软件包：tlswrapper（0~20230101-1）

[ 源代码： tlswrapper  ]

TLS encryption wrapper

The tlswrapper is an TLS encryption wrapper between remote client and local program prog.

Internet <--> tcpserver/inetd/systemd.socket/... <--> tlswrapper <--> prog

Separate process for every connection

The tlswrapper is executed from systemd.socket/inetd/tcpserver/... which runs separate instance of tlswrapper for each TLS connection. It ensures that a vulnerability in the code (e.g. bug in the TLS library) can't be used to compromise the memory of another connection.

Separate process for network connection and for secret-key operation

To protect against secret-information leaks to the network connection (such Heartbleed) tlswrapper runs two independent processes for every TLS connection. One process holds secret-keys and runs secret-keys operations and second talks to the network. Processes communicate with each other through unix pipes.

Privilege separation, filesystem isolation, limits

The tlswrapper processes run under dedicated non-zero uid to prohibit kill, ptrace, etc. Is chrooted into an empty, unwritable directory to prohibit filesystem access. Sets ulimits to prohibit new files, sockets, etc. Sets ulimits to prohibit forks.

TLS library

The tlswrapper is using BearSSL library which implements only secure versions of TLS protocol (TLS1.0 - TLS1.2). And implements safe and constant-time algorithms.

其他与 tlswrapper 有关的软件包

• dep: libbearssl0 (>= 0.6) [amd64]

  BearSSL - shared libraries

  dep: libbearssl0 (>= 0.6+dfsg.1) [除 amd64]

• dep: libc6 (>= 2.34)

  GNU C 语言运行库：共享库
  同时作为一个虚包由这些包填实： libc6-udeb

下载 tlswrapper

下载可用于所有硬件架构的

硬件架构	软件包大小	安装后大小	文件
amd64	50.1 kB	195.0 kB	[文件列表]
arm64	46.7 kB	202.0 kB	[文件列表]
armel	49.3 kB	187.0 kB	[文件列表]
armhf	49.1 kB	159.0 kB	[文件列表]
i386	52.0 kB	183.0 kB	[文件列表]
mips64el	49.7 kB	212.0 kB	[文件列表]
mipsel	55.4 kB	272.0 kB	[文件列表]
ppc64el	48.4 kB	202.0 kB	[文件列表]
s390x	47.3 kB	202.0 kB	[文件列表]