From 24a07a0bbfe98924b339f4ffeeaef093e74f73fb Mon Sep 17 00:00:00 2001 From: eunhhu Date: Sun, 27 Sep 2026 08:12:23 +0100 Subject: Deliver to https receivers, verifying their certificates (083) A wire to an https:// URL speaks TLS 1.2 or later through OpenSSL: the receiver's certificate must chain to the system's CAs (or to the file --send-ca names) and name its host (SNI and SSL_set1_host, or the IP address). An untrusted receiver gets nothing: the send stays in the outbox, the wire logs it and tries again every 10 s. pure-serve now links libssl and libcrypto. --- prototypes/connections/serve.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'prototypes/connections/serve.c') diff --git a/prototypes/connections/serve.c b/prototypes/connections/serve.c index 2ecb780..d175e29 100644 --- a/prototypes/connections/serve.c +++ b/prototypes/connections/serve.c @@ -1839,6 +1839,7 @@ int main(int argc, char **argv) { else if (!strcmp(argv[i], "--store")) store = argv[i + 1]; else if (!strcmp(argv[i], "--send") && send_count < PURE_MODULE_INPUTS) sends[send_count++] = argv[i + 1]; else if (!strcmp(argv[i], "--name")) name = argv[i + 1]; + else if (!strcmp(argv[i], "--send-ca")) pure_wire_trust(argv[i + 1]); else if (!strcmp(argv[i], "--port") && number(argv[i + 1], 65535, &value)) port = (unsigned)value; else if (!strcmp(argv[i], "--budget") && number(argv[i + 1], SIZE_MAX, &value) && value) budget = (size_t)value; else if (!strcmp(argv[i], "--connections") && number(argv[i + 1], 1u << 20, &value) && value) capacity = (size_t)value; @@ -1948,6 +1949,7 @@ int main(int argc, char **argv) { return 0; usage: fputs("pure-serve --module FILE.pmod --store DIRECTORY [--port 8767] [--threads 1|N|auto] [--budget BYTES] " - "[--connections 1024] [--timeout-ms 10000] [--send OUTPUT=http://host:port/path ...] [--name NAME]\n", stderr); + "[--connections 1024] [--timeout-ms 10000] [--send OUTPUT=http[s]://host:port/path ...] [--name NAME] " + "[--send-ca FILE]\n", stderr); return 2; } -- cgit v1.2.3