crypto/tls, now with 100% more 1.3. THE API IS NOT STABLE AND DOCUMENTATION IS NOT GUARANTEED.
Permalink
Failed to load latest commit information.
_dev go 1.11: Switch to GO 1.11 Oct 17, 2018
testdata crypto/tls: add examples for [Load]X509KeyPair Oct 17, 2018
.travis.yml go 1.11: Switch to GO 1.11 Oct 17, 2018
13.go don't expect CertificateVerify when the client doesn't send any cert Oct 12, 2018
README.md Minimal number of changes needed to udpate to draft-28 (#115) Aug 9, 2018
alert.go Add EMS support to tls-tris Sep 7, 2018
auth.go test: adds tests for rsa-pss signatures Oct 17, 2018
auth_test.go test: adds tests for rsa-pss signatures Oct 17, 2018
cipher_suites.go Minimal number of changes needed to udpate to draft-28 (#115) Aug 9, 2018
common.go test: adds tests for rsa-pss signatures Oct 17, 2018
conn.go Add EMS support to tls-tris Sep 7, 2018
conn_test.go crypto/tls: fix first byte test for 255 CBC padding bytes Oct 6, 2017
example_test.go crypto/tls: add examples for [Load]X509KeyPair Oct 17, 2018
generate_cert.go crypto/tls: handle errors in generate_cert.go Oct 17, 2018
handshake_client.go moves methods from Config to Conn receives Oct 9, 2018
handshake_client_test.go test: adds tests for rsa-pss signatures Oct 17, 2018
handshake_messages.go Add EMS support to tls-tris Sep 7, 2018
handshake_messages_test.go Add EMS support to tls-tris Sep 7, 2018
handshake_server.go don't expect CertificateVerify when the client doesn't send any cert Oct 12, 2018
handshake_server_test.go go 1.11: Switch to GO 1.11 Oct 17, 2018
handshake_test.go crypto/tls: advertise support for SHA-512 signatures in 1.2 Nov 8, 2017
hkdf.go crypto/tls: implement TLS 1.3 minimal server Sep 5, 2017
key_agreement.go Refactor the keyAgreement interface Jun 29, 2018
prf.go Add EMS support to tls-tris Sep 7, 2018
prf_test.go Add EMS support to tls-tris Sep 7, 2018
subcerts.go Cleanup Aug 10, 2018
subcerts_test.go Swap TLS 1.3 to RFC 8446 Sep 16, 2018
ticket.go Add EMS support to tls-tris Sep 7, 2018
tls.go crypto/tls: parse certificate first in X509KeyPair to get better errors Oct 17, 2018
tls_test.go Add EMS support to tls-tris Sep 7, 2018

README.md

 _____ _     ____        _        _
|_   _| |   / ___|      | |_ _ __(_)___
  | | | |   \___ \ _____| __| '__| / __|
  | | | |___ ___) |_____| |_| |  | \__ \
  |_| |_____|____/       \__|_|  |_|___/

crypto/tls, now with 100% more 1.3.

THE API IS NOT STABLE AND DOCUMENTATION IS NOT GUARANTEED.

Build Status

Usage

Since crypto/tls is very deeply (and not that elegantly) coupled with the Go stdlib, tls-tris shouldn't be used as an external package. It is also impossible to vendor it as crypto/tls because stdlib packages would import the standard one and mismatch.

So, to build with tls-tris, you need to use a custom GOROOT.

A script is provided that will take care of it for you: ./_dev/go.sh. Just use that instead of the go tool.

The script also transparently fetches the custom Cloudflare Go 1.10 compiler with the required backports.

Development

Dependencies

Copy paste line bellow to install all required dependencies:

  • ArchLinux:
pacman -S go docker gcc git make patch python2 python-docker rsync
  • Debian:
apt-get install build-essential docker go patch python python-pip rsync
pip install setuptools
pip install docker
  • Ubuntu (18.04) :
apt-get update
apt-get install build-essential docker docker.io golang patch python python-pip rsync sudo
pip install setuptools
pip install docker
sudo usermod -a -G docker $USER

Similar dependencies can be found on any UNIX based system/distribution.

Building

There are number of things that need to be setup before running tests. Most important step is to copy go env GOROOT directory to _dev and swap TLS implementation and recompile GO. Then for testing we use go implementation from _dev/GOROOT.

git clone https://github.com/cloudflare/tls-tris.git
cd tls-tris; cp _dev/utils/pre-commit .git/hooks/ 
make -f _dev/Makefile build-all

Testing

We run 3 kinds of test:.

  • Unit testing:
    make -f _dev/Makefile test-unit
  • Testing against BoringSSL test suite:
    make -f _dev/Makefile test-bogo
  • Compatibility testing (see below):
    make -f _dev/Makefile test-interop

To run all the tests in one go use:

make -f _dev/Makefile test

Testing interoperability with 3rd party libraries

In order to ensure compatibility we are testing our implementation against BoringSSL, NSS and PicoTLS.

Makefile has a specific target for testing interoperability with external libraries. Following command can be used in order to run such test:

make -f _dev/Makefile test-interop

The makefile target is just a wrapper and it executes _dev/interop_test_runner script written in python. The script implements interoperability tests using python unittest framework.

Script can be started from command line directly. For example:

> ./interop_test_runner -v InteropServer_NSS.test_zero_rtt
test_zero_rtt (__main__.InteropServer_NSS) ... ok

----------------------------------------------------------------------
Ran 1 test in 8.765s

OK

Debugging

When the environment variable TLSDEBUG is set to error, Tris will print a hexdump of the Client Hello and a stack trace if an handshake error occurs. If the value is short, only the error and the first meaningful stack frame are printed.