From 0de4e6e0703f47be954f4cfa37648dd58665c819 Mon Sep 17 00:00:00 2001 From: Laurent Bercot Date: Mon, 30 Nov 2020 12:55:39 +0000 Subject: Fix build with skalibs 2.10.0.0; document dependencies --- INSTALL | 70 ++++++++++++++++++++++++++++++-------------------- NEWS | 1 + doc/index.html | 24 +++++++++-------- doc/libstls/index.html | 10 +++++--- doc/upgrade.html | 6 ++++- src/tls/s6-tlsserver.c | 2 +- 6 files changed, 70 insertions(+), 43 deletions(-) diff --git a/INSTALL b/INSTALL index 37e0076..b7f9a64 100644 --- a/INSTALL +++ b/INSTALL @@ -6,13 +6,15 @@ Build Instructions - A POSIX-compliant C development environment - GNU make version 3.81 or later - - skalibs version 2.9.4.0 or later: https://skarnet.org/software/skalibs/ - - (Optional) execline version 2.6.1.1 or later: https://skarnet.org/software/execline/ - - s6 version 2.9.2.0 or later: https://skarnet.org/software/s6/ + - skalibs version 2.10.0.0 or later: https://skarnet.org/software/skalibs/ + - (Optional) execline version 2.7.0.0 or later: https://skarnet.org/software/execline/ + - s6 version 2.10.0.0 or later: https://skarnet.org/software/s6/ - s6-dns version 2.3.3.0 or later: https://skarnet.org/software/s6-dns/ - Depending on whether you build the SSL tools, - libressl version 3.1.4 or later: https://libressl.org/ - or bearssl version 0.6 or later: https://bearssl.org/ + bearssl version 0.6 or later: https://bearssl.org/ + or libressl version 3.2.2 or later: https://libressl.org/ + or openssl version 1.1.1h or later: https://openssl.org/ *in addition to* + libretls version 3.3.0 or later: https://git.causal.agency/libretls/about/ This software will run on any operating system that implements POSIX.1-2008, available at: @@ -182,14 +184,22 @@ source tree if parallel builds are needed. * SSL support ----------- - s6-networking implements UCSPI tools for SSL/TLS connections: s6-tlsclient, -s6-tlsserver, s6-tlsc and s6-tlsd. Those are built if you give the ---enable-ssl= flag to configure. There are two supported -values for : libressl (in which case the tools will be -built against libtls) and bearssl (in which case the tools will be built -against libbearssl). You should install the relevant header and library -files for your chosen implementation, be it LibreSSL or BearSSL, before -building a SSL-enabled s6-networking. + s6-networking implements UCSPI tools for SSL/TLS connections: see the +doc/tls-overview.html page for a listing of these tools and what they do. +The TLS tools are built if you give the --enable-ssl= +flag to configure. There are two supported values for : +bearssl and libtls. You should install the relevant header and library +files for your chosen implementation before building a SSL-enabled +s6-networking. + "bearssl" uses the BearSSL API, of which there's only one implementation, +from bearssl.org. + "libtls" uses the libtls API, which has two possible implementations: + - The original one, from libressl.org, bundled with LibreSSL + - An alternative one, from causal.agency, that is used on top of +OpenSSL. + + For compatibility, "libressl" is accepted as and is +an alias to libtls. If your SSL headers and library files are not installed in /usr/include and /usr/lib, you can use the --with-ssl-path=DIR configure option: @@ -198,23 +208,27 @@ DIR/lib. For more complex setups, use the generic --with-include and --with-dir configure options. If you choose --enable-ssl=bearssl, then s6-networking will build a -"libsbearssl" support library, which s6-tlsc and s6-tlsd will be linked -against. This support library depends on libbearssl interfaces. - - If you choose --enable-ssl=libressl, then s6-networking will build -a "libstls" support library, which s6-tlsc and s6-tlsd will be linked -against. This support library depends on libtls interfaces, but not -on libssl or libcrypto interfaces - so it is possible to use alternative -implementations of the libtls API. +"libsbearssl" support library, which s6-tlsc-io and s6-tlsd-io will be +linked against. This support library depends on libbearssl interfaces. + + If you choose --enable-ssl=libtls, then s6-networking will build a +"libstls" support library, which s6-tlsc-io and s6-tlsd-io will be +linked against. This support library depends on libtls interfaces, but +not on libssl or libcrypto interfaces, so it is possible to use other +alternative implementations of the libtls API. There is one such +implementation: libtls-bearssl, implementing libtls on top of bearssl, +but using it with s6-networking is a waste since s6-networking supports +bearssl natively. If your SSL implementation library needs nonstandard -l options to link against it, you can override the CRYPTO_LIB make variable. -By default, CRYPTO_LIB is "-lbearssl" when building against BearSSL, -and "-ltls -lssl -lcrypto" when building against LibreSSL. +By default, CRYPTO_LIB is "-lbearssl" when building against bearssl, +and "-ltls -lssl -lcrypto" when building against libtls. - As of 2019-02-12, please note that BearSSL is considered beta quality + As of 2020-11-30, please note that BearSSL is considered beta quality by its author, so use with caution. Nevertheless, it's an incredibly -promising library with high-quality interfaces and implementation. -When statically linked against BearSSL, the s6-tlsc and s6-tlsd binaries -are 1/10th the size of what they are when statically linked against LibreSSL, -with a smaller RAM footprint too. +good beta, with high-quality interfaces and implementation, and no +known serious bugs. +When statically linked against BearSSL, the s6-tlsc-io and s6-tlsd-io +binaries are 1/10th the size of what they are when statically linked +against libressl/openssl, with a much smaller RAM footprint too. diff --git a/NEWS b/NEWS index 25c989b..83f2c29 100644 --- a/NEWS +++ b/NEWS @@ -3,6 +3,7 @@ Changelog for s6-networking. In 2.4.0.0 ---------- + - Can be built against OpenSSL + libretls. - execline is now optional. - s6-tlsc and s6-tlsd rewrite. They're now wrappers around new binaries: s6-tlsc-io and s6-tlsd-io, which establish and run a diff --git a/doc/index.html b/doc/index.html index f402ab3..1160f7a 100644 --- a/doc/index.html +++ b/doc/index.html @@ -44,23 +44,27 @@ compiled with IPv6 support, s6-networking is IPv6-ready.
  • A POSIX-compliant system with a standard C development environment
  • GNU make, version 3.81 or later
  • skalibs version -2.9.4.0 or later. It's a build-time requirement. It's also a run-time +2.10.0.0 or later. It's a build-time requirement. It's also a run-time requirement if you link against the shared version of the skalibs library.
  • execline version -2.6.1.1 or later. It's a build-time and run-time requirement.
    • +2.7.0.0 or later. It's a build-time and run-time requirement.
  • s6 version -2.9.2.0 or later. It's a build-time and run-time requirement.
    • +2.10.0.0 or later. It's a build-time and run-time requirement.
  • s6-dns version 2.3.3.0 or later. It's a build-time requirement. It's also a run-time requirement if you link against the shared version of the s6-dns libraries.
  • If you want to build the secure communication tools:
      -
    • Either LibreSSL version 3.1.4 -or later
      • -
    • Or BearSSL version 0.6 +
    • Either BearSSL version 0.6 or later. This is a beta version.
      • +
    • Or LibreSSL version 3.2.2 +or later
      • +
    • Or OpenSSL version 1.1.1h +or later and +LibreTLS +version 3.3.0 or later
    The chosen library is a build-time requirement, and also a run-time requirement if you link against its shared version.
    • @@ -141,13 +145,13 @@ relevant page.

    TCP access control

    diff --git a/doc/libstls/index.html b/doc/libstls/index.html index 0983fef..3be3464 100644 --- a/doc/libstls/index.html +++ b/doc/libstls/index.html @@ -24,8 +24,11 @@ libstls is a small support library for the s6-tlsc and s6-tlsd executables when they're built -against the LibreSSL -backend. You can use it in your own programs, but since +against the libtls API, whether that API is implemented via +LibreSSL or via +OpenSSL with the addition of +LibreTLS. +You can use it in your own programs, but since libtls is already relatively high-level, it's probably not very useful.

    @@ -42,7 +45,8 @@ and the tls.h header, are visible in your header search path.
    • Make sure the s6-networking libraries, as well as the skalibs -libraries, and the LibreSSL libraries, are visible in your library search path.
      • +libraries, and the libraries needed by libtls, are visible in your +library search path.
    • Link against -lstls, -lskarnet, -ltls, -lssl, -lcrypto, `cat $sysdeps/socket.lib`, `cat $sysdeps/spawn.lib`, and diff --git a/doc/upgrade.html b/doc/upgrade.html index eabebb6..4df1cb7 100644 --- a/doc/upgrade.html +++ b/doc/upgrade.html @@ -21,8 +21,12 @@

      in 2.4.0.0

        +
      • OpenSSL plus +LibreTLS +can now be used as a backend, since LibreTLS provides an +implementation of the libtls API.
      • skalibs -dependency bumped to 2.9.4.0.
        • +dependency bumped to 2.10.0.0.
      • execline has been made optional. It's still enabled by default; disabling it with the --disable-execline configure option disables diff --git a/src/tls/s6-tlsserver.c b/src/tls/s6-tlsserver.c index fe493ad..0a6ae78 100644 --- a/src/tls/s6-tlsserver.c +++ b/src/tls/s6-tlsserver.c @@ -6,7 +6,7 @@ #include #include #include -#include +#include #include -- cgit v1.3.1