feat: S03.08 TLS hardening — cert validation, cipher pinning, lifecycle cleanup#183

Merged

DavidCozens merged 33 commits into

mainfrom

feat/s03-08-tls-integration-harness

Apr 22, 2026

Commits on Apr 21, 2026

test: S03.08 in-process TLS integration harness with real libssl

DavidCozens
and
claude
committed
test: S03.08 integration tests for TLS handshake rejection paths

DavidCozens
and
claude
committed
fix: S03.08 block handshake when SSL_set1_host fails

DavidCozens
and
claude
committed
fix: S03.08 block handshake when SNI hostname setup fails

DavidCozens
and
claude
committed
fix: S03.08 abort Open when SSL_CTX_new returns NULL

DavidCozens
and
claude
committed
fix: S03.08 abort Open when SSL_new returns NULL

DavidCozens
and
claude
committed
fix: S03.08 abort Open when SSL_CTX_load_verify_locations fails

DavidCozens
and
claude
committed
fix: S03.08 abort Open when TLS 1.2 floor cannot be set

DavidCozens
and
claude
committed

Commits on Apr 22, 2026

fix: S03.08 free BIO_METHOD on Close

DavidCozens
and
claude
committed
fix: S03.08 BIO_METHOD freed exactly once across Close/Destroy

DavidCozens
and
claude
committed
fix: S03.08 SSL freed exactly once across Close/Destroy

DavidCozens
and
claude
committed
fix: S03.08 abort Open when BIO_meth_new returns NULL

DavidCozens
and
claude
committed
fix: S03.08 abort Open when BIO_new returns NULL and free BIO_METHOD

DavidCozens
and
claude
committed
feat: S03.08 forward SolidSyslogTlsStreamConfig.cipherList to libssl

DavidCozens
and
claude
committed
fix: S03.08 abort Open when cipher list is rejected by libssl

DavidCozens
and
claude
committed
test: S03.08 integration test for cipher list rejection

DavidCozens
and
claude
committed
docs: S03.08 document SL4 TLS hardening in iec62443.md

DavidCozens
and
claude
committed
docs: update DEVLOG for S03.08 TLS hardening session

DavidCozens
and
claude
committed
chore: S03.08 satisfy clang-format and clang-tidy on new TLS code

DavidCozens
and
claude
committed
chore: S03.08 address CodeRabbit review on PR #183

DavidCozens
and
claude
committed
refactor: extract ConfigureExpectedHostname from Open

DavidCozens
and
claude
committed
refactor: extract AttachTransportBio from Open

DavidCozens
and
claude
committed
refactor: extract ReleaseHandshakeState from Close and Destroy

DavidCozens
and
claude
committed
refactor: single-exit Open via && chain of named steps

DavidCozens
and
claude
committed
refactor: single-exit CreateSslContext with named configurers

DavidCozens
and
claude
committed
refactor: split CreateTransportBioMethod out of CreateTransportBio

DavidCozens
and
claude
committed
refactor: single-exit TransportBioCtrl

DavidCozens
and
claude
committed
refactor: order functions top-down, depth-first from callers

DavidCozens
and
claude
committed
refactor: extract ReleaseSsl, ReleaseBioMethod, ReleaseSslContext

DavidCozens
and
claude
committed
refactor: vtable is a static const, not per-instance assignment

DavidCozens
and
claude
committed
refactor: prefix all TU-local functions with TlsStream_

DavidCozens
and
claude
committed
refactor: mark all TU-local static functions static inline

DavidCozens
and
claude
committed
fix: S03.08 OpenSslFake stores BIO data per-instance

DavidCozens
and
claude
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: S03.08 TLS hardening — cert validation, cipher pinning, lifecycle cleanup#183

feat: S03.08 TLS hardening — cert validation, cipher pinning, lifecycle cleanup#183
DavidCozens merged 33 commits into
mainfrom
feat/s03-08-tls-integration-harness

Commits on Apr 21, 2026

test: S03.08 in-process TLS integration harness with real libssl

test: S03.08 integration tests for TLS handshake rejection paths

fix: S03.08 block handshake when SSL_set1_host fails

fix: S03.08 block handshake when SNI hostname setup fails

fix: S03.08 abort Open when SSL_CTX_new returns NULL

fix: S03.08 abort Open when SSL_new returns NULL

fix: S03.08 abort Open when SSL_CTX_load_verify_locations fails

fix: S03.08 abort Open when TLS 1.2 floor cannot be set

Commits on Apr 22, 2026

fix: S03.08 free BIO_METHOD on Close

fix: S03.08 BIO_METHOD freed exactly once across Close/Destroy

fix: S03.08 SSL freed exactly once across Close/Destroy

fix: S03.08 abort Open when BIO_meth_new returns NULL

fix: S03.08 abort Open when BIO_new returns NULL and free BIO_METHOD

feat: S03.08 forward SolidSyslogTlsStreamConfig.cipherList to libssl

fix: S03.08 abort Open when cipher list is rejected by libssl

test: S03.08 integration test for cipher list rejection

docs: S03.08 document SL4 TLS hardening in iec62443.md

docs: update DEVLOG for S03.08 TLS hardening session

chore: S03.08 satisfy clang-format and clang-tidy on new TLS code

chore: S03.08 address CodeRabbit review on PR #183

refactor: extract ConfigureExpectedHostname from Open

refactor: extract AttachTransportBio from Open

refactor: extract ReleaseHandshakeState from Close and Destroy

refactor: single-exit Open via && chain of named steps

refactor: single-exit CreateSslContext with named configurers

refactor: split CreateTransportBioMethod out of CreateTransportBio

refactor: single-exit TransportBioCtrl

refactor: order functions top-down, depth-first from callers

refactor: extract ReleaseSsl, ReleaseBioMethod, ReleaseSslContext

refactor: vtable is a static const, not per-instance assignment

refactor: prefix all TU-local functions with TlsStream_

refactor: mark all TU-local static functions static inline

fix: S03.08 OpenSslFake stores BIO data per-instance