aboutsummaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* Debug session. Now works.Laurent Bercot2021-06-027-46/+54
| | | | | The environment given to the application still needs to be cleaned up of SNI variables.
* Merge branch 'dev'Laurent Bercot2021-06-0124-62/+657
|\ | | | | | | | | This add full client certificate support, as well as tentative SNI functionality
| * Add servername to storagedevLaurent Bercot2021-06-015-18/+15
| |
| * Make stuff buildLaurent Bercot2021-06-013-54/+76
| | | | | | | | Still not working: we need to add servername to the storage
| * Add all the missing pieces for sni_policyLaurent Bercot2021-06-0119-122/+326
| | | | | | | | | | sbearssl_server_init_and_run is yet unchanged, the next step is to rewrite it using the new primitives.
| * Start work on bearssl server-side sniLaurent Bercot2021-05-3010-0/+372
| |
* | bugfix: -l option in s6-tlsserver takes an argLaurent Bercot2021-05-301-1/+1
|/
* Server-side SNI, libtls versionLaurent Bercot2021-05-287-32/+84
| | | | Implementation for bearssl coming soon.
* All good, remove debug instructionsLaurent Bercot2021-05-273-20/+1
|
* Remove backtraces; add verification impls to server enginesLaurent Bercot2021-05-272-9/+2
|
* Add backtrace invocation to debug spurious get_pkey callLaurent Bercot2021-05-271-1/+10
|
* More debug commandsLaurent Bercot2021-05-252-4/+11
|
* bugfix: tcpserver should unignore SIGPIPELaurent Bercot2021-05-222-2/+4
|
* Trivial syscall number optimizationLaurent Bercot2021-05-212-2/+2
|
* Debugging iterationLaurent Bercot2021-05-202-2/+1
|
* Add an x509 engine wrapping minimal. NOT FUNCTIONAL, FOR TESTING.Laurent Bercot2021-05-2012-66/+310
|
* Prepare for 2.4.2.0; implement client certificates with bearsslLaurent Bercot2021-05-189-83/+199
| | | | Also send a bit more environment with libtls
* sbearssl cosmetic fixesLaurent Bercot2021-05-082-3/+5
|
* Remove SSL_TLS_SNI_SERVERNAME (instead of defined but empty) if no SNILaurent Bercot2021-01-282-8/+20
|
* Prepare for 2.4.1.0; add SSL_TLS_SNI_SERVERNAMELaurent Bercot2021-01-282-2/+9
|
* Tiny code and doc fixesLaurent Bercot2021-01-182-0/+2
|
* Implement handshake timeout for libtls backendLaurent Bercot2021-01-139-14/+53
|
* Get rid of webipc.hLaurent Bercot2020-12-094-10/+10
|
* Change -K semantics: timeout *during handshake*, not afterwardsLaurent Bercot2020-12-075-13/+14
| | | | | | | | | | | | | | - the TLS tunnel itself should be transparent so it has no business shutting down the connection no matter how long the app takes - there's still an undetectable situation on some kernels where EOF doesn't get transmitted from the network, and the engine is in the handshake, and it can't do anything but wait forever. A timeout is useful here: dawg, your peer is never going to send any more data, you should just give up. - if the situation happens after the handshake, the *app* should have a timeout and die. The tunnel will follow suit. - libtls has a blocking tls_handshake() blackbox, we cannot give it a timeout. Too bad, use bearssl.
* Fix build with skalibs 2.10.0.0; document dependenciesLaurent Bercot2020-11-301-1/+1
|
* Convert to new exec.h syntaxLaurent Bercot2020-11-2616-83/+106
|
* That exit condition is really hard to get right >.>Laurent Bercot2020-11-261-1/+1
|
* Fix engine exit condition for sbearsslLaurent Bercot2020-11-261-4/+5
|
* minidentd QoL fixLaurent Bercot2020-11-231-1/+3
|
* stls client: prefer CAFILE, warn on CADIR use, because libtls is brokenLaurent Bercot2020-11-231-6/+7
|
* Fix more bugs; disable renegociation in bearssl clientLaurent Bercot2020-11-234-44/+44
|
* Fix a few bugs. sbearssl appears to be working.Laurent Bercot2020-11-227-24/+26
|
* Add SSL_PROTOCOL and SSL_CIPHER support, fix some bugsLaurent Bercot2020-11-2213-45/+376
|
* Add documentation, fix tiny privdrop bugLaurent Bercot2020-11-222-4/+4
|
* Move all tls stuff into its own subdirLaurent Bercot2020-11-2122-0/+0
|
* Add s6-ucspitlscLaurent Bercot2020-11-219-78/+201
|
* Prepare for 2.4.0.0Laurent Bercot2020-11-211-1/+12
|
* Privs can only be dropped after reading key files.Laurent Bercot2020-11-2115-11/+38
|
* Refactor tls code to support ucspi-tlsLaurent Bercot2020-11-2029-432/+804
| | | | | | | | | | | | | | | | | | That includes: - new architecture: the tls binary is now a child of the app instead of the other way around - the sbearssl_run engine now takes a post-handshake callback. This allows s6-tlsc and s6-tlsd to only exec into the app when the handshake succeeds (which was already the case with libressl). - new binaries s6-tlsc-io and s6-tlsd-io encapsulate the crypto code; they init and run the engine, connecting to 4 already open fds (stdin/stdout = network, argv[1] and argv[2] = local) - s6-tlsc is now a simple wrapper around s6-tlsc-io - s6-tlsd is now a simple wrapper around s6-tlsd-io - new binary: s6-ucspitlsd, which is also a wrapper around s6-tlsd-io, but differently: the parent execs the app which should be ucspi-tls-aware, the child waits for a command from the parent and execs into s6-tlsd-io if it receives it.
* Add -e option to s6-tlsserverLaurent Bercot2020-05-061-4/+12
|
* Remove tainnow.lib dependencyLaurent Bercot2019-09-218-8/+8
|
* Adapt to new stopwatch APILaurent Bercot2019-09-066-10/+6
|
* Use stopwatches and wallclocks where appropriateLaurent Bercot2019-09-047-1/+7
|
* Different code style for the maxconn spurious warning avoidanceLaurent Bercot2019-05-142-9/+6
|
* Adapt to skalibs/posixishard.hLaurent Bercot2019-02-206-7/+18
|
* bugfix: have s6-tcpserver?d write localport to stdout on notifLaurent Bercot2018-10-062-2/+24
| | | | and not just a newline.
* Add nsss supportLaurent Bercot2018-08-011-0/+2
|
* Adapt to skalibs-2.7.0.0, prepare for 2.3.0.3Laurent Bercot2018-07-212-11/+8
|
* change localip is6 flag based on destination ipJohn Regan2018-04-111-2/+6
| | | | | | | | | | | | | | | | By default, the localip flag is initialized with the is6 flag set to 0. The only time the flag is changed to 1 is when a user specifies a local IPv6 address to use. Because of this, socket_tcp46 always creates an IPv4 socket. This patch corrects that - if the user hasn't specified a local address, then the local 'is6' flag is updated to match the destination 'is6' flag. Signed-off-by: Laurent Bercot <ska-skaware@skarnet.org>
* Add -B (blocking) option to s6-tcpserver?-socketbinderLaurent Bercot2018-04-112-6/+12
|
generated by cgit v1.3.1 (git 2.54.0) at 2026-07-16 19:41:02 +0000