Commit graph

177 commits

Author SHA1 Message Date
Ariadne Conill
9a7b4a4521 librb: appease libtool by adding rb_close_pending_fds() to the export list 2021-07-31 00:05:59 -04:00
Ariadne Conill
ad2421c74e librb: make free_fds() public as rb_close_pending_fds() 2021-07-31 00:05:59 -04:00
jailbird777
8f0c3422e7 Remove Windows support 2021-07-30 14:17:47 -04:00
jailbird777
e370888264 (Mostly) exorcise select()
Sadly, this just sends it to purgatory. It's still around for the
socketpair() emulation and the nanosleep() emulation.

socketpair() obviously only selects() on 2 FDs, so not a huge deal.
nanosleep() only uses it for the timeout, so also not a huge deal.

socketpair() is SUSv3 (2001) and nanosleep() is SUSv2 (1997), so maybe
it's OK to remove those emulations.  If so, then we can also remove the
sys/select.h check in configure.ac
2021-06-26 17:56:40 +01:00
jailbird777
365feb397b Remove unneeded ugly hack for 32-bit Solaris
- The official Sun/Oracle solution is to use the extendedFILE(5)
  mechanism, which works around the limitation.
  https://docs.oracle.com/cd/E18752_01/html/816-5175/extendedfile-5.html
- Add a quick HOWTO to the README.md
2021-06-26 16:22:08 +01:00
jailbird777
b29800911a librb mbedTLS: der_pubkey is used out of scope 2021-06-02 18:38:22 +00:00
Ariadne Conill
3fc0499e77
Mailmap and copyright update for Ariadne 2021-06-01 12:40:02 -04:00
mniip
79a38ce96d Fix time.h in librb autoconf 2021-05-30 16:13:38 -05:00
Ariadne Conill
8dbfb0203e librb: radixtree: fix iteration restarting
STATE_CUR(state) = NULL causes rb_radixtree_foreach_next() to fail,
instead set both state pointers to the same address.
2021-05-30 10:39:34 -05:00
Aaron Jones
a90f22c92d OpenSSL: Support configuration of TLSv1.3 ciphersuites
The OpenSSL developers decided, during the OpenSSL 1.1.1 development
phase, to use a different API and different set of lists for TLSv1.3
ciphersuites, than for every TLS version preceeding it.

This is stupid, but we have to work with it.

This commit also improves configuration fault resilience. The reason
is that if you don't pass any valid old-style ciphersuites, OpenSSL
will not negotiate an older protocol at all. However, when they
implemented the new API, they decided that lack of any valid
ciphersuites should result in using the defaults. This means that if
you pass a completely invalid ciphersuite list (like "foo"), OR if
you pass a TLSv1.2-only ciphersuite list, TLSv1.3 continues to work.
This is not mirrored; passing a TLSv1.3-only ciphersuite list will
break TLSv1.2 and below.

Therefore we work around this lack of mirroring by falling back to
the default list for each protocol. This means that if
ssl_cipher_list is complete garbage, the default will be used, and
TLS setup will succeed for both protocols. This is logged, so that
administrators can fix their configuration.

I prefer this approach over explicitly disabling the protocols if
their respective ciphersuite lists are invalid, because it will
result in unusable TLSv1.3 if people run newer solanum with their
older charybdis/solanum configuration files that contain custom
ssl_cipher_list definitions. Hindering TLSv1.3 adoption is not an
option, in my opinion.

The downside of this is that it is no longer possible to disable a
protocol family by not including any of its ciphersuites. This could
be remedied by an ssl_protocol_list configuration directive if it is
decided that this functionality is ultimately necessary.

This work is not required for either of the other TLS backends,
because neither of those libraries yet support TLSv1.3, and in the
event that they eventually do, I expect them to allow configuration
of newer ciphersuites with the existing APIs. This can be revisited
if it turns out not to be the case.

Signed-off-by: Aaron Jones <me@aaronmdjones.net>
Tested-by: Aaron Jones <me@aaronmdjones.net>
2021-02-07 11:52:58 +00:00
Doug Freed
71325a9801 librb/helper: call rb_clear_cloexec on child fds 2021-01-26 00:03:48 -05:00
Doug Freed
1cad0654b7 librb: call rb_set_cloexec in rb_setup_fd 2021-01-26 00:03:48 -05:00
Doug Freed
34a2afbc28 librb: add rb_{set,clear}_cloexec 2021-01-26 00:03:48 -05:00
Ed Kellett
c07751a50d Remove hardcoded TLSv1 disables 2020-11-01 04:07:24 +00:00
Ed Kellett
a6f63a829e
Innovation by sed 2020-10-15 15:52:41 +01:00
Ed Kellett
ad516b7d47
librb/event: Don't leak event names on completion 2020-04-19 14:22:18 +01:00
Simon Arlott
400e650809
librb: Fix nossl 2019-09-15 12:33:56 +01:00
Simon Arlott
b7660ea49d
librb: Fix nossl 2019-09-15 11:43:52 +01:00
Simon Arlott
8679c0fe3c
Fix Clang 6 compiler warnings 2019-09-15 11:28:48 +01:00
Simon Arlott
4b7abcfb7d
librb: Avoid unused variable warning 2019-09-15 11:13:54 +01:00
Simon Arlott
53aeb0305a
librb: Specify -Wno-unused-parameter 2019-09-15 11:12:44 +01:00
Simon Arlott
c4c1bf3b79
librb: Fix GCC 8 warning; 640 bytes should be enough 2019-09-15 10:25:25 +01:00
Aaron Jones
f7f1c50494
Support ECDH X25519 for TLSv1.3 (OpenSSL 1.1.1) 2019-09-08 14:00:24 +00:00
Ed Kellett
3576d1b482
librb/event: delete indirectly via a dead flag
This avoids an issue where deleting an event inside the handler of a
different event puts the event iteration in an invalid state.
2019-09-07 14:50:42 +01:00
Simon Arlott
17809d2db7
librb: Fix type of dst for rb_inet_pton_sock() 2019-08-31 16:10:50 +01:00
Aaron Jones
8d93dd76ad
MbedTLS: Support ChaCha20-Poly1305 in TLSv1.2+ 2018-08-13 22:35:20 +00:00
Simon Arlott
30053ab982
gcc7 fixes: make fallthrough explicit 2018-01-19 23:26:03 +00:00
Aaron Jones
e081bf2988
libratbox/src/mbedtls.c: check public/private keys match 2018-01-06 16:05:48 +00:00
Simon Arlott
268044ea40
Add workaround for Linux SCTP_I_WANT_MAPPED_V4_ADDR bug on older kernels 2017-08-24 20:08:22 +01:00
Simon Arlott
6003ce763c
Add outgoing SCTP connect support 2017-08-24 20:08:21 +01:00
Simon Arlott
c6ad9b0c5f
Add basic SCTP listener support that binds to multiple addresses
This only supports two addresses as the intended use is 1 IPv4 and 1 IPv6
address on a single-homed host, and the only supported configuration of
outgoing connections to other servers is to bind a single IPv4 or IPv6
address.
2017-08-24 20:08:20 +01:00
Simon Arlott
589dbf4d0f
rb_connect: use SO_ERROR 2017-08-24 20:08:19 +01:00
Simon Arlott
9caecc9348
rb_inet_pton_sock: initialise sockaddr to zero 2017-08-24 20:08:19 +01:00
Simon Arlott
de2934965c
remove RB_IPV6 2017-08-20 12:54:46 +01:00
Simon Arlott
fa2367e3f3
librb: remove zstring
rb_zstring_serialized leaks memory while doing nothing with its
arguments... nothing is using zstring so remove it
2017-08-06 18:40:24 +01:00
Simon Arlott
1272b289e6
librb: dictionary_add mishandles replacing elements
This can only happen with soft asserts otherwise it will crash instead.

Nothing currently uses the return value of rb_dictionary_add.
2017-08-06 18:38:35 +01:00
Simon Arlott
4b1cce65ed
ircd: send tags on every message
Simplify linebuf by introducing fsnprint to manage a list of printfs.
Add a msgbuf unparse cache for send functions that loop.
2017-08-06 16:21:29 +01:00
Aaron Jones
515467e527
mbedtls.c: minor fixups
- Add (void) casts for unused function parameters
- Rearrange member in `struct rb_mbedtls_cfg_context' for data alignment
- Document a `clang-4.0 -Weverything' (-Wcast-qual) diagnostic
- Avoid pointless conversions between positive/negative error codes
- Use capital hexadecimals in error codes and properly cast to
  (unsigned int) for %x/%X
2017-07-30 18:41:32 +01:00
Simon Arlott
e5c434a2df
librb: add rb_snprintf_try_append
For when it might fit, or it might not.
2017-07-30 17:04:06 +01:00
Simon Arlott
8573c3409e
librb: rb_snprinf_append: handle error return value from vsnprintf() 2017-07-30 17:03:30 +01:00
Simon Arlott
7a06833fb4
librb: linebuf: reduce the number of "put" implementations from 4 to 1 2017-07-30 15:51:45 +01:00
Simon Arlott
4c7d1de8f3
librb: linebuf needs to use the buffer limit from msgbuf_unparse_prefix 2017-07-29 23:32:27 +01:00
Simon Arlott
2100c58d09
librb: rb_rawbuf_length: do something if soft assert fails
correct the value of rb->len
2017-07-29 22:46:10 +01:00
Simon Arlott
9f46eae691
linebuf: increase buffer size to accommodate IRCv3 tags 2017-07-29 22:46:06 +01:00
Simon Arlott
33ded5fc57
librb: remove unnecessary NULL from the end of rb_string_to_array output 2017-07-29 22:46:04 +01:00
Simon Arlott
b5ad4cdfde
make soft asserts better by allowing them to be used in expressions 2017-07-29 22:39:53 +01:00
Simon Arlott
45285c4a73
librb: rb_lib_loop: avoid clang static analysis warning 2017-07-29 22:39:49 +01:00
Simon Arlott
630c15211d
librb: rb_linebuf_copy_raw: remove unused assignment 2017-07-29 22:28:47 +01:00
Simon Arlott
b0adc7bf97
librb: commio: Must set addrlen before every call to accept()
If an IPv4 connection is dropped by the pre-callback, and there is a
pending IPv6 connection on the same listening socket then the retried
accept() will be unable to populate `st` because `addrlen` will be too
small. Also initialise `st` each time to avoid a clang static analysis
warning.
2017-07-29 22:20:05 +01:00
Aaron Jones
c3abf98286
MbedTLS: Disable TLSv1.0 2016-12-30 17:59:48 +00:00