gmnisrv/src/tls.c, branch main

Serve CA full chain (Let's Encrypt), TLS 1.3, fix handshake buffer overflow

2026-06-26T17:20:00+00:00

- tls.c/config.h: read full PEM chain into STACK_OF(X509), send via SSL_set1_chain - tls.c: minimum protocol TLS 1.2 -> TLS 1.3 - server.c: drain handshake output via local buffer loop instead of staging into the fixed 4 KB client buffer (a full CA chain overflowed it -> assert) - FORK.md: describe the fork

set session id context

2021-08-27T07:48:07+00:00

This is necessary now client certificates are supported. Without it, an attempt to resume a session fails with "ssl_get_prev_session:session id context uninitialized".

Create certificates which last 68 years (INT32_MAX seconds)

2021-05-16T18:10:57+00:00

This avoids integer overflow on 32-bit architectures.

Fix integer overflow error in tls.c

2021-03-24T12:02:48+00:00

Move certificate expiration into the far future

2021-03-04T16:04:46+00:00

Send client certificate hash for CGI scripts.

2021-02-11T14:19:16+00:00

Set SSL_VERIFY_PEER to request a client certificate from the server, when available. Have to shim the certificate verification function or else it will fail on self-signed client certs. In serve_cgi retrieve client certificate, create a fingerprint, and set proper environment variables. It's pretty barebones, it doesn't parse the certificate to give any other useful info like the common name, but it's acceptable IMO. For most CGI uses the fingerprint is the only thing that is needed anyways.

Use v3 X509 certificate

2021-02-05T15:39:21+00:00

This fixes an issue where rustls failed to validate the X509v1 certificate. Tested with Amfora, av-98, and titan (https://github.com/mkeeter/titan) This requires fresh certificates, which could break clients with strict trust-on-first-use policies; unfortunately, it doesn't appear to be possible to migrate v1 certificates to v3.

Switch to using ECDSA (secp384r1) keys

2020-11-21T14:12:16+00:00

tls: fix crash when opening priv key for writing

2020-11-08T14:38:04+00:00

The open syscall will return a negative value if the call fails. Switch the check to look for this instead of 0. before: [gmnisrv] generating certificate for localhost gmnisrv: src/tls.c:68: tls_host_gencert: Assertion `pf' failed. abort (core dumped) ./gmnisrv -C config.ini after: [gmnisrv] generating certificate for localhost [gmnisrv] opening private key for writing failed: No such file or directory [gmnisrv] TLS initialization failed Signed-off-by: William Casarin

Overhaul network I/O to be async for real

2020-10-25T18:50:07+00:00

Had to totally cut off OpenSSL from the network fd because obviously OpenSSL is just going to wreck our shit