summaryrefslogtreecommitdiff
path: root/src
AgeCommit message (Collapse)Author
2020-12-09 Get rid of webipc.hLaurent Bercot
2020-12-07 Change -K semantics: timeout *during handshake*, not afterwardsLaurent Bercot
- the TLS tunnel itself should be transparent so it has no business shutting down the connection no matter how long the app takes - there's still an undetectable situation on some kernels where EOF doesn't get transmitted from the network, and the engine is in the handshake, and it can't do anything but wait forever. A timeout is useful here: dawg, your peer is never going to send any more data, you should just give up. - if the situation happens after the handshake, the *app* should have a timeout and die. The tunnel will follow suit. - libtls has a blocking tls_handshake() blackbox, we cannot give it a timeout. Too bad, use bearssl.
2020-11-30 Fix build with skalibs 2.10.0.0; document dependenciesLaurent Bercot
2020-11-26 Convert to new exec.h syntaxLaurent Bercot
2020-11-26 That exit condition is really hard to get right >.>Laurent Bercot
2020-11-26 Fix engine exit condition for sbearsslLaurent Bercot
2020-11-23 minidentd QoL fixLaurent Bercot
2020-11-23 stls client: prefer CAFILE, warn on CADIR use, because libtls is brokenLaurent Bercot
2020-11-23 Fix more bugs; disable renegociation in bearssl clientLaurent Bercot
2020-11-22 Fix a few bugs. sbearssl appears to be working.Laurent Bercot
2020-11-22 Add SSL_PROTOCOL and SSL_CIPHER support, fix some bugsLaurent Bercot
2020-11-22 Add documentation, fix tiny privdrop bugLaurent Bercot
2020-11-21 Move all tls stuff into its own subdirLaurent Bercot
2020-11-21 Add s6-ucspitlscLaurent Bercot
2020-11-21 Prepare for 2.4.0.0Laurent Bercot
2020-11-21 Privs can only be dropped after reading key files.Laurent Bercot
2020-11-20 Refactor tls code to support ucspi-tlsLaurent Bercot
That includes: - new architecture: the tls binary is now a child of the app instead of the other way around - the sbearssl_run engine now takes a post-handshake callback. This allows s6-tlsc and s6-tlsd to only exec into the app when the handshake succeeds (which was already the case with libressl). - new binaries s6-tlsc-io and s6-tlsd-io encapsulate the crypto code; they init and run the engine, connecting to 4 already open fds (stdin/stdout = network, argv[1] and argv[2] = local) - s6-tlsc is now a simple wrapper around s6-tlsc-io - s6-tlsd is now a simple wrapper around s6-tlsd-io - new binary: s6-ucspitlsd, which is also a wrapper around s6-tlsd-io, but differently: the parent execs the app which should be ucspi-tls-aware, the child waits for a command from the parent and execs into s6-tlsd-io if it receives it.
2020-05-06 Add -e option to s6-tlsserverLaurent Bercot
2019-09-21 Remove tainnow.lib dependencyLaurent Bercot
2019-09-06 Adapt to new stopwatch APILaurent Bercot
2019-09-04 Use stopwatches and wallclocks where appropriateLaurent Bercot
2019-05-14 Different code style for the maxconn spurious warning avoidanceLaurent Bercot
2019-02-20 Adapt to skalibs/posixishard.hLaurent Bercot
2018-10-06 bugfix: have s6-tcpserver?d write localport to stdout on notifLaurent Bercot
and not just a newline.
2018-08-01 Add nsss supportLaurent Bercot
2018-07-21 Adapt to skalibs-2.7.0.0, prepare for 2.3.0.3Laurent Bercot
2018-04-11change localip is6 flag based on destination ipJohn Regan
By default, the localip flag is initialized with the is6 flag set to 0. The only time the flag is changed to 1 is when a user specifies a local IPv6 address to use. Because of this, socket_tcp46 always creates an IPv4 socket. This patch corrects that - if the user hasn't specified a local address, then the local 'is6' flag is updated to match the destination 'is6' flag. Signed-off-by: Laurent Bercot <ska-skaware@skarnet.org>
2018-04-11 Add -B (blocking) option to s6-tcpserver?-socketbinderLaurent Bercot
2017-09-13 bugfix: spurious error message in s6-tcpserver?d when maxed connectionsLaurent Bercot
2017-08-28 Moderately big hammer: force kill on s6-tlsd when it has nothing to write ↵Laurent Bercot
to the network
2017-08-28 Revert big hammer. Data still needs to be flushed to the network even when ↵Laurent Bercot
the local app dies.
2017-08-22 Optimize to xpathexec ; prepare for 2.3.0.2Laurent Bercot
2017-06-29 Fix error messages in stls_s6tls?.c when setting key fileLaurent Bercot
2017-05-11 Explicitly make s6-tls[cd] die when the app diesLaurent Bercot
I have no explanation for the fact that they sometimes survive their app, and I'm fed up with it, so it's time to use the big hammer.
2017-03-22 Fix case where s6-tls[cd] would sometimes not detect an application and ↵Laurent Bercot
remain there forever with its zombie, both condemned to err in limbo for all eternity, the living and the dead, hand in hand
2017-03-15 Fix memcpy size in s6-tcpserver6dLaurent Bercot
2017-03-14 Cleanup superfluous includesLaurent Bercot
2017-03-12 Adapt to skalibs-2.5.0.0Laurent Bercot
2017-01-30 Delay client cert support, but make s6-networking build against bearssl-0.3Laurent Bercot
2017-01-22 Fix variable scope in sbearssl_ta_certsLaurent Bercot
2017-01-10 Types fix, first passLaurent Bercot
XXX marks what must change when skalibs changes. Also started writing functions for client certificate support in sbearssl, but it's not working yet (need more high-level support from BearSSL before it can work)
2016-12-14 sbearssl: follow API change for br_x590_trust_anchorLaurent Bercot
2016-12-04 Fix sbearssl buildLaurent Bercot
2016-12-04 Remove s6-tls* dependency to libs6net. Improve gen-deps to make dynlinking ↵Laurent Bercot
easier.
2016-12-03 s6-tls*: small bugfixes. Add documentation.Laurent Bercot
2016-12-02 Fix closing bugs in sbearssl_run and tls_runLaurent Bercot
2016-12-01 Fix several bugs in stls, make the engine workLaurent Bercot
2016-11-30 sbearssl: allow DER-encoded certificates in TA directoryLaurent Bercot
2016-11-28 Small sbearssl bugfixes and usability messagesLaurent Bercot
2016-11-27 Fix double close in sbearssl_cert_readfileLaurent Bercot
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-14 20:15:18 +0000