lunarmodules / copas

85%

LAST BUILD ON BRANCH master

branch: SELECT

CHANGE BRANCH

x

• No branch selected
• datagram
• debug
• debug-socket
• docs
• drop/limitset
• errhandler
• feat/more-stats
• fix/autoclose
• fix/docs
• fix/html
• fix/http-sni
• fix/removethread
• fix/timeout
• fix/timer
• fix/unexpected-yielding
• fixes
• gc
• gcaid
• http
• httprequest
• huge
• loop
• luasocket
• master
• namedthread
• pause
• queue
• receivepartial
• refs/pull/108/merge
• refs/pull/111/merge
• refs/pull/112/merge
• refs/pull/114/merge
• refs/pull/117/merge
• refs/pull/119/merge
• refs/pull/120/merge
• refs/pull/121/merge
• refs/pull/123/merge
• refs/pull/124/merge
• refs/pull/125/merge
• refs/pull/126/merge
• refs/pull/127/merge
• refs/pull/128/merge
• refs/pull/129/merge
• refs/pull/130/merge
• refs/pull/131/merge
• refs/pull/132/merge
• refs/pull/133/merge
• refs/pull/134/merge
• refs/pull/135/merge
• refs/pull/136/merge
• refs/pull/137/merge
• refs/pull/140/merge
• refs/pull/141/merge
• refs/pull/142/merge
• refs/pull/143/merge
• refs/pull/144/merge
• refs/pull/145/merge
• refs/pull/146/merge
• refs/pull/147/merge
• refs/pull/148/merge
• refs/pull/149/merge
• refs/pull/150/merge
• refs/pull/152/merge
• refs/pull/153/merge
• refs/pull/154/merge
• refs/pull/155/merge
• refs/pull/156/merge
• refs/pull/157/merge
• refs/pull/158/merge
• refs/pull/160/merge
• refs/pull/161/merge
• refs/pull/162/merge
• refs/pull/167/merge
• refs/pull/169/merge
• refs/pull/170/merge
• refs/pull/171/merge
• refs/pull/172/merge
• refs/pull/173/merge
• refs/pull/174/merge
• refs/pull/175/merge
• refs/pull/176/merge
• refs/pull/177/merge
• refs/pull/179/merge
• refs/pull/180/merge
• refs/pull/181/merge
• refs/pull/182/merge
• refs/pull/183/merge
• refs/pull/184/merge
• refs/pull/186/merge
• refs/pull/187/merge
• refs/pull/192/merge
• refs/pull/193/merge
• refs/pull/194/merge
• refs/pull/195/merge
• refs/pull/196/merge
• refs/pull/200/merge
• refs/pull/202/merge
• refs/pull/204/merge
• refs/pull/205/merge
• refs/pull/207/merge
• refs/pull/209/merge
• refs/pull/211/merge
• refs/tags/4.0.0
• refs/tags/4.1.0
• refs/tags/4.2.0
• refs/tags/4.3.0
• refs/tags/4.3.1
• refs/tags/4.3.2
• refs/tags/4.4.0
• refs/tags/4.5.0
• refs/tags/4.6.0
• refs/tags/4.7.0
• refs/tags/v4_0_0
• refs/tags/v4_2_0
• refs/tags/v4_3_0
• refs/tags/v4_3_1
• refs/tags/v4_3_2
• refs/tags/v4_4_0
• refs/tags/v4_5_0
• refs/tags/v4_6_0
• refs/tags/v4_7_0
• release
• ringsize
• sema
• sempahore/timeout
• several
• starvation
• status
• submodules
• test/redirect
• timeout-err
• timer-errors
• wrapper

Build # 30305613508

Build Type

push

github

Committed by Tieske

Commit Message

fix(tls): reject sslparams tables that silently disable TLS

normalize_sslt() detected the current {wrap=, sni=} table format by
checking for the legacy 'mode'/'protocol' keys, so any table lacking
those (an empty table, or one with unrelated/misspelled keys) fell
into the "current format" branch and both wrap and sni silently
defaulted to false, identical to passing nil. Since a doc-comment
claimed an empty table meant "TLS with defaults" (no such defaults
exist -- a certificate is mandatory), following that comment produced
a plaintext socket with no error.

Detection is now based on the presence of the 'wrap'/'sni' keys
themselves. Anything without them (empty table, garbage keys, or a
genuine legacy flat luasec-context table) is passed straight through
as 'wrap' parameters, which LuaSec validates and errors on when a
handshake is actually attempted -- so this can no longer fail open
into silent plaintext.

Adds tests/tls-params.lua covering all normalization shapes: no
params, empty/garbage tables, the legacy flat table, and the current
{wrap=, sni=} table.

Fixes #210

Coverage Stats

3 of 3 new or added lines in 1 file covered. (100.0%)

48 existing lines in 1 file now uncovered.

1472 of 1730 relevant lines covered (85.09%)

57213.92 hits per line