Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

output.tlscli #96

Merged
merged 6 commits into from
Oct 10, 2018
Merged

output.tlscli #96

merged 6 commits into from
Oct 10, 2018

Conversation

nicki-krizek
Copy link
Contributor

@nicki-krizek nicki-krizek commented Oct 5, 2018 •
edited
Loading

basic TLS client with no certificate validation.

@nicki-krizek
Copy link
Contributor Author

Updated with the latest working version.

The TLS client is basically the TCP client, with removed unused non-blocking mode (#101) and added TLS session.

I've also had to remove the poll() function and timeout handling. I'm not sure how to properly implement it with gnutls.

@jelu
TLS client
d45ddec 
- `output.tlscli`:
  - Fix required package for Travis
  - Regenerate `Makefile.am`
  - Reformat code
  - Add function name on errors
  - Fix timeout handling
  - Remove debug output
  - Moved GnuTLS credentials and session initialization to `output_tlscli_init()`
  - Track TLS establish state in `tls_ok`
@jelu
Copy link
Member

jelu commented Oct 10, 2018

#build

@jelu jelu changed the title WIP: add tlsclient output.tlscli Oct 10, 2018
@jelu
Copy link
Member

jelu commented Oct 10, 2018

@tomaskrizek Please test my changes.

@jelu
TLS client
7266655 
- `examples/replay.lua`: Add `-T` for TLS
- `output.tlscli`:
  - Call `gnutls_global_init()`, support for older versions
  - Disable `poll()` code, timeout handled by GnuTLS
  - Fix include headers
  - Require `dnsjit.core.compat_h` for GnuTLS types
@nicki-krizek
Copy link
Contributor Author

Thanks for the changes! The only issue I see is when the response times out - lua receives nil instead of 0-length packet.

@jelu
TLS client
e4ddbf1 
- `output.tlscli`:
  - Remove `poll()` code
  - Return zero length payload on timeout while receiving DNS length
@jelu
Copy link
Member

jelu commented Oct 10, 2018

@tomaskrizek Are you sure? It should only return 0 if there is an error, I can't see where it would return 0 on timeout.

@nicki-krizek
Copy link
Contributor Author

GNUTLS_E_TIMEDOUT has to be handled when calling gnutls_record_recv().

Looking at e4ddbf1, I think the right action to do when we get GNUTLS_E_AGAIN or GNUTLS_E_INTERRUPTED is to call the function again. Or is there some reason to return a 0-length packet in these cases?

@jelu
Copy link
Member

jelu commented Oct 10, 2018

I can't find in the docs that gnutls_record_recv() returns GNUTLS_E_TIMEDOUT.

I can only find that it is used for the DTLS features.

Have you tested this?

@nicki-krizek
Copy link
Contributor Author

Yes, I can verify this with GnuTLS 3.6.4. gnutls_record_recv() returns GNUTLS_E_TIMEDOUT in case the timeout configured with gnutls_record_set_timeout() is reached.

@jelu
TLS client
560888e 
- `output.tlscli`:
  - Don't treat interrupted like timed out / try again, same behavior for UDP/TCP client
  - Handle `GNUTLS_E_TIMEDOUT`
@jelu
Copy link
Member

jelu commented Oct 10, 2018

@tomaskrizek The behavior is the same as the other clients now, please test.

@nicki-krizek
Copy link
Contributor Author

@jelu Seems to work fine now, thanks!

@jelu
Documentation
23d3477 
- Make GnuTLS required for building
- Update dependencies in documentation and packages
@jelu jelu merged commit 656758f into DNS-OARC:develop Oct 10, 2018
@nicki-krizek nicki-krizek deleted the add-tls branch February 19, 2020 11:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@nicki-krizek @jelu