3 ms·

Not to miss: Less code http://www.openbsd.org/papers/libtls-fsec-2015/mgp00004.html http://www.openbsd.org/papers/libtls-fsec-2015/mgp00004.html What's wrong

by alecco 11y ago

Not to miss: Less code http://www.openbsd.org/papers/libtls-fsec-2015/mgp00004.html http://www.openbsd.org/papers/libtls-fsec-2015/mgp00004.html What's wrong with the OpenSSL API http://www.openbsd.org/papers/libtls-fsec-2015/mgp00007.html http://www.openbsd.org/papers/libtls-fsec-2015/mgp00007.html TLS small set of functions http://www.openbsd.org/papers/libtls-fsec-2015/mgp00009.html http://www.openbsd.org/papers/libtls-fsec-2015/mgp00009.html read() and write() semantics http://www.openbsd.org/papers/libtls-fsec-2015/mgp00011.html http://www.openbsd.org/papers/libtls-fsec-2015/mgp00011.html No need for handling errno EAGAIN/EINTR yay! http://www.openbsd.org/papers/libtls-fsec-2015/mgp00016.html http://www.openbsd.org/papers/libtls-fsec-2015/mgp00016.html There's more stuff like event/poll, but I don't want to link more. The presentation is very interesting.

gnuvince 11y ago
One nice side benefit of their usage of MagicPoint; it's easy to link directly into a specific slide.
deathanatos 11y ago
> No need for handling errno EAGAIN/EINTR yay! Yay for EINTR, but you're still handling EAGAIN; it's just called TLS_POLLIN/TLS_POLLOUT now. (Not that this is a bad thing: this is exactly what I'd expect from such an API, as it needs to integrate with the local event loop.) The "What's wrong with the OpenSSL API" is excellent: a coworker ran into this just recently. A client was failing to connect, and had SSL23_XXX in the stack trace, and he wondered why it was using an outdated version of SSL; since we've long since disabled support for SSLv3 server-side, he figured — reasonably — that the client was failing to connect for that reason. For those wondering, from the Python docs, which have the best explanation I know of: > ssl.PROTOCOL_SSLv23 > Selects the highest protocol version that both the client and server support. Despite the name, this option can select “TLS” protocols as well as “SSL”.
- ben0x539 11y ago
  > Yay for EINTR, but you're still handling EAGAIN; it's just called TLS_POLLIN/TLS_POLLOUT now. I think their point is that you just have to check the return value to know how to proceed, you don't have to check the return value and errno.

by alecco 11y ago

gnuvince 11y ago

One nice side benefit of their usage of MagicPoint; it's easy to link directly into a specific slide.

deathanatos 11y ago

> No need for handling errno EAGAIN/EINTR yay! Yay for EINTR, but you're still handling EAGAIN; it's just called TLS_POLLIN/TLS_POLLOUT now. (Not that this is a bad thing: this is exactly what I'd expect from such an API, as it needs to integrate with the local event loop.) The "What's wrong with the OpenSSL API" is excellent: a coworker ran into this just recently. A client was failing to connect, and had SSL23_XXX in the stack trace, and he wondered why it was using an outdated version of SSL; since we've long since disabled support for SSLv3 server-side, he figured — reasonably — that the client was failing to connect for that reason. For those wondering, from the Python docs, which have the best explanation I know of: > ssl.PROTOCOL_SSLv23 > Selects the highest protocol version that both the client and server support. Despite the name, this option can select “TLS” protocols as well as “SSL”.

ben0x539 11y ago
> Yay for EINTR, but you're still handling EAGAIN; it's just called TLS_POLLIN/TLS_POLLOUT now. I think their point is that you just have to check the return value to know how to proceed, you don't have to check the return value and errno.