summaryrefslogtreecommitdiff
path: root/src/include
AgeCommit message (Collapse)Author
2023-11-17 Small sbearssl_run pass, should work nowLaurent Bercot
Signed-off-by: Laurent Bercot <ska@appnovation.com>
2023-11-16 Add -J and -j to the TLS tools to check for peer close_notify.Laurent Bercot
Also, and more importantly, significantly rewrite stls_run() for better full-duplex support. This implementation isn't fully tested yet. Signed-off-by: Laurent Bercot <ska@appnovation.com>
2023-11-11 New and fixed version of sbearssl_runLaurent Bercot
Signed-off-by: Laurent Bercot <ska@appnovation.com>
2022-10-14 Bring libsbearssl doc up to date.Laurent Bercot
Also fix a typo in sbearssl.h Signed-off-by: Laurent Bercot <ska@appnovation.com>
2022-10-07 Add workaround to bearssl regression with BR_FEATURE_X509_TIME_CALLBACKLaurent Bercot
Signed-off-by: Laurent Bercot <ska@appnovation.com>
2021-11-19 Add sbearssl_*_set_tain(n)_g convenience macrosLaurent Bercot
Signed-off-by: Laurent Bercot <ska@appnovation.com>
2021-08-10 Adapt to skalibs-2.11.0.0Laurent Bercot
Signed-off-by: Laurent Bercot <ska@appnovation.com>
2021-06-02 Debug session. Now works.Laurent Bercot
The environment given to the application still needs to be cleaned up of SNI variables.
2021-06-01 Add servername to storagedevLaurent Bercot
2021-06-01 Add all the missing pieces for sni_policyLaurent Bercot
sbearssl_server_init_and_run is yet unchanged, the next step is to rewrite it using the new primitives.
2021-05-30 Start work on bearssl server-side sniLaurent Bercot
2021-05-20 Debugging iterationLaurent Bercot
2021-05-20 Add an x509 engine wrapping minimal. NOT FUNCTIONAL, FOR TESTING.Laurent Bercot
2021-05-18 Prepare for 2.4.2.0; implement client certificates with bearsslLaurent Bercot
Also send a bit more environment with libtls
2021-01-13 Implement handshake timeout for libtls backendLaurent Bercot
2020-12-07 Change -K semantics: timeout *during handshake*, not afterwardsLaurent Bercot
- the TLS tunnel itself should be transparent so it has no business shutting down the connection no matter how long the app takes - there's still an undetectable situation on some kernels where EOF doesn't get transmitted from the network, and the engine is in the handshake, and it can't do anything but wait forever. A timeout is useful here: dawg, your peer is never going to send any more data, you should just give up. - if the situation happens after the handshake, the *app* should have a timeout and die. The tunnel will follow suit. - libtls has a blocking tls_handshake() blackbox, we cannot give it a timeout. Too bad, use bearssl.
2020-11-22 Add SSL_PROTOCOL and SSL_CIPHER support, fix some bugsLaurent Bercot
2020-11-20 Refactor tls code to support ucspi-tlsLaurent Bercot
That includes: - new architecture: the tls binary is now a child of the app instead of the other way around - the sbearssl_run engine now takes a post-handshake callback. This allows s6-tlsc and s6-tlsd to only exec into the app when the handshake succeeds (which was already the case with libressl). - new binaries s6-tlsc-io and s6-tlsd-io encapsulate the crypto code; they init and run the engine, connecting to 4 already open fds (stdin/stdout = network, argv[1] and argv[2] = local) - s6-tlsc is now a simple wrapper around s6-tlsc-io - s6-tlsd is now a simple wrapper around s6-tlsd-io - new binary: s6-ucspitlsd, which is also a wrapper around s6-tlsd-io, but differently: the parent execs the app which should be ucspi-tls-aware, the child waits for a command from the parent and execs into s6-tlsd-io if it receives it.
2017-03-22 Fix case where s6-tls[cd] would sometimes not detect an application and ↵Laurent Bercot
remain there forever with its zombie, both condemned to err in limbo for all eternity, the living and the dead, hand in hand
2017-03-12 Adapt to skalibs-2.5.0.0Laurent Bercot
2017-01-30 Delay client cert support, but make s6-networking build against bearssl-0.3Laurent Bercot
2017-01-10 Types fix, first passLaurent Bercot
XXX marks what must change when skalibs changes. Also started writing functions for client certificate support in sbearssl, but it's not working yet (need more high-level support from BearSSL before it can work)
2016-12-04 Remove s6-tls* dependency to libs6net. Improve gen-deps to make dynlinking ↵Laurent Bercot
easier.
2016-11-30 sbearssl: allow DER-encoded certificates in TA directoryLaurent Bercot
2016-11-26 Add -z option to s6-tlsc/s6-tlsd to clean TLS env vars before spawning ↵Laurent Bercot
(default)
2016-11-25 Add EC certificate issuer key type detection for sbearsslLaurent Bercot
2016-11-25 Fix build bugs. It builds!Laurent Bercot
Two things remain to do: - how to pass SNI information to libtls - how to detect cert issuer key type for ECC in bearssl
2016-11-25 Alpha version of the SSL work.Laurent Bercot
Doesn't build yet, but I'm scared of losing it, so using git as storage. Will fix the stupid bugs now, the tricky bugs later.
2015-01-15 Move Unix domain socket and access control stuff to s6.Laurent Bercot
Move seekablepipe to s6-portable-utils. Version: 2.0.1.0, release candidate
2014-12-15 Initial commitLaurent Bercot