TLS transport: OpenSSL-based encrypted TCP #13

Merged

TapTap merged 8 commits from tls-transport into main 2026-07-18 17:54:26 +02:00

Conversation 5 Commits 8 Files Changed 16

+392 -28

TapTap commented 2026-07-16 16:28:49 +02:00

Owner

Copy Link

Copy Source

New TLS transport layer using OpenSSL for encrypted TCP connections.

• transport_tls.h/c: server_create_tls, server_listen_tls, client_connect_tls
• protocol.c: io_set_ssl() + SSL_read/SSL_write in send_n_data/receive_n_data
• transport_tcp.h: ssl/ssl_ctx fields added to Server/Client structs
• config.h/c: use_tls, tls_cert, tls_key fields
• client_cli.c: --tls, --cert, --key flags
• server.c: --tls, --cert, --key, -p flags with TLS support
• CMakeLists.txt: OpenSSL::SSL + OpenSSL::Crypto linkage
• shell.nix: openssl added to buildInputs

Usage:
server: ./build/server --tls --cert server.pem --key server.pem -p 4433
client: ./build/client --tls --cert client.pem --key client.pem src dest

All 7 unit tests and 30 integration tests pass with zero warnings.

New TLS transport layer using OpenSSL for encrypted TCP connections. - transport_tls.h/c: server_create_tls, server_listen_tls, client_connect_tls - protocol.c: io_set_ssl() + SSL_read/SSL_write in send_n_data/receive_n_data - transport_tcp.h: ssl/ssl_ctx fields added to Server/Client structs - config.h/c: use_tls, tls_cert, tls_key fields - client_cli.c: --tls, --cert, --key flags - server.c: --tls, --cert, --key, -p flags with TLS support - CMakeLists.txt: OpenSSL::SSL + OpenSSL::Crypto linkage - shell.nix: openssl added to buildInputs Usage: server: ./build/server --tls --cert server.pem --key server.pem -p 4433 client: ./build/client --tls --cert client.pem --key client.pem src dest All 7 unit tests and 30 integration tests pass with zero warnings.

TapTap commented 2026-07-16 16:42:56 +02:00

Author

Owner

Copy Link

Copy Source

Code Review: TLS transport

Overall this is a solid first TLS implementation. The architecture is clean and the integration with existing transport abstractions is well thought out. Below are the issues I found, organized by severity.

---

CRITICAL / Bugs

1. Memory leaks: SSL and SSL_CTX not freed on client disconnect/delete
transport_tcp.c:129-141

client_disconnect() only closes the fd and waits for SSH. client_delete() only frees the struct. Neither frees client->ssl or client->ssl_ctx. Every TLS client connection leaks an SSL object and an SSL_CTX.

2. server_delete leaks SSL_CTX
transport_tcp.c:52-57

Same issue on the server side — server_delete closes the fd and frees the struct but never calls SSL_CTX_free(server->ssl_ctx).

3. config_receive doesn't initialize TLS fields
config.c:107-154

When the server calls config_receive(), it does a raw malloc and only populates specific fields. use_tls, tls_cert, and tls_key are never initialized, leaving them as garbage. While nothing currently reads them on the server, this is technically undefined behavior.

4. tls_global_cleanup() is never called anywhere
transport_tls.c:24-30

Declared in the header but no code path invokes it. OpenSSL resources (error strings, algorithms) are leaked on exit. The global g_ssl_ctx is also never assigned to, making the cleanup dead code.

5. Deprecated OpenSSL 1.0.x API
transport_tls.c:17-22,29

SSL_library_init(), OpenSSL_add_all_algorithms(), SSL_load_error_strings(), EVP_cleanup() are all deprecated since OpenSSL 1.1.0 and removed in some OpenSSL 3.x builds. Since 1.1.0, initialization is automatic. These calls should be removed or guarded with #if OPENSSL_VERSION_NUMBER < 0x10100000L.

---

Security Concerns

6. No minimum TLS version enforced
transport_tls.c:33-34

create_ssl_ctx doesn't call SSL_CTX_set_min_proto_version(ctx, TLS1_2_VERSION). On older systems, TLS 1.0 or 1.1 could be negotiated — both are deprecated and have known vulnerabilities.

7. No server certificate verification on the client
transport_tls.c:32-61

create_ssl_ctx for the client never calls SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, ...). The client connects to the server without verifying its certificate, making it vulnerable to MITM attacks. This significantly undermines the value of TLS.

8. SSL errors dumped to stderr
transport_tls.c:38,46,52,58,79

ERR_print_errors_fp(stderr) leaks internal SSL error details (potentially including certificate paths, cipher info) to stdout. Should use the project's log_message system, or at minimum only log at debug level.

---

Design Issues

9. tls_global_init() called multiple times without guard
client_send.c:62,216

Called in both send_files() and send_chunks_multithreaded(). While the underlying calls are idempotent, this is wasteful and should be called once at startup.

10. Client allows NULL cert/key silently
transport_tls.c:41,149-150

create_ssl_ctx has an if (cert && key) guard that silently creates a context without a client certificate. On the server side, --tls requires --cert and --key. This asymmetry is confusing — the user might think --tls --cert cert.pem works, but it silently skips loading the cert if --key isn't provided.

11. server_listen_tls duplicates server_listen
transport_tls.c:93-134 vs transport_tcp.c:59-89

Nearly identical code (accept loop, fork, close fd). The only difference is the SSL handshake wrapper. Should share a common accept/fork loop or use a function pointer pattern.

12. -p port not validated
server.c:177

atoi(argv[++i]) returns 0 on failure with no error checking. No range validation (1-65535).

---

Minor / Style

13. No server --help / usage message
The server accepts --stdio, --verbose, --tls, --cert, --key, -p but has no help output.

14. __thread inconsistency
protocol.c:9-11 — io_read_fd and io_write_fd are __thread, but io_ssl is plain static. This works because of the fork-per-client model (each child has its own copy), but it's inconsistent and fragile if the threading model changes.

---

Summary

The most important fixes before merging:

1. Free SSL/SSL_CTX in client_disconnect/client_delete/server_delete (memory leaks)
2. Initialize TLS fields in config_receive (UB)
3. Add minimum TLS 1.2 version enforcement (security)
4. Add SSL_VERIFY_PEER on client + callback or flag (security)
5. Remove or gate deprecated OpenSSL API calls (portability)

## Code Review: TLS transport Overall this is a solid first TLS implementation. The architecture is clean and the integration with existing transport abstractions is well thought out. Below are the issues I found, organized by severity. --- ### CRITICAL / Bugs **1. Memory leaks: `SSL` and `SSL_CTX` not freed on client disconnect/delete** `transport_tcp.c:129-141` `client_disconnect()` only closes the fd and waits for SSH. `client_delete()` only frees the struct. Neither frees `client->ssl` or `client->ssl_ctx`. Every TLS client connection leaks an `SSL` object and an `SSL_CTX`. **2. `server_delete` leaks `SSL_CTX`** `transport_tcp.c:52-57` Same issue on the server side — `server_delete` closes the fd and frees the struct but never calls `SSL_CTX_free(server->ssl_ctx)`. **3. `config_receive` doesn't initialize TLS fields** `config.c:107-154` When the server calls `config_receive()`, it does a raw `malloc` and only populates specific fields. `use_tls`, `tls_cert`, and `tls_key` are never initialized, leaving them as garbage. While nothing currently reads them on the server, this is technically undefined behavior. **4. `tls_global_cleanup()` is never called anywhere** `transport_tls.c:24-30` Declared in the header but no code path invokes it. OpenSSL resources (error strings, algorithms) are leaked on exit. The global `g_ssl_ctx` is also never assigned to, making the cleanup dead code. **5. Deprecated OpenSSL 1.0.x API** `transport_tls.c:17-22,29` `SSL_library_init()`, `OpenSSL_add_all_algorithms()`, `SSL_load_error_strings()`, `EVP_cleanup()` are all deprecated since OpenSSL 1.1.0 and removed in some OpenSSL 3.x builds. Since 1.1.0, initialization is automatic. These calls should be removed or guarded with `#if OPENSSL_VERSION_NUMBER < 0x10100000L`. --- ### Security Concerns **6. No minimum TLS version enforced** `transport_tls.c:33-34` `create_ssl_ctx` doesn't call `SSL_CTX_set_min_proto_version(ctx, TLS1_2_VERSION)`. On older systems, TLS 1.0 or 1.1 could be negotiated — both are deprecated and have known vulnerabilities. **7. No server certificate verification on the client** `transport_tls.c:32-61` `create_ssl_ctx` for the client never calls `SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, ...)`. The client connects to the server without verifying its certificate, making it vulnerable to MITM attacks. This significantly undermines the value of TLS. **8. SSL errors dumped to stderr** `transport_tls.c:38,46,52,58,79` `ERR_print_errors_fp(stderr)` leaks internal SSL error details (potentially including certificate paths, cipher info) to stdout. Should use the project's `log_message` system, or at minimum only log at debug level. --- ### Design Issues **9. `tls_global_init()` called multiple times without guard** `client_send.c:62,216` Called in both `send_files()` and `send_chunks_multithreaded()`. While the underlying calls are idempotent, this is wasteful and should be called once at startup. **10. Client allows NULL cert/key silently** `transport_tls.c:41,149-150` `create_ssl_ctx` has an `if (cert && key)` guard that silently creates a context without a client certificate. On the server side, `--tls` requires `--cert` and `--key`. This asymmetry is confusing — the user might think `--tls --cert cert.pem` works, but it silently skips loading the cert if `--key` isn't provided. **11. `server_listen_tls` duplicates `server_listen`** `transport_tls.c:93-134` vs `transport_tcp.c:59-89` Nearly identical code (accept loop, fork, close fd). The only difference is the SSL handshake wrapper. Should share a common accept/fork loop or use a function pointer pattern. **12. `-p` port not validated** `server.c:177` `atoi(argv[++i])` returns 0 on failure with no error checking. No range validation (1-65535). --- ### Minor / Style **13. No server `--help` / usage message** The server accepts `--stdio`, `--verbose`, `--tls`, `--cert`, `--key`, `-p` but has no help output. **14. `__thread` inconsistency** `protocol.c:9-11` — `io_read_fd` and `io_write_fd` are `__thread`, but `io_ssl` is plain `static`. This works because of the fork-per-client model (each child has its own copy), but it's inconsistent and fragile if the threading model changes. --- ### Summary The most important fixes before merging: 1. Free `SSL`/`SSL_CTX` in `client_disconnect`/`client_delete`/`server_delete` (memory leaks) 2. Initialize TLS fields in `config_receive` (UB) 3. Add minimum TLS 1.2 version enforcement (security) 4. Add `SSL_VERIFY_PEER` on client + callback or flag (security) 5. Remove or gate deprecated OpenSSL API calls (portability)

TapTap commented 2026-07-16 17:05:14 +02:00

Author

Owner

Copy Link

Copy Source

Re-review of 7a314b8

Great update — most of the original issues are resolved. Here's a summary:

Fixed from previous review

• SSL/SSL cleanup in client_disconnect, client_delete, server_delete — done
• config_receive now initializes TLS fields — done
• Dead g_ssl_ctx and tls_global_cleanup removed — done
• Deprecated OpenSSL API guarded with #if OPENSSL_VERSION_NUMBER — done
• TLS 1.2 minimum enforced — done
• SSL_VERIFY_PEER support via --ca flag — done
• ERR_print_errors_fp(stderr) replaced with log_ssl_errors() using log_message — done
• tls_global_init() called once in main, removed from send_files/send_chunks_multithreaded — done
• Client validates --tls requires --cert and --key — done
• Shared accept_loop eliminates server_listen/server_listen_tls duplication — done
• Server --help added — done
• Port validation added — done

---

NEW CRITICAL BUG: __thread on io_ssl breaks TLS in multithreaded server mode

protocol.c:11

io_ssl was changed from static SSL *io_ssl = NULL; to static __thread SSL *io_ssl = NULL;.

In the server's multithreaded path (-m):

1. tls_child_fn calls io_set_ssl(ssl) in the forked child's main thread
2. handler() creates receiver and writer threads via thrd_create
3. receiver thread calls receive_n_data() → checks io_ssl → NULL (each __thread variable is per-thread, initialized from the static initializer)
4. TLS is silently bypassed — read()/write() used instead of SSL_read()/SSL_write()

The client side is unaffected because client_connect_tls() and send_chunk() both run in the same thread (send_chunks_multithreaded).

Fix: Remove __thread from io_ssl, making it plain static. This is safe because:

• Fork model (server): each child is a separate process with its own copy of static variables — no sharing issue
• Thread model (client): only one thread sets/reads io_ssl (the sender thread), so no race condition

The __thread on io_read_fd/io_write_fd is fine — those are only used in the --stdio single-threaded path.

---

Minor remaining issues

1. atoi for port parsing
server.c:195

atoi(argv[++i]) doesn't detect overflow (e.g., 99999999999). Use strtol with errno checking for robustness.

2. --ca without --tls

--ca is silently accepted even without --tls. The CA path sits unused in config. Minor, but could warn.

---

Summary

Must-fix:

1. Remove __thread from io_ssl — TLS is broken for server --tls -m (multithreaded mode)

## Re-review of 7a314b8 Great update — most of the original issues are resolved. Here's a summary: ### Fixed from previous review - SSL/SSL cleanup in `client_disconnect`, `client_delete`, `server_delete` — done - `config_receive` now initializes TLS fields — done - Dead `g_ssl_ctx` and `tls_global_cleanup` removed — done - Deprecated OpenSSL API guarded with `#if OPENSSL_VERSION_NUMBER` — done - TLS 1.2 minimum enforced — done - `SSL_VERIFY_PEER` support via `--ca` flag — done - `ERR_print_errors_fp(stderr)` replaced with `log_ssl_errors()` using `log_message` — done - `tls_global_init()` called once in main, removed from `send_files`/`send_chunks_multithreaded` — done - Client validates `--tls` requires `--cert` and `--key` — done - Shared `accept_loop` eliminates `server_listen`/`server_listen_tls` duplication — done - Server `--help` added — done - Port validation added — done --- ### NEW CRITICAL BUG: `__thread` on `io_ssl` breaks TLS in multithreaded server mode `protocol.c:11` `io_ssl` was changed from `static SSL *io_ssl = NULL;` to `static __thread SSL *io_ssl = NULL;`. In the server's multithreaded path (`-m`): 1. `tls_child_fn` calls `io_set_ssl(ssl)` in the forked child's main thread 2. `handler()` creates `receiver` and `writer` threads via `thrd_create` 3. `receiver` thread calls `receive_n_data()` → checks `io_ssl` → **NULL** (each `__thread` variable is per-thread, initialized from the static initializer) 4. TLS is silently bypassed — `read()`/`write()` used instead of `SSL_read()`/`SSL_write()` The client side is unaffected because `client_connect_tls()` and `send_chunk()` both run in the same thread (`send_chunks_multithreaded`). **Fix:** Remove `__thread` from `io_ssl`, making it plain `static`. This is safe because: - **Fork model (server):** each child is a separate process with its own copy of static variables — no sharing issue - **Thread model (client):** only one thread sets/reads `io_ssl` (the sender thread), so no race condition The `__thread` on `io_read_fd`/`io_write_fd` is fine — those are only used in the `--stdio` single-threaded path. --- ### Minor remaining issues **1. `atoi` for port parsing** `server.c:195` `atoi(argv[++i])` doesn't detect overflow (e.g., `99999999999`). Use `strtol` with `errno` checking for robustness. **2. `--ca` without `--tls`** `--ca` is silently accepted even without `--tls`. The CA path sits unused in config. Minor, but could warn. --- ### Summary Must-fix: 1. Remove `__thread` from `io_ssl` — TLS is broken for `server --tls -m` (multithreaded mode)

TapTap commented 2026-07-16 17:20:41 +02:00

Author

Owner

Copy Link

Copy Source

PR Review Summary

Verdict: FAIL — 3 critical issues must be fixed before merge

Files reviewed: 13
Issues found: 11 (3 critical, 6 warning, 2 style)

---

CRITICAL Issues

[1] src/shared/transport_tcp.c:51-56 — memory leak
server_delete() does not free ssl_ctx. When TLS is used, server_create_tls() stores an SSL_CTX* in server->ssl_ctx, but server_delete() only closes the fd and frees the struct — the SSL_CTX leaks.
Fix: Add to server_delete() before close:

if ((*server)->ssl_ctx) SSL_CTX_free((*server)->ssl_ctx);

[2] src/shared/transport_tcp.c:126-138 — memory leak + protocol violation
client_disconnect() and client_delete() do not clean up ssl or ssl_ctx. This leaks the SSL session/context and fails to send TLS close_notify (peer sees abrupt TCP close).
Fix: In client_disconnect(), before close(fd):

if (client->ssl) { SSL_shutdown(client->ssl); SSL_free(client->ssl); client->ssl = NULL; }

In client_delete(), before free(client):

if (client->ssl_ctx) { SSL_CTX_free(client->ssl_ctx); client->ssl_ctx = NULL; }

Note: ssl_ctx must be freed AFTER ssl since ssl was created from ssl_ctx.

[3] src/shared/config.c:101-149 — uninitialized fields
config_receive() uses malloc(sizeof(Config)) (not calloc) and does NOT initialize the new fields: use_tls, tls_cert, tls_key. These will contain garbage values → undefined behavior.
Fix: Add after config->min_size = 0:

config->use_tls = false;
config->tls_cert = NULL;
config->tls_key = NULL;

---

Warnings

• protocol.c:10 — io_ssl is a plain global while io_read_fd/io_write_fd are __thread. Add __thread or document thread-safety contract.
• transport_tls.c:17-21 — tls_global_init() ignores SSL_library_init() return; should check for failure.
• transport_tls.c:15,25-29 — g_ssl_ctx is declared but never assigned; dead code. Remove it.
• client_send.c:62,206 — No validation that both --cert and --key are provided when --tls is used. Silent cert ignore if one is missing.
• transport_tls.c:17-21,25-29 — tls_global_cleanup() is never called anywhere. OpenSSL resources leaked on exit.
• transport_tls.c:17-21 — SSL_library_init() etc. deprecated since OpenSSL 1.1.0; produces warnings on OpenSSL 3.x.

Style

• protocol.h:12 — io_set_ssl() takes void *ssl instead of SSL *ssl; consider type safety.
• server.c:169 — atoi() for port parsing silently returns 0 for non-numeric input; use strtol().

## PR Review Summary **Verdict: FAIL** — 3 critical issues must be fixed before merge **Files reviewed:** 13 **Issues found:** 11 (3 critical, 6 warning, 2 style) --- ### CRITICAL Issues **[1] `src/shared/transport_tcp.c:51-56` — memory leak** `server_delete()` does not free `ssl_ctx`. When TLS is used, `server_create_tls()` stores an `SSL_CTX*` in `server->ssl_ctx`, but `server_delete()` only closes the fd and frees the struct — the SSL_CTX leaks. **Fix:** Add to `server_delete()` before close: ```c if ((*server)->ssl_ctx) SSL_CTX_free((*server)->ssl_ctx); ``` **[2] `src/shared/transport_tcp.c:126-138` — memory leak + protocol violation** `client_disconnect()` and `client_delete()` do not clean up `ssl` or `ssl_ctx`. This leaks the SSL session/context and fails to send TLS `close_notify` (peer sees abrupt TCP close). **Fix:** In `client_disconnect()`, before `close(fd)`: ```c if (client->ssl) { SSL_shutdown(client->ssl); SSL_free(client->ssl); client->ssl = NULL; } ``` In `client_delete()`, before `free(client)`: ```c if (client->ssl_ctx) { SSL_CTX_free(client->ssl_ctx); client->ssl_ctx = NULL; } ``` Note: `ssl_ctx` must be freed AFTER `ssl` since ssl was created from ssl_ctx. **[3] `src/shared/config.c:101-149` — uninitialized fields** `config_receive()` uses `malloc(sizeof(Config))` (not `calloc`) and does NOT initialize the new fields: `use_tls`, `tls_cert`, `tls_key`. These will contain garbage values → undefined behavior. **Fix:** Add after `config->min_size = 0`: ```c config->use_tls = false; config->tls_cert = NULL; config->tls_key = NULL; ``` --- ### Warnings - **`protocol.c:10`** — `io_ssl` is a plain global while `io_read_fd`/`io_write_fd` are `__thread`. Add `__thread` or document thread-safety contract. - **`transport_tls.c:17-21`** — `tls_global_init()` ignores `SSL_library_init()` return; should check for failure. - **`transport_tls.c:15,25-29`** — `g_ssl_ctx` is declared but never assigned; dead code. Remove it. - **`client_send.c:62,206`** — No validation that both `--cert` and `--key` are provided when `--tls` is used. Silent cert ignore if one is missing. - **`transport_tls.c:17-21,25-29`** — `tls_global_cleanup()` is never called anywhere. OpenSSL resources leaked on exit. - **`transport_tls.c:17-21`** — `SSL_library_init()` etc. deprecated since OpenSSL 1.1.0; produces warnings on OpenSSL 3.x. ### Style - `protocol.h:12` — `io_set_ssl()` takes `void *ssl` instead of `SSL *ssl`; consider type safety. - `server.c:169` — `atoi()` for port parsing silently returns 0 for non-numeric input; use `strtol()`.

TapTap commented 2026-07-17 09:57:44 +02:00

Author

Owner

Copy Link

Copy Source

Re-review after commits 7a314b8 + df85509

Verdict: PASS — All 3 critical issues fixed

Critical issues — all resolved

• [1] server_delete() now frees ssl_ctx ✅
• [2] client_disconnect() calls SSL_shutdown/SSL_free; client_delete() frees ssl_ctx ✅
• [3] config_receive() initializes use_tls, tls_cert, tls_key (and new tls_ca) ✅

Warnings — all resolved or addressed

• io_ssl no longer __thread ✅
• tls_global_init() now has deprecation guards for OpenSSL < 1.1.0 ✅
• Dead g_ssl_ctx removed ✅
• tls_global_cleanup() removed (was never called) ✅
• --tls now validates both --cert and --key are provided ✅
• Port parsing uses strtol() with range validation (1-65535) ✅
• --ca option added for CA certificate verification ✅
• Server now has --help and unknown option detection ✅
• Accept loop refactored into shared accept_loop() — cleaner code ✅

Remaining minor items

• protocol.h:12 — io_set_ssl() still takes void *ssl (acceptable, hides OpenSSL dep from header)

Safe to merge.

## Re-review after commits `7a314b8` + `df85509` **Verdict: PASS** — All 3 critical issues fixed ### Critical issues — all resolved - [1] `server_delete()` now frees `ssl_ctx` ✅ - [2] `client_disconnect()` calls `SSL_shutdown`/`SSL_free`; `client_delete()` frees `ssl_ctx` ✅ - [3] `config_receive()` initializes `use_tls`, `tls_cert`, `tls_key` (and new `tls_ca`) ✅ ### Warnings — all resolved or addressed - `io_ssl` no longer `__thread` ✅ - `tls_global_init()` now has deprecation guards for OpenSSL < 1.1.0 ✅ - Dead `g_ssl_ctx` removed ✅ - `tls_global_cleanup()` removed (was never called) ✅ - `--tls` now validates both `--cert` and `--key` are provided ✅ - Port parsing uses `strtol()` with range validation (1-65535) ✅ - `--ca` option added for CA certificate verification ✅ - Server now has `--help` and unknown option detection ✅ - Accept loop refactored into shared `accept_loop()` — cleaner code ✅ ### Remaining minor items - `protocol.h:12` — `io_set_ssl()` still takes `void *ssl` (acceptable, hides OpenSSL dep from header) Safe to merge.

TapTap force-pushed tls-transport from b54d5eb102 to 017c119472 2026-07-17 10:51:53 +02:00 Compare

TapTap commented 2026-07-17 10:57:33 +02:00

Author

Owner

Copy Link

Copy Source

Re-review after commits ff3e02e + 017c119

Verdict: PASS — Two good defensive fixes added

New changes

ff3e02e — SSL type safety + stale pointer prevention:

• protocol.h: Added typedef struct ssl_st SSL; forward declaration — proper type safety for io_set_ssl() instead of void* ✅
• transport_tcp.c: Added io_set_ssl(NULL) in client_disconnect() — prevents stale SSL pointer access after disconnect ✅

017c119 — Use-after-free prevention:

• transport_ssh.c: client->ssl = NULL; client->ssl_ctx = NULL; initialized in client_connect_ssh() — prevents SSL_free/SSL_CTX_free on uninitialized pointers if client_disconnect()/client_delete() is called on an SSH client ✅

Both are small, targeted, correct. No new issues.

Safe to merge.

## Re-review after commits `ff3e02e` + `017c119` **Verdict: PASS** — Two good defensive fixes added ### New changes **`ff3e02e` — SSL type safety + stale pointer prevention:** - `protocol.h`: Added `typedef struct ssl_st SSL;` forward declaration — proper type safety for `io_set_ssl()` instead of `void*` ✅ - `transport_tcp.c`: Added `io_set_ssl(NULL)` in `client_disconnect()` — prevents stale SSL pointer access after disconnect ✅ **`017c119` — Use-after-free prevention:** - `transport_ssh.c`: `client->ssl = NULL; client->ssl_ctx = NULL;` initialized in `client_connect_ssh()` — prevents `SSL_free`/`SSL_CTX_free` on uninitialized pointers if `client_disconnect()`/`client_delete()` is called on an SSH client ✅ Both are small, targeted, correct. No new issues. Safe to merge.

TapTap added 5 commits 2026-07-18 17:40:58 +02:00

TLS transport: OpenSSL-based encrypted TCP ... eff50346fd

- New transport_tls.h/c: TLS server (server_create_tls, server_listen_tls)
  and client (client_connect_tls) using OpenSSL
- protocol.c: io_set_ssl() + SSL_read/SSL_write in send_n_data/receive_n_data
- transport_tcp.h: ssl/ssl_ctx fields added to Server/Client structs
- config.h/c: use_tls, tls_cert, tls_key fields
- client_cli.c: --tls, --cert, --key flags
- server.c: --tls, --cert, --key, -p flags with TLS support
- CMakeLists.txt: OpenSSL::SSL + OpenSSL::Crypto linkage
- shell.nix: openssl added to buildInputs

Fix TLS code review issues: SSL cleanup, TLS 1.2 min, CA verify, deprecation guards, server --help, port validation, __thread io_ssl, shared accept loop 864eb1316d

Fix re-review: remove __thread from io_ssl (breaks -m), strtol port parsing, --ca warning 20ede4391c

fix: io_set_ssl NULL in client_disconnect, SSL* type safety in protocol.h 8b6550f8c6

fix: initialize ssl/ssl_ctx in client_connect_ssh to prevent use-after-free 907baf3379

TapTap force-pushed tls-transport from 017c119472 to 907baf3379 2026-07-18 17:40:58 +02:00 Compare

TapTap added 1 commit 2026-07-18 17:43:47 +02:00

ci: add libssl-dev to Docker image for TLS transport 43cf0bd81e

TapTap added 1 commit 2026-07-18 17:50:57 +02:00

ci: retrigger CI with updated Docker image 6de0998f69

TapTap added 1 commit 2026-07-18 17:53:10 +02:00

ci: use v5 Docker image to force runner to pull updated image with libssl-dev fed77f6ce0

TapTap merged commit 0642a43c2c into main 2026-07-18 17:54:26 +02:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

bug

Defect or bug

enhancement

Feature or improvement

memory

Memory safety issue

needs-triage

Needs human review

performance

Performance issue

quality

Code quality improvement

security

Security vulnerability

threading

Threading or concurrency

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

TapTap

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: TapTap/FastSync#13