aboutsummaryrefslogtreecommitdiff
path: root/src/sp/transport/tls
Commit message (Collapse)AuthorAge
* Replace nng_pipe_get_addr, nng_stream_get_addr, and the NNG_OPT_REMADDR option.Garrett D'Amore2025-10-27
| | | | | | | | | | | More direct access methods are provided instead. This results in much lower friction when using, and is a step on the path to removing NNG_OPT_LOCADDR as well. We need to figure a solution for NNG_OPT_LOCADDR for dialers; for listeners there is little use in it either, and it will be removed. (Dialers will probably get a new NNG_OPT_BIND_IP option.)
* NNG_OPT_BOUND_PORT replaces NNG_OPT_TCP/UDP_BOUND_PORT.Garrett D'Amore2025-10-26
| | | | | | | | | | This is easier and agnostic about the underlying L3 protocol. We plan to remove direct NNG_OPT_LOCADDR support from listeners (and probably both NNG_OPT_LOCADDR and NNG_OPT_REMADDR have numbered days left in their lifetime. They will be replaced with more direct typed access functions as has been done for pipes already.) While here fixed some include for IWYU in the POSIX platform.
* Plumb sockaddrs all the way through pipes, make them failsafe.Garrett D'Amore2025-10-25
| | | | These functions can no longer fail.
* Add support for OpenSSL v3.5 and newer.Garrett D'Amore2025-10-19
| | | | | | | | | | | We are *only* supporting 3.5 (or newer 3.x releases) as its the newest LTS version of OpenSSL. This supports the full set of TLS features with NNG, including DTLS, PSK, TLS 1.3, etc. Future work will explore making using of the QUIC support in OpenSSL. Note that this OpenSSL work sits on top of NNG's TCP streams, so it cannot benefit from Linux in-kernel TLS or other features such as TCP fast open at this time.
* header file fixesGarrett D'Amore2025-10-09
|
* fixes #2173 New TLS cert API - replaces the properties for CN and ALTNAMES.Garrett D'Amore2025-10-05
| | | | | | This will replace the NNG_OPT_TLS_PEER_ALTNAMES and NNG_OPT_TLS_PEER_CN properties, and gives a bit more access to the certificate, as well as direct access to the raw DER form, which should allow use in other APIs.
* Various header file fixes... also fix compilation errors when HTTP is disabled.v2.0.0-alpha.6Garrett D'Amore2025-10-05
| | | | | | Also, some instances nni_aio are changed to nng_aio. We think we want to harmonize some of these types going forward as it will reduce the need to include headers hopefully letting us get away with just "defs.h" in more places.
* fixes #2158 Implement support for NNG_OPT_TLS_PEER_CN for WolfSSLGarrett D'Amore2025-10-05
| | | | | | | This also provides an implementation for getting ALT names, although nothing uses that yet. We plan to provide a new certificate API to replace these with a nicer API, as obtaining the full list of certs may be unreasonable.
* Introduce DTLS transport for NNG.Garrett D'Amore2025-06-01
| | | | | | | | | | | | | This introduces a new experimental transport for DTLS, that provides encryption over UDP. It has a simpler protocol than the current UDP SP protocol (but we intend to fix that by making the UDP transport simpler in a follow up!) There are a few other fixes in the TLS layer itself, and in the build, that were needed to accomplish this work. Also there was an endianness bug in the UDP protocol handling, which is fixed here.
* Converted rest of transports to nng_err.Garrett D'Amore2025-04-27
|
* Converted property functions to use nng_err.Garrett D'Amore2025-04-27
|
* Transport listen: use nng_errGarrett D'Amore2025-04-27
|
* AIO: Use nng_err for cancellation callback instead of int.Garrett D'Amore2025-04-27
| | | | | | This is part of our work to improve type safety/awareness, and also improve debugger support, for NNG error codes. There are still quite a few more but this should help.
* Fix typos in TLS test names.Garrett D'Amore2025-04-27
|
* Set server name for TLS test.Garrett D'Amore2025-04-19
|
* api: pipes should use nng_errGarrett D'Amore2025-01-14
|
* tests: TLS transport test resilience against EADDRINUSEGarrett D'Amore2025-01-04
| | | | This was occasionally causing "sigabrt" and similar failures in the tests.
* api: fold TLS supplemental headers into nng.hGarrett D'Amore2025-01-04
|
* socket: rename nng_close to nng_socket_closeGarrett D'Amore2024-12-31
|
* fix for potential leaking connectionsGarrett D'Amore2024-12-26
|
* tls: use nni_aio_beginGarrett D'Amore2024-12-26
|
* tls: fix deadlock in error pathGarrett D'Amore2024-12-16
|
* transports: all transports use the new inline approachGarrett D'Amore2024-12-15
| | | | | | We can retire the old approach that used separate allocations, and all of the supporting code. This also gives us a more natural signature for the end point initializations.
* tls transport: use inline SP structuresGarrett D'Amore2024-12-15
|
* tls transport: inline aiosGarrett D'Amore2024-12-15
|
* streams: add explicit stop functionsGarrett D'Amore2024-12-12
| | | | | | | | | | | | This allows us to explicitly stop streams, dialers, and listeners, before we start tearing down things. This hopefully will be useful in resolving use-after-free bugs in http, tls, and websockets. The new functions are not yet documented, but they are nng_stream_stop, nng_stream_dialer_stop, and nng_stream_listener_stop. They should be called after close, and before free. The close functions now close without blocking, but the stop function is allowed to block.
* tls: implement ep stopGarrett D'Amore2024-12-11
|
* tls: don't use an extra resolver step in the listener.Garrett D'Amore2024-11-24
| | | | This was centralized in the stream layer a while ago.
* tls: add a mutual authentication testGarrett D'Amore2024-11-23
| | | | | | | | Also, make it clearer that TLS keys and certificates can only be set once on a configuration. (mbedTLS makes this confusing!) This mutual test is only fully validated on mbed, because wolfSSL seems to not properly validate this in many configurations.
* tls: include error code from mbed in log messagesGarrett D'Amore2024-11-23
| | | | Also add a test case for mismatch verify.
* tls: remove NNG_OPT_URLGarrett D'Amore2024-11-23
|
* tests: eliminate use of NNG_OPT_URLGarrett D'Amore2024-11-23
|
* Collect the bound port as part of the URL at bind time.Garrett D'Amore2024-11-21
| | | | This is a step on cleaning up our logic around NNG_OPT_URL.
* Merge internal and external URL APIs. No need forGarrett D'Amore2024-11-18
| | | | the separation of nni_url and nng_url.
* URL refactor part 1.Garrett D'Amore2024-11-18
| | | | | | | This eliminates most (but not all) of the dynamic allocations associated with URL objects. A number of convenience fields on the URL are removed, but we are able to use common buffer for most of the details.
* URL u_port should be a number not a string.Garrett D'Amore2024-11-17
| | | | | | | | | | | The idea here is to reduce the dynamic allocations used for URLs, and also the back and forth with parsing begin strings and port numbers. We always resolve to a port number, and this is easier for everyone. The real goal in the long term is to eliminate dynamic allocation of the URL fields altogether, but that requires a little more work. This is a step in the right direction.
* tcp/tls: Remove support for local interface address in dialer URLsGarrett D'Amore2024-11-17
| | | | | This was an undocumented capability provided for libnanomsg. The correct way to obtain the same functionality is to use `NNG_OPT_LOCADDR`.
* refactor initialization/finalizationGarrett D'Amore2024-11-11
| | | | | | | | | Applications must now call nng_init(), but they can supply a set of parameters optionally. The code is now safe for multiple libraries to do this concurrently, meaning nng_fini no longer can race against another instance starting up. The nni_init checks on all public APIs are removed now.
* TLS configuration changed to use discret _set_tls and _get_tls functions.Garrett D'Amore2024-11-09
| | | | This is simpler, and more reliable than using socket options.
* Introduce NUTS_SKIP and use it in a few tests.Garrett D'Amore2024-11-03
| | | | | This lets us see that we are skipping tests due to lack of support, and makes it a little clearer to an observer.
* Remove untyped nng_dialer_get/set and nng_listener_get/set.Garrett D'Amore2024-11-03
|
* tls: Remove the individual TLS configuration optionsGarrett D'Amore2024-10-28
| | | | | | | | This is a breaking change. TLS configuration changes are to be made using TLS configuration objects, and then set on a listener or dialer with NNG_OPT_TLS_CONFIG. This should be a bit less racy, and allows for simpler code.
* remove legacy support for configuration of transport options on socketGarrett D'Amore2024-10-20
| | | | | | | | | Transport specific options should be configured on the end point. This has the most impact for TLS, as TLS dialers and listeners will need to be allocated apriori, to configure TLS options. Some legacy tests were removed... we're going to remove the legacy libnanomsg compatibility layer anyway.
* Remove the legacy transport registration functions.Garrett D'Amore2024-10-06
| | | | | | This also allows to remove most of the transport headers. Only zerotier.h sticks around, and only for now. (We expect to eject it into a separate module.)
* TLS: make some tests conditional.Garrett D'Amore2024-07-22
| | | | This is in preparation for the wolfSSL integration.
* Fix conditional tls_tran_testGarrett D'Amore2024-07-21
|
* fixes #1846 Add support for TLS PSKGarrett D'Amore2024-07-21
| | | | | | This also adds an SP layer transport test for TLS, based on the TCP test but with some additions; this test does not cover all the edge cases for TLS, but it does at least show how to use it.
* Free SP protocol streams before discarding aio objects.Garrett D'Amore2024-05-30
| | | | | | | | This seems to alleviate the use after free crashes, although it does not seem like it should. Current theory is that this closes the handle ensuring that it is unregistered from the I/O subsystem, thus preventing callbacks from firing and referring to objects that have been freed.
* Another attempt at the close deadlock, fix use-after-free.Garrett D'Amore2024-05-30
| | | | | | | | When closing pipes, we defer them to be reaped, but also leave them in the match list where they might be picked up by ep_match, or leak. It's best to reap these proactively and ensure that they are not allowed to life longer once they have errored during the negotiation phase.
* Logging improvements (#1816)Garrett D'Amore2024-04-21
| | | | | | | | | | | | * Add nng_str_sockaddr to get string representation of socket address. * Added nng_log_get_level() is meant to allow users to obtain the current level and avoid some possibly expensive operations just to collect debugging information when debugging is not in effect. We use a custom logger for NUTS, and this fits within the NUTS test framework well, so that if -v is supplied we get more content. All tests now get this by default.
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2026-01-18 19:18:19 +0000