From 4fb917263ac30373cb3e5dfe3e207369eb238def Mon Sep 17 00:00:00 2001 From: Laurent Bercot Date: Sun, 22 Nov 2020 15:46:34 +0000 Subject: Add SSL_PROTOCOL and SSL_CIPHER support, fix some bugs --- src/include/s6-networking/sbearssl.h | 7 ++ src/include/s6-networking/stls.h | 1 + src/sbearssl/deps-lib/sbearssl | 8 +- src/sbearssl/sbearssl-internal.h | 51 ++++++++ src/sbearssl/sbearssl_send_environment.c | 31 +++++ src/sbearssl/sbearssl_suite_bits.c | 16 +++ src/sbearssl/sbearssl_suite_list.c | 201 +++++++++++++++++++++++++++++++ src/sbearssl/sbearssl_suite_name.c | 14 +++ src/stls/deps-lib/stls | 1 + src/stls/stls_send_environment.c | 24 ++++ src/tls/deps-lib/s6tls | 1 + src/tls/s6-tlsc-io.c | 33 ++--- src/tls/s6-tlsd-io.c | 33 ++--- 13 files changed, 376 insertions(+), 45 deletions(-) create mode 100644 src/sbearssl/sbearssl_send_environment.c create mode 100644 src/sbearssl/sbearssl_suite_bits.c create mode 100644 src/sbearssl/sbearssl_suite_list.c create mode 100644 src/sbearssl/sbearssl_suite_name.c create mode 100644 src/stls/stls_send_environment.c (limited to 'src') diff --git a/src/include/s6-networking/sbearssl.h b/src/include/s6-networking/sbearssl.h index 9fb8792..5527696 100644 --- a/src/include/s6-networking/sbearssl.h +++ b/src/include/s6-networking/sbearssl.h @@ -34,6 +34,12 @@ extern int sbearssl_x509_minimal_set_tai (br_x509_minimal_context *, tai_t const #define sbearssl_x509_minimal_set_tain(ctx, a) sbearssl_x509_minimal_set_tai(ctx, tain_secp(a)) + /* Cipher suites */ + +extern char const *sbearssl_suite_name (br_ssl_session_parameters const *) ; +extern uint16_t bearssl_suite_bits (br_ssl_session_parameters const *) ; + + /* Certificates (x509-encoded) */ typedef struct sbearssl_cert_s sbearssl_cert, *sbearssl_cert_ref ; @@ -214,6 +220,7 @@ struct sbearssl_handshake_cb_context_s typedef int sbearssl_handshake_cb_t (br_ssl_engine_context *, sbearssl_handshake_cb_context_t *) ; typedef sbearssl_handshake_cb_t *sbearssl_handshake_cb_t_ref ; +extern int sbearssl_send_environment (br_ssl_engine_context *, int) ; extern void sbearssl_run (br_ssl_engine_context *, int *, tain_t const *, uint32_t, unsigned int, sbearssl_handshake_cb_t_ref, sbearssl_handshake_cb_context_t *) gccattr_noreturn ; diff --git a/src/include/s6-networking/stls.h b/src/include/s6-networking/stls.h index 76acdd8..e4ef28a 100644 --- a/src/include/s6-networking/stls.h +++ b/src/include/s6-networking/stls.h @@ -15,6 +15,7 @@ /* Engine */ +extern int stls_send_environment (struct tls *, int) ; extern void stls_run (struct tls *, int *, tain_t const *, uint32_t, unsigned int) gccattr_noreturn ; diff --git a/src/sbearssl/deps-lib/sbearssl b/src/sbearssl/deps-lib/sbearssl index 13df389..dfa4f29 100644 --- a/src/sbearssl/deps-lib/sbearssl +++ b/src/sbearssl/deps-lib/sbearssl @@ -3,6 +3,7 @@ sbearssl_cert_from.o sbearssl_cert_readbigpem.o sbearssl_cert_readfile.o sbearssl_cert_to.o +sbearssl_client_init_and_run.o sbearssl_drop.o sbearssl_ec_issuer_keytype.o sbearssl_ec_pkey_from.o @@ -21,9 +22,14 @@ sbearssl_rsa_pkey_to.o sbearssl_rsa_skey_from.o sbearssl_rsa_skey_to.o sbearssl_run.o +sbearssl_send_environment.o +sbearssl_server_init_and_run.o sbearssl_skey_from.o sbearssl_skey_readfile.o sbearssl_skey_to.o +sbearssl_suite_bits.o +sbearssl_suite_list.o +sbearssl_suite_name.o sbearssl_ta_cert.o sbearssl_ta_certs.o sbearssl_ta_from.o @@ -33,7 +39,5 @@ sbearssl_ta_to.o sbearssl_x500_name_len.o sbearssl_x500_from_ta.o sbearssl_x509_minimal_set_tai.o -sbearssl_client_init_and_run.o -sbearssl_server_init_and_run.o -lbearssl -lskarnet diff --git a/src/sbearssl/sbearssl-internal.h b/src/sbearssl/sbearssl-internal.h index 2d98680..bfaad73 100644 --- a/src/sbearssl/sbearssl-internal.h +++ b/src/sbearssl/sbearssl-internal.h @@ -5,9 +5,12 @@ #include #include + #include + #include #include + #include typedef struct sbearssl_strallocerr_s sbearssl_strallocerr, *sbearssl_strallocerr_ref ; @@ -17,8 +20,56 @@ struct sbearssl_strallocerr_s int err ; } ; +typedef enum sbearssl_suite_prop_e sbearssl_suite_prop ; +enum sbearssl_suite_prop_e +{ + /* key exchange */ + kRSA = 1<<0, + ECDHE = 1<<1, + + /* authentication */ + aRSA = 1<<2, + ECDSA = 1<<3, + + /* encryption */ + TRIPLEDES = 1<<4, + AES128 = 1<<5, + AES256 = 1<<6, + AESGCM = 1<<7, + AESCCM = 1<<8, + AESCCM8 = 1<<9, + CHACHA20 = 1<<10, + + /* MAC */ + AEAD = 1<<11, + SHA1 = 1<<12, + SHA256 = 1<<13, + SHA384 = 1<<14, + + /* minimum TLS version */ + TLS10 = 1<<15, + TLS12 = 1<<16, + + /* strength */ + HIGH = 1<<17, + MEDIUM = 1<<18, + LOW = 1<<19, +} ; + +typedef struct sbearssl_suiteinfo_s sbearssl_suiteinfo, *sbearssl_suiteinfo_ref ; +struct sbearssl_suiteinfo_s +{ + char name[32] ; + uint16_t id ; + sbearssl_suite_prop prop ; + uint16_t bits ; +} ; + extern void sbearssl_drop (void) ; extern void sbearssl_append (void *, void const *, size_t) ; extern int sbearssl_pem_push (br_pem_decoder_context *, char const *, size_t, sbearssl_pemobject *, genalloc *, sbearssl_strallocerr *, int *) ; +extern sbearssl_suiteinfo const *const sbearssl_suite_list ; +extern size_t const sbearssl_suite_list_len ; + #endif diff --git a/src/sbearssl/sbearssl_send_environment.c b/src/sbearssl/sbearssl_send_environment.c new file mode 100644 index 0000000..3e1f1e1 --- /dev/null +++ b/src/sbearssl/sbearssl_send_environment.c @@ -0,0 +1,31 @@ +/* ISC license. */ + +#include +#include + +#include + +#include + +int sbearssl_send_environment (br_ssl_engine_context *ctx, int fd) +{ + char buf[4096] ; + buffer b = BUFFER_INIT(&buffer_write, fd, buf, 4096) ; + unsigned int v = br_ssl_engine_get_version(ctx) ; + char const *suite ; + br_ssl_session_parameters params ; + + br_ssl_engine_get_session_parameters(ctx, ¶ms) ; + suite = sbearssl_suite_name(¶ms) ; + byte_zzero((char *)params.master_secret, 48) ; + if (!suite) suite = "" ; + + if (buffer_puts(&b, "SSL_PROTOCOL=") < 0 + || buffer_puts(&b, v == BR_TLS12 ? "TLSv1.2" : v == BR_TLS11 ? "TLSv1.1" : v == BR_TLS10 ? "TLSv1" : "unknown") < 0 + || buffer_put(&b, "", 1) < 0 + || buffer_puts(&b, "SSL_CIPHER=") < 0 + || buffer_puts(&b, suite) < 0 + || buffer_putflush(&b, "\0", 2) < 0) + return 0 ; + return 1 ; +} diff --git a/src/sbearssl/sbearssl_suite_bits.c b/src/sbearssl/sbearssl_suite_bits.c new file mode 100644 index 0000000..8e2584e --- /dev/null +++ b/src/sbearssl/sbearssl_suite_bits.c @@ -0,0 +1,16 @@ +/* ISC license. */ + +#include + +#include + +#include +#include "sbearssl-internal.h" + +uint16_t sbearssl_suite_bits (br_ssl_session_parameters const *params) +{ + for (size_t i = 0 ; i < sbearssl_suite_list_len ; i++) + if (sbearssl_suite_list[i].id == params->cipher_suite) + return sbearssl_suite_list[i].bits ; + return 0 ; +} diff --git a/src/sbearssl/sbearssl_suite_list.c b/src/sbearssl/sbearssl_suite_list.c new file mode 100644 index 0000000..b51c480 --- /dev/null +++ b/src/sbearssl/sbearssl_suite_list.c @@ -0,0 +1,201 @@ +/* ISC license. */ + +/* Copied from Michael Forney's libtls-bearssl */ + +#include "sbearssl-internal.h" + +static sbearssl_suiteinfo const sbearssl_suite_list_[] = +{ + { + "ECDHE-ECDSA-CHACHA20-POLY1305", + BR_TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, + ECDHE|ECDSA|CHACHA20|AEAD|TLS12|HIGH, + 256, + }, + { + "ECDHE-RSA-CHACHA20-POLY1305", + BR_TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, + ECDHE|aRSA|CHACHA20|AEAD|TLS12|HIGH, + 256, + }, + { + "ECDHE-ECDSA-AES128-GCM-SHA256", + BR_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, + ECDHE|ECDSA|AES128|AESGCM|AEAD|TLS12|HIGH, + 128, + }, + { + "ECDHE-RSA-AES128-GCM-SHA256", + BR_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, + ECDHE|aRSA|AES128|AESGCM|AEAD|TLS12|HIGH, + 128, + }, + { + "ECDHE-ECDSA-AES256-GCM-SHA384", + BR_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, + ECDHE|ECDSA|AES256|AESGCM|AEAD|TLS12|HIGH, + 256, + }, + { + "ECDHE-RSA-AES256-GCM-SHA384", + BR_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, + ECDHE|aRSA|AES256|AESGCM|AEAD|TLS12|HIGH, + 256, + }, + { + "ECDHE-ECDSA-AES128-CCM", + BR_TLS_ECDHE_ECDSA_WITH_AES_128_CCM, + ECDHE|ECDSA|AES128|AESCCM|AEAD|TLS12|HIGH, + 128, + }, + { + "ECDHE-ECDSA-AES256-CCM", + BR_TLS_ECDHE_ECDSA_WITH_AES_256_CCM, + ECDHE|ECDSA|AES256|AESCCM|AEAD|TLS12|HIGH, + 256, + }, + { + "ECDHE-ECDSA-AES128-CCM8", + BR_TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8, + ECDHE|ECDSA|AES128|AESCCM8|AEAD|TLS12|HIGH, + 128, + }, + { + "ECDHE-ECDSA-AES256-CCM8", + BR_TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8, + ECDHE|ECDSA|AES256|AESCCM8|AEAD|TLS12|HIGH, + 256, + }, + { + "ECDHE-ECDSA-AES128-SHA256", + BR_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, + ECDHE|ECDSA|AES128|SHA256|TLS12|HIGH, + 128, + }, + { + "ECDHE-RSA-AES128-SHA256", + BR_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, + ECDHE|aRSA|AES128|SHA256|TLS12|HIGH, + 128, + }, + { + "ECDHE-ECDSA-AES256-SHA384", + BR_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, + ECDHE|ECDSA|AES256|SHA384|TLS12|HIGH, + 256, + }, + { + "ECDHE-RSA-AES256-SHA384", + BR_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, + ECDHE|aRSA|AES256|SHA384|TLS12|HIGH, + 256, + }, + { + "ECDHE-ECDSA-AES128-SHA", + BR_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, + ECDHE|ECDSA|AES128|SHA1|TLS10|HIGH, + 128, + }, + { + "ECDHE-RSA-AES128-SHA", + BR_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, + ECDHE|aRSA|AES128|SHA1|TLS10|HIGH, + 128, + }, + { + "ECDHE-ECDSA-AES256-SHA", + BR_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, + ECDHE|ECDSA|AES256|SHA1|TLS10|HIGH, + 256, + }, + { + "ECDHE-RSA-AES256-SHA", + BR_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, + ECDHE|aRSA|AES256|SHA1|TLS10|HIGH, + 256, + }, + /* ECDH suites, used in BearSSL "full" profile do + * not have corresponding OpenSSL + */ + { + "AES128-GCM-SHA256", + BR_TLS_RSA_WITH_AES_128_GCM_SHA256, + kRSA|aRSA|AES128|AESGCM|SHA256|TLS12|HIGH, + 128, + }, + { + "AES256-GCM-SHA384", + BR_TLS_RSA_WITH_AES_256_GCM_SHA384, + kRSA|aRSA|AES256|AESGCM|SHA384|TLS12|HIGH, + 256, + }, + { + "AES128-CCM", + BR_TLS_RSA_WITH_AES_128_CCM, + kRSA|aRSA|AES128|AESCCM|TLS12|HIGH, + 128, + }, + { + "AES256-CCM", + BR_TLS_RSA_WITH_AES_256_CCM, + kRSA|aRSA|AES256|AESCCM|TLS12|HIGH, + 256, + }, + { + "AES128-CCM8", + BR_TLS_RSA_WITH_AES_128_CCM_8, + kRSA|aRSA|AES128|AESCCM8|TLS12|HIGH, + 128, + }, + { + "AES256-CCM8", + BR_TLS_RSA_WITH_AES_256_CCM_8, + kRSA|aRSA|AES256|AESCCM8|TLS12|HIGH, + 256, + }, + { + "AES128-SHA256", + BR_TLS_RSA_WITH_AES_128_CBC_SHA256, + kRSA|aRSA|AES128|SHA256|TLS12|HIGH, + 128, + }, + { + "AES256-SHA256", + BR_TLS_RSA_WITH_AES_256_CBC_SHA256, + kRSA|aRSA|AES256|SHA256|TLS12|HIGH, + 256, + }, + { + "AES128-SHA", + BR_TLS_RSA_WITH_AES_128_CBC_SHA, + kRSA|aRSA|AES128|SHA1|TLS10|HIGH, + 128, + }, + { + "AES256-SHA", + BR_TLS_RSA_WITH_AES_256_CBC_SHA, + kRSA|aRSA|AES256|SHA1|TLS10|HIGH, + 256, + }, + { + "ECDHE-ECDSA-DES-CBC3-SHA", + BR_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, + ECDHE|ECDSA|TRIPLEDES|SHA1|TLS10|MEDIUM, + 112, + }, + { + "ECDHE-RSA-DES-CBC3-SHA", + BR_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, + ECDHE|aRSA|TRIPLEDES|SHA1|TLS10|MEDIUM, + 112, + }, + { + "DES-CBC3-SHA", + BR_TLS_RSA_WITH_3DES_EDE_CBC_SHA, + kRSA|aRSA|TRIPLEDES|SHA1|TLS10|MEDIUM, + 112, + }, +}; + +sbearssl_suiteinfo const *const sbearssl_suite_list = sbearssl_suite_list_ ; +size_t const sbearssl_suite_list_len = sizeof(sbearssl_suite_list_) / sizeof(sbearssl_suiteinfo) ; diff --git a/src/sbearssl/sbearssl_suite_name.c b/src/sbearssl/sbearssl_suite_name.c new file mode 100644 index 0000000..97cc593 --- /dev/null +++ b/src/sbearssl/sbearssl_suite_name.c @@ -0,0 +1,14 @@ +/* ISC license. */ + +#include + +#include +#include "sbearssl-internal.h" + +char const *sbearssl_suite_name (br_ssl_session_parameters const *params) +{ + for (size_t i = 0 ; i < sbearssl_suite_list_len ; i++) + if (sbearssl_suite_list[i].id == params->cipher_suite) + return sbearssl_suite_list[i].name ; + return 0 ; +} diff --git a/src/stls/deps-lib/stls b/src/stls/deps-lib/stls index 9416332..615ce3b 100644 --- a/src/stls/deps-lib/stls +++ b/src/stls/deps-lib/stls @@ -2,5 +2,6 @@ stls_drop.o stls_run.o stls_client_init_and_handshake.o stls_server_init_and_handshake.o +stls_send_environment.o ${CRYPTO_LIB} -lskarnet diff --git a/src/stls/stls_send_environment.c b/src/stls/stls_send_environment.c new file mode 100644 index 0000000..1c13602 --- /dev/null +++ b/src/stls/stls_send_environment.c @@ -0,0 +1,24 @@ +/* ISC license. */ + +#include +#include + +#include + +#include + +#include + +int stls_send_environment (struct tls *ctx, int fd) +{ + char buf[4096] ; + buffer b = BUFFER_INIT(&buffer_write, fd, buf, 4096) ; + if (buffer_puts(&b, "SSL_PROTOCOL=") < 0 + || buffer_puts(&b, tls_conn_version(ctx)) < 0 + || buffer_put(&b, "", 1) < 0 + || buffer_puts(&b, "SSL_CIPHER=") < 0 + || buffer_puts(&b, tls_conn_cipher(ctx)) < 0 + || buffer_putflush(&b, "\0", 2) < 0) + return 0 ; + return 1 ; +} diff --git a/src/tls/deps-lib/s6tls b/src/tls/deps-lib/s6tls index f392de5..caa9872 100644 --- a/src/tls/deps-lib/s6tls +++ b/src/tls/deps-lib/s6tls @@ -2,3 +2,4 @@ s6tls_exec_tlscio.o s6tls_exec_tlsdio.o s6tls_sync_and_exec_app.o s6tls_ucspi_exec_app.o +-lskarnet diff --git a/src/tls/s6-tlsc-io.c b/src/tls/s6-tlsc-io.c index 79dd25d..48965cc 100644 --- a/src/tls/s6-tlsc-io.c +++ b/src/tls/s6-tlsc-io.c @@ -1,22 +1,20 @@ /* ISC license. */ #include -#include #include #include #include #include #include -#include #include -#include #include #include #include -#define HANDSHAKE_BANNER "SSL_PROTOCOL=TLSv1\0" +#define USAGE "s6-tlsc-io [ -v verbosity ] [ -d notif ] [ -S | -s ] [ -Y | -y ] [ -K timeout ] [ -k servername ] fdr fdw" +#define dieusage() strerr_dieusage(100, USAGE) static inline void doit (int *, tain_t const *tto, uint32_t, uint32_t, unsigned int, char const *, unsigned int) gccattr_noreturn ; @@ -29,7 +27,7 @@ static inline void doit (int *fds, tain_t const *tto, uint32_t preoptions, uint3 struct tls *ctx = stls_client_init_and_handshake(fds + 2, preoptions, servername) ; if (notif) { - if (allwrite(notif, HANDSHAKE_BANNER, sizeof(HANDSHAKE_BANNER)) < sizeof(HANDSHAKE_BANNER)) + if (!stls_send_environment(ctx, notif)) strerr_diefu1sys(111, "write post-handshake data") ; fd_close(notif) ; } @@ -39,22 +37,19 @@ static inline void doit (int *fds, tain_t const *tto, uint32_t preoptions, uint3 #else #ifdef S6_NETWORKING_USE_BEARSSL +#include + #include #include -static int handshake_cb_nop (br_ssl_engine_context *ctx, sbearssl_handshake_cb_context_t *cbarg) -{ - (void)ctx ; - (void)cbarg ; - return 1 ; -} - -static int handshake_cb_sendvars (br_ssl_engine_context *ctx, sbearssl_handshake_cb_context_t *cbarg) +static int handshake_cb (br_ssl_engine_context *ctx, sbearssl_handshake_cb_context_t *cbarg) { - if (allwrite(cbarg->notif, HANDSHAKE_BANNER, sizeof(HANDSHAKE_BANNER)) < sizeof(HANDSHAKE_BANNER)) - return 0 ; - fd_close(cbarg->notif) ; + if (cbarg->notif) + { + if (!sbearssl_send_environment(ctx, cbarg->notif)) return 0 ; + fd_close(cbarg->notif) ; + } return 1 ; } @@ -63,7 +58,7 @@ static inline void doit (int *fds, tain_t const *tto, uint32_t preoptions, uint3 if (ndelay_on(fds[0]) < 0 || ndelay_on(fds[1]) < 0) strerr_diefu1sys(111, "set local fds non-blocking") ; if (!random_init()) strerr_diefu1sys(111, "initialize random device") ; - sbearssl_client_init_and_run(fds, tto, preoptions, options, verbosity, servername, notif ? &handshake_cb_sendvars : &handshake_cb_nop, notif) ; + sbearssl_client_init_and_run(fds, tto, preoptions, options, verbosity, servername, &handshake_cb, notif) ; } #else @@ -73,10 +68,6 @@ static inline void doit (int *fds, tain_t const *tto, uint32_t preoptions, uint3 #endif #endif - -#define USAGE "s6-tlsc-io [ -v verbosity ] [ -d notif ] [ -S | -s ] [ -Y | -y ] [ -K timeout ] [ -k servername ] fdr fdw" -#define dieusage() strerr_dieusage(100, USAGE) - int main (int argc, char const *const *argv, char const *const *envp) { char const *servername = 0 ; diff --git a/src/tls/s6-tlsd-io.c b/src/tls/s6-tlsd-io.c index 0b42b3b..14003a2 100644 --- a/src/tls/s6-tlsd-io.c +++ b/src/tls/s6-tlsd-io.c @@ -1,22 +1,20 @@ /* ISC license. */ #include -#include #include #include #include #include #include -#include -#include #include -#include +#include #include #include -#define HANDSHAKE_BANNER "SSL_PROTOCOL=TLSv1\0" +#define USAGE "s6-tlsd-io [ -v verbosity ] [ -d notif ] [ -S | -s ] [ -Y | -y ] [ -K timeout ] fdr fdw" +#define dieusage() strerr_dieusage(100, USAGE) static inline void doit (int *, tain_t const *tto, uint32_t, uint32_t, unsigned int, unsigned int) gccattr_noreturn ; @@ -29,7 +27,7 @@ static inline void doit (int *fds, tain_t const *tto, uint32_t preoptions, uint3 struct tls *ctx = stls_server_init_and_handshake(fds + 2, preoptions) ; if (notif) { - if (allwrite(notif, HANDSHAKE_BANNER, sizeof(HANDSHAKE_BANNER)) < sizeof(HANDSHAKE_BANNER)) + if (!stls_send_environment(ctx, notif)) strerr_diefu1sys(111, "write post-handshake data") ; fd_close(notif) ; } @@ -43,18 +41,13 @@ static inline void doit (int *fds, tain_t const *tto, uint32_t preoptions, uint3 #include -static int handshake_cb_nop (br_ssl_engine_context *ctx, sbearssl_handshake_cb_context_t *cbarg) -{ - (void)ctx ; - (void)cbarg ; - return 1 ; -} - -static int handshake_cb_sendvars (br_ssl_engine_context *ctx, sbearssl_handshake_cb_context_t *cbarg) +static int handshake_cb (br_ssl_engine_context *ctx, sbearssl_handshake_cb_context_t *cbarg) { - if (allwrite(cbarg->notif, HANDSHAKE_BANNER, sizeof(HANDSHAKE_BANNER)) < sizeof(HANDSHAKE_BANNER)) - return 0 ; - fd_close(cbarg->notif) ; + if (cbarg->notif) + { + if (!sbearssl_send_environment(ctx, cbarg->notif)) return 0 ; + fd_close(cbarg->notif) ; + } return 1 ; } @@ -63,7 +56,7 @@ static inline void doit (int *fds, tain_t const *tto, uint32_t preoptions, uint3 if (ndelay_on(fds[0]) < 0 || ndelay_on(fds[1]) < 0) strerr_diefu1sys(111, "set local fds non-blocking") ; if (!random_init()) strerr_diefu1sys(111, "initialize random device") ; - sbearssl_server_init_and_run(fds, tto, preoptions, options, verbosity, notif ? &handshake_cb_sendvars : &handshake_cb_nop, notif) ; + sbearssl_server_init_and_run(fds, tto, preoptions, options, verbosity, &handshake_cb, notif) ; } #else @@ -73,10 +66,6 @@ static inline void doit (int *fds, tain_t const *tto, uint32_t preoptions, uint3 #endif #endif - -#define USAGE "s6-tlsd-io [ -v verbosity ] [ -d notif ] [ -S | -s ] [ -Y | -y ] [ -K timeout ] fdr fdw" -#define dieusage() strerr_dieusage(100, USAGE) - int main (int argc, char const *const *argv, char const *const *envp) { tain_t tto ; -- cgit v1.2.3