signed-off-by: Laurent Bercot <ska@appnovation.com>
* Adapt to skalibs-2.11.0.0Laurent Bercot2021-08-104-4/+4
| | | | Signed-off-by: Laurent Bercot <ska@appnovation.com>
* Work around incredible libtls stupidityLaurent Bercot2021-06-021-0/+8
|
* Make stuff buildLaurent Bercot2021-06-011-2/+2
| | | | Still not working: we need to add servername to the storage
* Server-side SNI, libtls versionLaurent Bercot2021-05-281-10/+38
| | | | Implementation for bearssl coming soon.
* Prepare for 2.4.2.0; implement client certificates with bearsslLaurent Bercot2021-05-181-10/+21
| | | | Also send a bit more environment with libtls
* Remove SSL_TLS_SNI_SERVERNAME (instead of defined but empty) if no SNILaurent Bercot2021-01-281-5/+10
|
* Prepare for 2.4.1.0; add SSL_TLS_SNI_SERVERNAMELaurent Bercot2021-01-281-2/+6
|
* Implement handshake timeout for libtls backendLaurent Bercot2021-01-135-4/+41
|
* Change -K semantics: timeout *during handshake*, not afterwardsLaurent Bercot2020-12-071-6/+2
| | | | | | | | | | | | | | - the TLS tunnel itself should be transparent so it has no business shutting down the connection no matter how long the app takes - there's still an undetectable situation on some kernels where EOF doesn't get transmitted from the network, and the engine is in the handshake, and it can't do anything but wait forever. A timeout is useful here: dawg, your peer is never going to send any more data, you should just give up. - if the situation happens after the handshake, the *app* should have a timeout and die. The tunnel will follow suit. - libtls has a blocking tls_handshake() blackbox, we cannot give it a timeout. Too bad, use bearssl.
* stls client: prefer CAFILE, warn on CADIR use, because libtls is brokenLaurent Bercot2020-11-231-6/+7
|
* Fix more bugs; disable renegociation in bearssl clientLaurent Bercot2020-11-232-32/+27
|
* Fix a few bugs. sbearssl appears to be working.Laurent Bercot2020-11-223-0/+10
|
* Add SSL_PROTOCOL and SSL_CIPHER support, fix some bugsLaurent Bercot2020-11-222-0/+25
|
* Add documentation, fix tiny privdrop bugLaurent Bercot2020-11-221-2/+2
|
* Privs can only be dropped after reading key files.Laurent Bercot2020-11-215-4/+30
|
* Refactor tls code to support ucspi-tlsLaurent Bercot2020-11-205-173/+68
| | | | | | | | | | | | | | | | | | That includes: - new architecture: the tls binary is now a child of the app instead of the other way around - the sbearssl_run engine now takes a post-handshake callback. This allows s6-tlsc and s6-tlsd to only exec into the app when the handshake succeeds (which was already the case with libressl). - new binaries s6-tlsc-io and s6-tlsd-io encapsulate the crypto code; they init and run the engine, connecting to 4 already open fds (stdin/stdout = network, argv[1] and argv[2] = local) - s6-tlsc is now a simple wrapper around s6-tlsc-io - s6-tlsd is now a simple wrapper around s6-tlsd-io - new binary: s6-ucspitlsd, which is also a wrapper around s6-tlsd-io, but differently: the parent execs the app which should be ucspi-tls-aware, the child waits for a command from the parent and execs into s6-tlsd-io if it receives it.
* Moderately big hammer: force kill on s6-tlsd when it has nothing to write ↵Laurent Bercot2017-08-281-1/+5
| | | | to the network
* Revert big hammer. Data still needs to be flushed to the network even when ↵Laurent Bercot2017-08-281-5/+1
| | | | the local app dies.
* Fix error messages in stls_s6tls?.c when setting key fileLaurent Bercot2017-06-292-2/+2
|
* Explicitly make s6-tls[cd] die when the app diesLaurent Bercot2017-05-111-1/+5
| | | | | I have no explanation for the fact that they sometimes survive their app, and I'm fed up with it, so it's time to use the big hammer.
* Fix case where s6-tls[cd] would sometimes not detect an application and ↵Laurent Bercot2017-03-227-65/+97
| | | | remain there forever with its zombie, both condemned to err in limbo for all eternity, the living and the dead, hand in hand
* Cleanup superfluous includesLaurent Bercot2017-03-144-5/+0
|
* Adapt to skalibs-2.5.0.0Laurent Bercot2017-03-123-15/+12
|
* Types fix, first passLaurent Bercot2017-01-105-15/+26
| | | | | | | XXX marks what must change when skalibs changes. Also started writing functions for client certificate support in sbearssl, but it's not working yet (need more high-level support from BearSSL before it can work)
* Remove s6-tls* dependency to libs6net. Improve gen-deps to make dynlinking ↵Laurent Bercot2016-12-045-14/+36
| | | | easier.
* s6-tls*: small bugfixes. Add documentation.Laurent Bercot2016-12-032-4/+3
|
* Fix closing bugs in sbearssl_run and tls_runLaurent Bercot2016-12-021-25/+25
|
* Fix several bugs in stls, make the engine workLaurent Bercot2016-12-013-25/+41
|
* Small sbearssl bugfixes and usability messagesLaurent Bercot2016-11-282-2/+2
|
* Add -z option to s6-tlsc/s6-tlsd to clean TLS env vars before spawning ↵Laurent Bercot2016-11-263-2/+5
| | | | (default)
* stls_run: fix "read from peer" error messageLaurent Bercot2016-11-261-1/+1
|
* Fix warning messages in libtls engineLaurent Bercot2016-11-261-3/+3
|
* Usability fixes for TLSLaurent Bercot2016-11-261-1/+1
|
* SNI support for libtlsLaurent Bercot2016-11-251-8/+6
|
* Fix build bugs. It builds!Laurent Bercot2016-11-252-7/+7
| | | | | | Two things remain to do: - how to pass SNI information to libtls - how to detect cert issuer key type for ECC in bearssl
* Alpha version of the SSL work.Laurent Bercot2016-11-254-0/+465
Doesn't build yet, but I'm scared of losing it, so using git as storage. Will fix the stupid bugs now, the tricky bugs later.
generated by cgit v1.3.1 (git 2.54.0) at 2026-07-16 23:41:41 +0000