From f7e676abdc799fcee5138807447b5e91ab05508f Mon Sep 17 00:00:00 2001 From: Laurent Bercot Date: Mon, 7 Dec 2020 12:53:54 +0000 Subject: Change -K semantics: timeout *during handshake*, not afterwards - the TLS tunnel itself should be transparent so it has no business shutting down the connection no matter how long the app takes - there's still an undetectable situation on some kernels where EOF doesn't get transmitted from the network, and the engine is in the handshake, and it can't do anything but wait forever. A timeout is useful here: dawg, your peer is never going to send any more data, you should just give up. - if the situation happens after the handshake, the *app* should have a timeout and die. The tunnel will follow suit. - libtls has a blocking tls_handshake() blackbox, we cannot give it a timeout. Too bad, use bearssl. --- src/include/s6-networking/stls.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'src/include') diff --git a/src/include/s6-networking/stls.h b/src/include/s6-networking/stls.h index e4ef28a..65bb950 100644 --- a/src/include/s6-networking/stls.h +++ b/src/include/s6-networking/stls.h @@ -8,7 +8,6 @@ #include #include -#include #define STLS_BUFSIZE (16384 + 325 + 1) @@ -16,7 +15,7 @@ /* Engine */ extern int stls_send_environment (struct tls *, int) ; -extern void stls_run (struct tls *, int *, tain_t const *, uint32_t, unsigned int) gccattr_noreturn ; +extern void stls_run (struct tls *, int *, uint32_t, unsigned int) gccattr_noreturn ; /* s6-tlsc-io and s6-tlsd-io */ -- cgit v1.3.1