summary refs log tree commit diff stats
path: root/lib/pure/net.nim
Commit message (Collapse)AuthorAgeFilesLines
* Add SSL_CTX_set_session_id_context (#15233)IDF2020-09-041-0/+16
| | | | | | | | | * Added SSL_CTX_set_session_id_context() * Added basic nimdoc * Raise an error if sessionIdContext is longer than the maximum length * Update nimdocs
* Added more SSL documentation to `net` module. (#15206)John Dupuy2020-08-221-3/+17
| | | | | | | | | | | | | | | | | | | | | | * Added more SSL documentation to `net` module. * Changed two of the net.nim doc refs to links. * Update lib/pure/net.nim doc wording. Co-authored-by: Dominik Picheta <dominikpicheta@googlemail.com> * Update lib/pure/net.nim - added space to doc URI Co-authored-by: alaviss <leorize+oss@disroot.org> * Fixed another doc URI in net module. * For net module doc added warning to connect procedure. * Update net.nim Co-authored-by: Dominik Picheta <dominikpicheta@googlemail.com> Co-authored-by: alaviss <leorize+oss@disroot.org>
* fixes #15177, the error message is now what it should have been (#15195)Andreas Rumpf2020-08-171-1/+1
|
* net: allow close() to ignore SSL failures due to disconnections (#15120)alaviss2020-08-011-8/+98
| | | | | | | | | | | | | | * net: allow close() to ignore SSL failures due to disconnections Comes with this PR is also a SIGPIPE handling contraption. * net: don't do selectSigpipe() on macOS macOS sockets have SO_NOSIGPIPE set, so an EPIPE doesn't necessary mean that a SIGPIPE happened. * net: fix alreadyBlocked logic * net: WSAESHUTDOWN is also a disconnection error
* asyncnet, net: don't attempt SSL_shutdown if a fatal error occurred (#15066)alaviss2020-07-301-30/+43
| | | | | | | | | | | | | | | | | | | | | | | | | * asyncnet, net: don't attempt SSL_shutdown if a fatal error occurred Per TLS standard and SSL_shutdown(3ssl). This should prevent errors coming from a close() after a bad event (ie. the other end of the pipe is closed before shutdown can be negotiated). Ref #9867 * tssl: try sending until an error occur * tssl: cleanup * tssl: actually run the test I forgot to make the test run :P * tssl: run the test on ARC, maybe then it'll be happy * tssl: turns off ARC, switch tlsEmulation on for freebsd * tssl: document why tlsEmulation is employed * net: move SafeDisconn handling logic to socketError
* Fix style inconsistencies due to the previous commitnarimiran2020-07-061-55/+55
|
* revert 0944b0f4narimiran2020-07-061-55/+55
|
* {.deprecated: [existsFile: fileExists].} (#14735)Timothee Cour2020-07-021-2/+2
| | | | | | | | | * {.deprecated: [existsFile: fileExists].} * s/existsFile/fileExists/ except under deps * workaround pending #14819 * fix test
* SSL_CTX_load_verify_locations parameters are reversed (#14815) [backport]aguspiza2020-06-291-1/+1
|
* net: also set TLSv1.3 cipher suitesLeorize2020-06-061-0/+7
|
* net: revert compatibility changes for WindowsLeorize2020-06-061-5/+2
| | | | | This reverts commit d53a6355f3ad4401731142d8fc66b95ecfdfb321 and 688b1f250ed058ecc49737dc75fd089206fa25b9.
* net: use CiphersOld list for WindowsLeorize2020-06-061-1/+4
| | | | | | | The default DLLs shipped are too old, switch to CiphersOld list to ensure compatibility. This commit should be reverted before any future release.
* net: don't call set_ecdh_auto for super old OpenSSLLeorize2020-06-061-1/+1
| | | | | And the fun thing is that currently we use a super old OpenSSL on Windows.
* net: enable automatic EC curve selection for OpenSSL 1.0.2Leorize2020-06-061-0/+7
| | | | | This setting is required for servers running OpenSSL < 1.1.0 to support EC-based secure ciphers that is now part of the default cipher list.
* net: use a secure cipher list by defaultLeorize2020-06-061-1/+2
| | | | | | | | | | | Previously, the `net` module use the blanket "ALL" as the default cipher list. This list may contain security ciphers that are weak and/or outdated according to the current standard. This commit introduces a new module `ssl_config` that contains the latest OpenSSL configurations as recommended by Mozilla OpSec, and make the `net` module use the cipher list targeting `intermediate` compatibility level as the default.
* asyncnet, net: clear openssl error queue before performing I/OLeorize2020-06-061-0/+7
| | | | | | | | | | | | Per SSL_get_error(3): The current thread's error queue must be empty before the TLS/SSL I/O operation is attempted, or SSL_get_error() will not work reliably. There has been records of not clearing the error queue causing weird SSL errors when there shouldn't be any, see: https://github.com/openssl/openssl/issues/11889
* openssl: fix erroneous function signaturesLeorize2020-06-061-2/+0
| | | | Now matches the declaration in openssl/err.h
* net: don't clear error queue unless shutdown() will be performedLeorize2020-06-061-1/+1
|
* Revert "net: don't clear all errors on close"Leorize2020-06-061-0/+1
| | | | | | | You're supposed to clear the error queue before any I/O operations. Per SSL_get_error(3) man page. This reverts commit ee3ed37300743addb1344e39bc46d3cd2b89a718.
* net: don't clear all errors on closeLeorize2020-06-061-1/+0
| | | | | | | Closing a socket clears the error queue of the entire thread, which seems to be a bit too invasive. Also I don't find any reason in the PR that added this.
* asyncnet, net: call SSL_shutdown only when connection establishedLeorize2020-06-061-9/+13
| | | | | | This commit prevents "SSL_shutdown while in init" errors from happening. See https://github.com/openssl/openssl/issues/710#issuecomment-253897666
* net: remove more erroneous set constructions (#14252) [backport]alaviss2020-05-071-3/+8
| | | Refs #13764
* Fixes net.recvFrom to work correctly with IPv6 (#14131)rockcavera2020-05-041-10/+22
| | | | | | | * added high level sendTo and recvFrom to std/asyncnet; tests were also added. * add .since annotation, a changelog entry and fixed to standard library style guide. * fixes net.recvFrom to work correctly with IPv6 * raise if domain is not AF_INET or AF_INET6 * renamed template to adaptRecvFromToDomain()
* move since from inclrtl to std/private/since (#14188)hlaaftana2020-05-021-1/+1
| | | | * move since from inclrtl to std/private/since * move since import in system below for HCR
* Error -> Defect for defects (#13908)Jacek Sieka2020-04-281-2/+2
| | | | | | | | | | | | | | * Error -> Defect for defects The distinction between Error and Defect is subjective, context-dependent and somewhat arbitrary, so when looking at an exception, it's hard to guess what it is - this happens often when looking at a `raises` list _without_ opening the corresponding definition and digging through layers of inheritance. With the help of a little consistency in naming, it's at least possible to start disentangling the two error types and the standard lib can set a good example here.
* change some Exceptions to CatchableError or Defect, fixes #10288 (#14069)hlaaftana2020-04-221-2/+2
|
* Make file descriptors from stdlib non-inheritable by default (#13201)alaviss2020-04-201-8/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * io: make file descriptors non-inheritable by default This prevents file descriptors/handles leakage to child processes that might cause issues like running out of file descriptors, or potential security issues like leaking a file descriptor to a restricted file. While this breaks backward compatibility, I'm rather certain that not many programs (if any) actually make use of this implementation detail. A new API `setInheritable` is provided for the few that actually want to use this functionality. * io: disable inheritance at file creation time for supported platforms Some platforms provide extension to fopen-family of functions to allow for disabling descriptor inheritance atomically during File creation. This guards against possible leaks when a child process is spawned before we managed to disable the file descriptor inheritance (ie. in a multi-threaded program). * net, nativesockets: make sockets non inheritable by default With this commit, sockets will no longer leak to child processes when you don't want it to. Should solves a lot of "address in use" that might occur when your server has just restarted. All APIs that create sockets in these modules now expose a `inheritable` flag that allow users to toggle inheritance for the resulting sockets. An implementation of `setInheritance()` is also provided for SocketHandle. While atomically disabling inheritance at creation time is supported on Windows, it's only implemented by native winsock2, which is too much for now. This support can be implemented in a future patch. * posix: add F_DUPFD_CLOEXEC This command duplicates file descriptor with close-on-exec flag set. Defined in POSIX.1-2008. * ioselectors_kqueue: don't leak file descriptors File descriptors internally used by ioselectors on BSD/OSX are now shielded from leakage. * posix: add O_CLOEXEC This flag allows file descriptors to be open() with close-on-exec flag set atomically. This flag is specified in POSIX.1-2008 * tfdleak: test for selectors leakage Also simplified the test by using handle-type agnostic APIs to test for validity. * ioselectors_epoll: mark all fd created close-on-exec File descriptors from ioselectors should no longer leaks on Linux. * tfdleak: don't check for selector leakage on Windows The getFd proc for ioselectors_select returns a hardcoded -1 * io: add NoInheritFlag at compile time * io: add support for ioctl-based close-on-exec This allows for the flag to be set/unset in one syscall. While the performance gains might be negliable, we have one less failure point to deal with. * tfdleak: add a test for setInheritable * stdlib: add nimInheritHandles to restore old behaviors * memfiles: make file handle not inheritable by default for posix * io: setInheritable now operates on OS file handle On Windows, the native handle is the only thing that's inheritable, thus we can assume that users of this function will already have the handle available to them. This also allows users to pass down file descriptors from memfiles on Windows with ease, should that be desired. With this, nativesockets.setInheritable can be made much simpler. * changelog: clarify * nativesockets: document setInheritable return value * posix_utils: atomically disable fd inheritance for mkstemp
* Deprecate DCE:on (#13839)Juan Carlos2020-04-021-1/+0
|
* fix deprecations and other warnings (#13748)Miran2020-03-251-4/+2
|
* introduce getPeerCertificates, fixes #13299 (#13650)Christian Ulrich2020-03-221-0/+34
| | | | | | | | | | | | * make i2d_X509 and d2i_X509 always available i2d_X509 and d2i_X509 have been available in all versions of OpenSSL, so make them available even if nimDisableCertificateValidation is set. * introduce getPeerCertificates, fixes #13299 getPeerCertificates retrieves the verified certificate chain of the peer we are connected to through an SSL-wrapped Socket/AsyncSocket. This introduces the new type Certificate which stores a DER-encoded X509 certificate.
* SSL certificate verify GitHub action (#13697)Federico Ceratto2020-03-201-12/+76
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Implement SSL/TLS certificate checking #782 * SSL: Add nimDisableCertificateValidation Remove NIM_SSL_CERT_VALIDATION env var tests/untestable/thttpclient_ssl.nim ran successfully on Linux with libssl 1.1.1d * SSL: update integ test to skip flapping tests * Revert .travis.yml change * nimDisableCertificateValidation disable imports Prevent loading symbols that are not defined on older SSL libs * SSL: disable verification in net.nim ..when nimDisableCertificateValidation is set * Update changelog * Fix peername type * Add define check for windows * Disable test on windows * Add exprimental GitHub action CI for SSL * Test nimDisableCertificateValidation
* [backport] Fix style issues in lib/, tools/, and testament/. Fixes #12687. ↵3n-k12019-11-281-74/+74
| | | | (#12754)
* documented behaviour of recv on bufferd socket (#12374)Gampol T2019-10-091-0/+18
|
* [backport] run nimpretty on web stuffnarimiran2019-09-301-28/+33
|
* Fix spellings (#12277) [backport]Federico Ceratto2019-09-271-3/+3
|
* Update OpenSSL example (#11896)Federico Ceratto2019-08-211-1/+5
| | | | | | | | * Update OpenSSL example Fix privkey filename. Bump up RSA key size. Add ECDSA example.
* fixes #11925Araq2019-08-161-1/+1
|
* style improvements; fixes #11774Araq2019-07-191-1/+1
|
* Use std/monotimes in the stdlibOscar Nihlgård2019-07-161-9/+10
|
* there is only one style -- my styleAraq2019-07-101-0/+5
|
* make more parts of the stdlib compile with --styleCheck:errorAraq2019-07-101-4/+4
|
* styleCheck: make the compiler and large parts of the stdlib compatible with ↵Araq2019-07-101-14/+20
| | | | --styleCheck:error
* newruntime for async (#11650)Andreas Rumpf2019-07-051-6/+6
| | | | | | | * fixes overloading resolution for passing owned(Future[string]) to Future[T] * WIP: make --newruntime work with .async * memtracker: make it compile again * make Nimble compile again
* Make net module compile with --taintMode:on (#11360)Smittyvb2019-06-011-1/+1
|
* fixes #1286; object case transitions are now soundAndreas Rumpf2019-05-271-16/+12
|
* Update outdated ETimeout exception nameZestyr2019-05-071-6/+6
|
* Detect local "primary" IP addressFederico Ceratto2019-03-171-0/+20
|
* Handle IPv6 in bindAddr #7633Federico Ceratto2019-02-231-13/+12
| | | | Add test
* Show correct address for ipv6 sockets, fixes #7634 (#10505)LemonBoy2019-01-311-1/+1
|
* Fix spelling errors (#10379)Federico Ceratto2019-01-191-19/+19
|
generated by cgit-pink 1.4.1-2-gfad0 (git 2.36.2.497.gbbea4dcf42) at 2025-02-14 00:18:54 +0000