shoney.arickathil
53485a748c
Compared §F3c-net's forks against gofiber v3's client (fasthttp + Go crypto/tls/x509, .dev/reference/fiber). Two gaps my defaults had vs Go, now locked as decisions 5 and 6: - (5) bounded handshake deadline: the blocking model would let a stalled server hang the shard's one thread indefinitely (the DoS DoTimeout closes). connect_tls now bounds connect+handshake via non-blocking connect+poll + SO_RCVTIMEO/SNDTIMEO, default WO_TLS_HANDSHAKE_MS (10s); expiry traps WO_T_IO. _dl variant + park handshake stay follow-ups - (6) chain hardening: signatures+validity+SAN alone let a leaf act as a CA. Now every non-leaf must assert basicConstraints CA:TRUE (+pathLen) and the leaf must carry EKU serverAuth — what Go's crypto/x509 enforces - acceptance criteria added (stalled-server timeout; leaf-as-CA + no-EKU rejected); connect_tls bullet, frontmatter review_pending, status NEXT PLAN updated to six locked forks Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> (cherry picked from commit 9662cd8b040f417b4886dae9ce97b70083e24e40) |
||
|---|---|---|
| .. | ||
| 00-story.md | ||
| 01-streaming-subprocess.md | ||
| 02-pty.md | ||
| 03-signals-as-events.md | ||
| 04-termios.md | ||
| 05-fd-passing.md | ||
| 06-term-size-width.md | ||
| 07-observability.md | ||
| 08-symmetric-cipher.md | ||
| 09-in-process-tls.md | ||