Note that you must have options ACCEPT_FILTER_DATA in your kernel
configuration or load the accf_data kernel module. The functionality is
not in the GENERIC kernel.
This allows for some further hardening against synflooding and connection flooding
where no data is actually sent, as the kernel will simply ignore those connections
(well, as far as the ircd is concerned anyway).
ERR_error_string() is just broken, as it returns at most 119 chars
which means error messages are frequently truncated.
Allow for 511 chars using ERR_error_string_n().
This lets a user connect with a client certificate, and
passes the certificate's fingerprint to ircd, which
currently just notices it to the user.
A new ssld->ircd message 'F' is used to pass on the
fingerprint.
This is only for OpenSSL for now, not GNUTLS.
If there is no space in the output buffer to report an
error adding to the kqueue, kevent(2) will abort and
return the error in errno (I was correct that it does
not tell you where it failed). So do not abort the loop
if kevent(2) fails and do not log (expected) EBADF.
(ircd wouldn't read or write anymore to certain clients)
This happens because kqueue.c will often try to add
already closed file descriptors to the kqueue. The kernel
tries to report bad file descriptors in the eventlist; if
the eventlist has no space, processing of the changelist
is silently halted.
The fix:
1. allocate two kqlst things, one for what kqlst currently does
and one as output buffer
this ensures the kevent(2) call in rb_select_kqueue() never
drops updates
2. replace the kevent(2) call in kq_update_events() by a loop
that processes the updates one at a time
that doesn't happen much, and it's the only way to be sure
without also getting events out of the queue we cannot process
at that time
libratbox r25354 (jilles)
In rare cases, this sharing caused the ircd to skip
part of outgoing traffic, e.g. appearing as "not enough
parameters" errors on the other side.
The purpose of this flag can be fulfilled by the writeofs
in the bufhead.
libratbox r25227
This makes the kernel's state agree with our handler pointer.
SSL may need to suspend selecting for reading to write
something, e.g. with renegotiation.
libratbox r25223
