Skip to content

colibri 0.2.0: each TLS session draws from its caller's source, and a failed handshake sends its alert

Choose a tag to compare

View all tags
@c4milo c4milo released this 27 Sep 22:28
· 861 commits to main since this release
v0.2.0
e42206d

Each TLS session now draws its randomness from a source its caller passes, so a program that seeds that source replays the session. A failed handshake also hands its alert to the caller to send, and tls names the limits a caller sizes its buffers by. chapulin is pinned at 5ae9182.

Breaking

  • start on tls.record.Client, tls.record.Server, tls.quic.Client and tls.quic.Server takes a tls.Random, a std.Random, right after its configuration. ServerConfig.check takes one too, for an RSA-PSS salt. Every draw a session makes comes from that source, and chapulin refuses a session without one.
  • A program that links tls no longer defines ch_rand_bytes. chapulin is built RAND=session, and ch_assert_fail is its one hook.

To move from 0.1.0, pass a source over your operating system's generator to each start and check, and delete your ch_rand_bytes. The generator must outlive the session. docs/usage.md shows one over getentropy.

Added

  • failure_written() on tls.record.Client and Server. After handshake fails, it counts the octets the call wrote at the front of its output, the alert that says why last (RFC 9846 §6.2). The caller sends them, then closes.
  • tls.record.alert_record_len, tls.record.Client.handshake_output_len_min, and each configuration's anchors_max and protocols_max.

Checked against

  • Go reads colibri's alert in four refused handshakes: "protocol version not supported" from colibri's server, and "bad certificate" and "unknown certificate authority" from its client.
  • Two tests replay a record handshake and a QUIC handshake from a seed: one seed writes the same octets twice, and a new seed for either side changes what that side writes.
  • h2spec 2.6.0 (144 of 146 in cleartext and over TLS), h3spec 0.1.13 (49 examples, 0 failures), and the interop scripts against curl, nghttp, Go, nghttpd, h2o and aioquic all pass.

docs/design.md §8 step 16 records each check: what ran, on what machine, and what it printed.

Install

zig fetch --save git+https://github.com/c4milo/colibri#v0.2.0
Assets 2
Loading