summaryrefslogtreecommitdiff
path: root/src/lib/libtls/tls_server.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Ensure that we clear the libssl error stack before we make a function calljsing2015-09-121-1/+3
| | | | | | | | | | that we will pass the result through tls_ssl_error() on failure. Otherwise we can end up reporting spurious errors due to their being unrelated errors already on the error stack. Spotted by Marko Kreen. ok beck@
* actually set return value to 0 on success.beck2015-09-111-1/+2
| | | | ok jsing@ who wears the cone of shame.
* Split tls_handshake() out from tls_accept/tls_connect. By doing this thejsing2015-09-101-30/+46
| | | | | | | | | | | | | | | tls_accept/tls_connect functions can be guaranteed to succeed or fail and will no longer return TLS_READ_AGAIN/TLS_WRITE_AGAIN. This also resolves the semantics of tls_accept_*. The tls_handshake() function now does I/O and can return TLS_READ_AGAIN/TLS_WRITE_AGAIN. Calls to tls_read() and tls_write() will trigger the handshake if it has not already completed, meaning that in many cases existing code will continue to work. Discussed over many coffees at l2k15. ok beck@ bluhm@
* Add support for preferring the server's cipher list or the client's cipherjsing2015-09-101-1/+5
| | | | | | | | list. Prefer the server's cipher list by default. Based on a diff from Kyle Thompson <jmp at giga dot moe>. ok beck@ bcook@
* Indent labels with a space so that diff -p is more friendly.jsing2015-09-091-3/+3
| | | | Requested by bluhm@
* Add client certificate support. Still needs a few tweaks but this willbeck2015-09-091-2/+9
| | | | | ride upcoming minor bump ok jsing@
* Only take ownership of a socket if we allocated it within libtls. If we arejsing2015-09-091-8/+2
| | | | | | passed a socket then the caller is responsible for closing it. ok bcook@
* Improve libtls error messages.jsing2015-08-271-9/+9
| | | | | | | | | | | | The tls_set_error() function previously stored the errno but did nothing with it. Change tls_set_error() to append the strerror(3) of the stored errno so that we include useful information regarding failures. Provide a tls_set_errorx() function that does not store the errno or include strerror(3) in the error message. Call this function instead of tls_set_error() for errors where the errno value has no useful meaning. With feedback from and ok doug@
* Unify error message between client and server.jsing2015-08-221-2/+2
|
* SSL_set_app_data is a macro for SSL_set_ex_data(), which is a wrapperjsing2015-08-221-3/+5
| | | | | around CRYPTO_set_ex_data(), which can fail. Since this is the case, check the return value of CRYPTO_set_ex_data^WSSL_set_ex_data^WSSL_set_app_data.
* Provide a tls_accept_fds() function, which allows a TLS connection to bejsing2015-03-311-5/+16
| | | | | | accepted via an existing pair of file descriptors. Based on a diff from Jan Klemkow.
* Store errors that occur during a tls_accept_socket() call on the contextjsing2015-03-311-2/+2
| | | | | | | for the server, rather than on the context for the connection. This makes more sense than the current behaviour does. Issue reported by Tim van der Molen.
* Convert tls_connect_fds() and tls_accept_socket() to the new OpenSSL errorjsing2015-02-071-11/+6
| | | | | | | dance handling code. This means that we get slightly useful messages when a TLS connection or accept fails. Requested by reyk@
* Add tls_config_set_dheparams() to allow specification of the parameters tojsing2015-02-071-5/+10
| | | | | | | | | use for DHE. This enables the use of DHE cipher suites. Rename tls_config_set_ecdhcurve() to tls_config_set_ecdhecurve() since it is only used to specify the curve for ephemeral ECDH. Discussed with reyk@
* Make the TLS connect and accept error messages consistent.bluhm2015-01-301-3/+2
| | | | OK jsing@
* The SSL/TLS session Id context is limited to 32 bytes. Instead ofreyk2015-01-161-1/+13
| | | | | | | | using the name of relayd relay or smtpd pki, use a 32 byte arc4random buffer that should be unique for the context. This fixes an issue in OpenSMTPD when a long pki name could break the configuration. OK gilles@ benno@
* Rename libressl to libtls to avoid confusion and to make it easier tojsing2014-10-311-0/+134
distinguish between LibreSSL (the project) and libressl (the library). Discussed with many.
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-04-26 20:33:12 +0000