Removes _dev
This commit is contained in:
parent
c1c7bfa053
commit
3c361d8664
@ -18,8 +18,5 @@ matrix:
|
||||
before_install:
|
||||
- make -f _dev/Makefile fmtcheck
|
||||
|
||||
install:
|
||||
- sudo pip install docker
|
||||
|
||||
script:
|
||||
- make -f _dev/Makefile build-all && make -f _dev/Makefile "$TEST_SUITE"
|
||||
- go test -v -r=.
|
||||
|
||||
6
_dev/.gitignore
vendored
6
_dev/.gitignore
vendored
@ -1,6 +0,0 @@
|
||||
/GOROOT
|
||||
/go
|
||||
/tris-localserver/tris-localserver
|
||||
/tris-testclient/tris-testclient
|
||||
/caddy/caddy
|
||||
/caddy/echo
|
||||
140
_dev/Makefile
140
_dev/Makefile
@ -1,140 +0,0 @@
|
||||
# Constants
|
||||
MK_FILE_PATH = $(lastword $(MAKEFILE_LIST))
|
||||
PRJ_DIR = $(abspath $(dir $(MK_FILE_PATH))/..)
|
||||
DEV_DIR = $(PRJ_DIR)/_dev
|
||||
# Results will be produced in this directory (can be provided by a caller)
|
||||
BUILD_DIR ?= $(PRJ_DIR)/_dev/GOROOT
|
||||
|
||||
# Compiler
|
||||
GO ?= go
|
||||
DOCKER ?= docker
|
||||
GIT ?= git
|
||||
|
||||
# Build environment
|
||||
OS ?= $(shell $(GO) env GOHOSTOS)
|
||||
ARCH ?= $(shell $(GO) env GOHOSTARCH)
|
||||
OS_ARCH := $(OS)_$(ARCH)
|
||||
VER_OS_ARCH := $(shell $(GO) version | cut -d' ' -f 3)_$(OS)_$(ARCH)
|
||||
GOROOT_ENV ?= $(shell $(GO) env GOROOT)
|
||||
GOROOT_LOCAL = $(BUILD_DIR)/$(OS_ARCH)
|
||||
# Flag indicates wheter invoke "go install -race std". Supported only on amd64 with CGO enabled
|
||||
INSTALL_RACE:= $(words $(filter $(ARCH)_$(shell go env CGO_ENABLED), amd64_1))
|
||||
TMP_DIR := $(shell mktemp -d)
|
||||
|
||||
# Test targets used for compatibility testing
|
||||
TARGET_TEST_COMPAT=boring picotls tstclnt
|
||||
|
||||
# Some target-specific constants
|
||||
BORINGSSL_REVISION=ff433815b51c34496bb6bea13e73e29e5c278238
|
||||
BOGO_DOCKER_TRIS_LOCATION=/go/src/github.com/cloudflare/tls-tris
|
||||
|
||||
# SIDH repository
|
||||
SIDH_REPO ?= https://github.com/cloudflare/sidh.git
|
||||
SIDH_REPO_TAG ?= Release_1.0
|
||||
# NOBS repo (SIKE depends on SHA3)
|
||||
NOBS_REPO ?= https://github.com/henrydcase/nobscrypto.git
|
||||
NOBS_REPO_TAG ?= Release_0.1
|
||||
|
||||
###############
|
||||
#
|
||||
# Build targets
|
||||
#
|
||||
##############################
|
||||
$(BUILD_DIR)/$(OS_ARCH)/.ok_$(VER_OS_ARCH): clean
|
||||
|
||||
# Create clean directory structure
|
||||
mkdir -p "$(GOROOT_LOCAL)/pkg"
|
||||
|
||||
# Copy src/tools from system GOROOT
|
||||
cp -Hr $(GOROOT_ENV)/src $(GOROOT_LOCAL)/src
|
||||
cp -Hr $(GOROOT_ENV)/pkg/include $(GOROOT_LOCAL)/pkg/include
|
||||
cp -Hr $(GOROOT_ENV)/pkg/tool $(GOROOT_LOCAL)/pkg/tool
|
||||
|
||||
# Swap TLS implementation
|
||||
rm -r $(GOROOT_LOCAL)/src/crypto/tls/*
|
||||
rsync -rltgoD $(PRJ_DIR)/ $(GOROOT_LOCAL)/src/crypto/tls/ --exclude=$(lastword $(subst /, ,$(DEV_DIR)))
|
||||
|
||||
# Apply additional patches
|
||||
for p in $(wildcard $(DEV_DIR)/patches/*); do patch -d "$(GOROOT_LOCAL)" -p1 < "$$p"; done
|
||||
|
||||
# Vendor NOBS library
|
||||
$(GIT) clone $(NOBS_REPO) $(TMP_DIR)/nobs
|
||||
cd $(TMP_DIR)/nobs; $(GIT) checkout tags/$(NOBS_REPO_TAG)
|
||||
cd $(TMP_DIR)/nobs; make vendor-sidh-for-tls
|
||||
cp -rf $(TMP_DIR)/nobs/tls_vendor/* $(GOROOT_LOCAL)/src/vendor/
|
||||
|
||||
# Vendor SIDH library
|
||||
$(GIT) clone $(SIDH_REPO) $(TMP_DIR)/sidh
|
||||
cd $(TMP_DIR)/sidh; $(GIT) checkout tags/$(SIDH_REPO_TAG)
|
||||
cd $(TMP_DIR)/sidh; make vendor
|
||||
cp -rf $(TMP_DIR)/sidh/build/vendor/* $(GOROOT_LOCAL)/src/vendor/
|
||||
|
||||
# Create go package
|
||||
GOARCH=$(ARCH) GOROOT="$(GOROOT_LOCAL)" $(GO) install -v std
|
||||
ifeq ($(INSTALL_RACE),1)
|
||||
GOARCH=$(ARCH) GOROOT="$(GOROOT_LOCAL)" $(GO) install -race -v std
|
||||
endif
|
||||
rm -rf $(TMP_DIR)
|
||||
@touch "$@"
|
||||
|
||||
build-test-%: $(BUILD_DIR)/$(OS_ARCH)/.ok_$(VER_OS_ARCH)
|
||||
$(DOCKER) build $(BUILDARG) -t tls-tris:$* $(DEV_DIR)/$*
|
||||
$(DOCKER) build $(BUILDARG) -t $(*)-localserver $(DEV_DIR)/$*
|
||||
|
||||
build-all: \
|
||||
build-test-tris-client \
|
||||
build-test-tris-server \
|
||||
build-test-bogo \
|
||||
$(addprefix build-test-,$(TARGET_TEST_COMPAT))
|
||||
|
||||
# Builds TRIS client
|
||||
build-test-tris-client: $(BUILD_DIR)/$(OS_ARCH)/.ok_$(VER_OS_ARCH)
|
||||
cd $(DEV_DIR)/tris-testclient; CGO_ENABLED=0 GOROOT="$(GOROOT_LOCAL)" $(GO) build -v -i .
|
||||
$(DOCKER) build -t tris-testclient $(DEV_DIR)/tris-testclient
|
||||
|
||||
# Builds TRIS server
|
||||
build-test-tris-server: $(BUILD_DIR)/$(OS_ARCH)/.ok_$(VER_OS_ARCH)
|
||||
cd $(DEV_DIR)/tris-localserver; CGO_ENABLED=0 GOROOT="$(GOROOT_LOCAL)" $(GO) build -v -i .
|
||||
$(DOCKER) build -t tris-localserver $(DEV_DIR)/tris-localserver
|
||||
|
||||
# BoringSSL specific stuff
|
||||
build-test-boring: BUILDARG=--build-arg REVISION=$(BORINGSSL_REVISION)
|
||||
|
||||
# TODO: This probably doesn't work
|
||||
build-caddy: $(BUILD_DIR)/$(OS_ARCH)/.ok_$(VER_OS_ARCH)
|
||||
CGO_ENABLED=0 GOROOT="$(GOROOT_LOCAL)" $(GO) build github.com/mholt/caddy
|
||||
|
||||
###############
|
||||
#
|
||||
# Test targets
|
||||
#
|
||||
##############################
|
||||
test: \
|
||||
test-unit \
|
||||
test-bogo \
|
||||
test-interop
|
||||
|
||||
test-unit: $(BUILD_DIR)/$(OS_ARCH)/.ok_$(VER_OS_ARCH)
|
||||
GOROOT="$(GOROOT_LOCAL)" $(GO) test -race crypto/tls
|
||||
|
||||
test-bogo:
|
||||
$(DOCKER) run --rm -v $(PRJ_DIR):$(BOGO_DOCKER_TRIS_LOCATION) tls-tris:bogo
|
||||
|
||||
test-interop:
|
||||
$(DEV_DIR)/interop_test_runner -v
|
||||
|
||||
###############
|
||||
#
|
||||
# Utils
|
||||
#
|
||||
##############################
|
||||
clean:
|
||||
rm -rf $(BUILD_DIR)/$(OS_ARCH)
|
||||
|
||||
clean-all: clean
|
||||
rm -rf $(BUILD_DIR)
|
||||
|
||||
fmtcheck:
|
||||
$(DEV_DIR)/utils/fmtcheck.sh
|
||||
|
||||
.PHONY: $(BUILD_DIR) clean build build-test test test-unit test-bogo test-interop
|
||||
@ -1,38 +0,0 @@
|
||||
FROM golang:1.11-alpine
|
||||
|
||||
RUN apk add --update \
|
||||
git \
|
||||
make \
|
||||
bash \
|
||||
patch \
|
||||
rsync \
|
||||
&& rm -rf /var/cache/apk/*
|
||||
|
||||
ENV CGO_ENABLED=0
|
||||
|
||||
RUN git clone https://github.com/henrydcase/crypto-tls-bogo-shim \
|
||||
/go/src/github.com/henrydcase/crypto-tls-bogo-shim
|
||||
|
||||
# Draft 18 with client-tests branch
|
||||
#ARG REVISION=3f5e87d6a1931b6f6930e4eadb7b2d0b2aa7c588
|
||||
|
||||
# Draft 22 with draft22 branch
|
||||
#ARG REVISION=81cc32b846c9fe2ea32613287e57a6a0db7bbb9a
|
||||
|
||||
# Draft 22 with draft22-client branch (client-tests + draft22)
|
||||
# ARG REVISION=f9729b5e4eafb1f1d313949388c3c2b167e84734
|
||||
|
||||
# Draft 23
|
||||
#ARG REVISION=d07b9e80a87c871c2569ce4aabd06695336c5dc5
|
||||
|
||||
# Draft 23 (+ client authentication)
|
||||
# ARG REVISION=cd33ad248ae9490854f0077ca046b47cac3735bf
|
||||
|
||||
# Draft 28
|
||||
ARG REVISION=33204d1eaa497819c6325998d7ba6b66316790f3
|
||||
|
||||
RUN cd /go/src/github.com/henrydcase/crypto-tls-bogo-shim && \
|
||||
git checkout $REVISION
|
||||
|
||||
WORKDIR /go/src/github.com/henrydcase/crypto-tls-bogo-shim
|
||||
CMD ["make", "run"]
|
||||
@ -1,69 +0,0 @@
|
||||
FROM alpine
|
||||
|
||||
RUN apk add --update \
|
||||
git \
|
||||
cmake \
|
||||
patch \
|
||||
perl \
|
||||
python \
|
||||
build-base \
|
||||
go \
|
||||
ninja \
|
||||
&& rm -rf /var/cache/apk/*
|
||||
|
||||
RUN git clone https://boringssl.googlesource.com/boringssl
|
||||
|
||||
RUN mkdir boringssl/build
|
||||
|
||||
# Draft 14
|
||||
# ARG REVISION=88536c3
|
||||
|
||||
# Draft 15
|
||||
# RUN cd boringssl && git fetch https://boringssl.googlesource.com/boringssl refs/changes/40/10840/18:draft15
|
||||
# ARG REVISION=cae930d
|
||||
|
||||
# Draft "14.25" (sigalg renumbering)
|
||||
# ARG REVISION=af56fbd
|
||||
|
||||
# Draft "14.25" w/ x25519 only
|
||||
# ARG REVISION=c8b6b4f
|
||||
|
||||
# Draft "14.5" (sigalg, x25519, version ext)
|
||||
# ARG REVISION=54afdab
|
||||
|
||||
# Draft 16
|
||||
# ARG REVISION=89917a5
|
||||
|
||||
# Draft 18
|
||||
# ARG REVISION=9b885c5
|
||||
# Draft 18, but with "bssl server -loop -www" support and build fix
|
||||
# ARG REVISION=40b24c8154
|
||||
|
||||
# Draft 21
|
||||
# ARG REVISION=cd8470f
|
||||
|
||||
# Draft 22
|
||||
# ARG REVISION=1530ef3e
|
||||
|
||||
# Draft 23
|
||||
# ARG REVISION=cb15cfda29c0c60d8d74145b17c93b43a7667837
|
||||
|
||||
# Draft 28
|
||||
# ARG REVISION=861f384d7bc59241a9df1634ae938d8e75be2d30
|
||||
|
||||
# TLS 1.3
|
||||
ARG REVISION=ff433815b51c34496bb6bea13e73e29e5c278238
|
||||
|
||||
ADD sidh_$REVISION.patch /
|
||||
|
||||
RUN cd boringssl && git fetch
|
||||
RUN cd boringssl && git checkout $REVISION
|
||||
RUN cd boringssl && patch -p1 < /sidh_$REVISION.patch
|
||||
RUN cd boringssl/build && cmake -GNinja ..
|
||||
RUN cd boringssl && ninja -C build
|
||||
|
||||
ADD httpreq.txt /httpreq.txt
|
||||
ADD run.sh /run.sh
|
||||
ADD server.sh rsa.pem ecdsa.pem /
|
||||
ADD client_rsa.key client_rsa.crt client_ca.crt /
|
||||
ENTRYPOINT ["/run.sh"]
|
||||
@ -1,34 +0,0 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIF6zCCA9OgAwIBAgIUC4U4HlbkVMrKKTFK0mNrMFDpRskwDQYJKoZIhvcNAQEL
|
||||
BQAwfTELMAkGA1UEBhMCRlIxDTALBgNVBAgMBFBBQ0ExFzAVBgNVBAcMDkNhZ25l
|
||||
cyBzdXIgTWVyMSIwIAYDVQQLDBlDZXJ0IFRlc3RpbmcgT3JnYW5pemF0aW9uMSIw
|
||||
IAYDVQQDDBlDZXJ0IFRlc3RpbmcgT3JnYW5pemF0aW9uMB4XDTE5MDIyMjAwNDIz
|
||||
OVoXDTQ2MDcwOTAwNDIzOVowfTELMAkGA1UEBhMCRlIxDTALBgNVBAgMBFBBQ0Ex
|
||||
FzAVBgNVBAcMDkNhZ25lcyBzdXIgTWVyMSIwIAYDVQQLDBlDZXJ0IFRlc3Rpbmcg
|
||||
T3JnYW5pemF0aW9uMSIwIAYDVQQDDBlDZXJ0IFRlc3RpbmcgT3JnYW5pemF0aW9u
|
||||
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0z+DMLb7YIMFFNZpn+ve
|
||||
NdT7GL9DPyV9ZWSHpUuDyme6Og6Mp5IpCLlKjNXtizX5aQ9xQ746slt70fivSV/r
|
||||
tiEtayZkcwS7zHtc5f+U/S0hR1q5Zh3DaLQH9diSeuNFQN5pg7zQT5csJFlxf6EB
|
||||
j/ioSBC+J1E8A2FAh0qDq+TvPPyZEEjcJy0oBuNHUnkC3rwjt24DAUI26rN/Qk9P
|
||||
a6KR9bBOdHFFul3DEP/uPqWV9TvV5tJhP3J2RbfS79WljFy/lFIwvJvfQHYEjMt4
|
||||
/gq8yTSUgJ8zmgJQ1sgOKH1FzJd4EdAMquSYbElkc35jX8gggUNOUcwsIfJBnu41
|
||||
SC51JQruNT256zse76o8Dx3lSHiz5c6luZyJnZWWt6xWtfGEGMnckpn6cVvcbbgq
|
||||
eWqmttgE2QTpgYoYUVcX/XFtsmZVTu05r8MZoqje5rgW9nEvvW+3M+eT5h0M9eGQ
|
||||
bIT3D3tdXB2XWCjUWqxpZscFwyumGu7vdykBKLhMVR3nEpFfORnH+534vwi49fjz
|
||||
WnN6fXAZZLPnGtEdWXNgs9JtgI5UheAQbcA3FT+M3maa88V2JrETLps405NYp6hJ
|
||||
6msbS/AmV/eSilRmbGVj9TfKHb/BVHNYwVQ0Bu/QN2YQNQ9olOpIxXgKr6Y4tKZt
|
||||
wTOMiCxZrnDQneQOTnW0NAMCAwEAAaNjMGEwHQYDVR0OBBYEFNLiS6YezH2bWiZ3
|
||||
TNbkQzMoBBB2MB8GA1UdIwQYMBaAFNLiS6YezH2bWiZ3TNbkQzMoBBB2MA8GA1Ud
|
||||
EwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4ICAQAQ
|
||||
cWIFOusSLKizqcqMsbMIY/Jzy0Tq5jzeOAQEQBztu7eJb208SG2EJtD6ylBQCF8t
|
||||
FCxUbvWNrly1MJoMSXdn3uMz3kLKNQa6RENckwA1UuYZpdhvTUtmPun9QqFPJdqm
|
||||
oi0paOVut9q3dplDy6MUknGN4tNWp2ZDfyvom3mUMfYGEO/FCWTy8eFd6cHRE9bw
|
||||
tHkcX5r7GpDHH5vKXOF/deMp1Xgep5ZTasL13YwPiYgctst91pEfdcztjHW0mQNT
|
||||
ZH/TUQDgs2UCjcvyeOlgoZixWOpkf1Qyje15k9qMb89/5hdarxvAQbG2BezQtzyk
|
||||
bbCu1MQa2DBdAKbhQxas/DPSvSkA/y8v+hiovTWtPKErPnQqZqVy59KUTBWj8ZAj
|
||||
5dkDVjBvUcsJ/6zHv0X9puEnIDZ8pK+Xn9LbcbPE7Nf1ikDyOqHmLmhGfWlEGvoD
|
||||
3Q8f8zUySZ40mfqtVhc7OYqA66Q9quNQ4VBESVNiEJ/LuWHRXe74KqFdggsQqtS6
|
||||
UQQgw5lFnKHZ9pk2VlKzgpkmd5fLMOhcHWQbsah9TFOuW5vEhWGHNhGCyGouWTzD
|
||||
mkwlPS8arj/ymUn6t/oiwSOA6GbjQLnTXvoAjdBxnukQlNY6TUDk+lSQw0qfZGIA
|
||||
xZywUgRbLZH8TFUnuEQps35XnWrY8rrXVj9+9h0B4g==
|
||||
-----END CERTIFICATE-----
|
||||
@ -1,31 +0,0 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIFSjCCAzKgAwIBAgIUCKk2npLYEX2Z3Ceu1CwSKK50j04wDQYJKoZIhvcNAQEL
|
||||
BQAwfTELMAkGA1UEBhMCRlIxDTALBgNVBAgMBFBBQ0ExFzAVBgNVBAcMDkNhZ25l
|
||||
cyBzdXIgTWVyMSIwIAYDVQQLDBlDZXJ0IFRlc3RpbmcgT3JnYW5pemF0aW9uMSIw
|
||||
IAYDVQQDDBlDZXJ0IFRlc3RpbmcgT3JnYW5pemF0aW9uMB4XDTE5MDIyMjAwNDMz
|
||||
MloXDTQ2MDcwOTAwNDMzMlowfTELMAkGA1UEBhMCRlIxDTALBgNVBAgMBFBBQ0Ex
|
||||
FzAVBgNVBAcMDkNhZ25lcyBzdXIgTWVyMSIwIAYDVQQLDBlDZXJ0IFRlc3Rpbmcg
|
||||
T3JnYW5pemF0aW9uMSIwIAYDVQQDDBlDZXJ0IFRlc3RpbmcgT3JnYW5pemF0aW9u
|
||||
MIIBIDANBgkqhkiG9w0BAQEFAAOCAQ0AMIIBCAKCAQEA0DQrWlCfijylutz28aTB
|
||||
T9WDnvBWpJ535t/Clt4o2nv3Cp6JxvUVzYkdKuaLR295gyEBx9JSHiZxPiJoPVfp
|
||||
wigmG0R9HvByAG5rhaQbQt99npoBaHMps1i12VxxFy1yaqZW6mrwrHMfV716rZ2M
|
||||
AzWx7UfhutloBYeeluiziDWUSEuGeJG7kHdvUtGYlbRd/ElFWHOfAQ7Oc8UUjEHW
|
||||
sorkqciqyAERV/H9hr5Rap/J/ERcFC8bNecS4t1Yh98WgIun/MbcBKQzo1LsWmOQ
|
||||
dmaMBoG8g1mYRbNap8G/+aQbjfRi1zN0yaW1wtlLoBJmNgLjwYgaS/5Uey5NZMdb
|
||||
NwIBA6OBwzCBwDAJBgNVHRMEAjAAMBEGCWCGSAGG+EIBAQQEAwIFoDAxBglghkgB
|
||||
hvhCAQ0EJBYiQ2VydCBUZXN0aW5nIEludGVybWVkaWF0ZSAtIENsaWVudDAdBgNV
|
||||
HQ4EFgQULlrGFPbxwz525ywQYPs72P7YnL4wHwYDVR0jBBgwFoAU0uJLph7MfZta
|
||||
JndM1uRDMygEEHYwDgYDVR0PAQH/BAQDAgXgMB0GA1UdJQQWMBQGCCsGAQUFBwMC
|
||||
BggrBgEFBQcDBDANBgkqhkiG9w0BAQsFAAOCAgEAwLc+Xg5Fyfbgu5iFs1y7E0Et
|
||||
4E/5lF0A4iqDVX3e7/upoUIBFZFv2PlAqIlhQ49NgGlIfrBlwEijZJ9kgVmUcKDS
|
||||
UrqBvKUn+99dTC8Zn/Py9ofLNcJy+qNJg4TpbpBxXaP1MXdZYXdYkGtyyPIGo31U
|
||||
oHibNLQDCtKFMoEPCvFuCBtJgyT46l5KN7VQCA0ZDm84fVmIgEEOXWwz0mDIhGWm
|
||||
hDhmqONznl0+aHirqJxsBaplBaFVV1N02ksR53sPPy/UfDsAD3Fpp8R1DAMEyy0o
|
||||
kTqm8QINVL961YT1Y/oI+GlypjPq9cL0dEHdxwu6gyCHPMMGGGIDHmLoqJJuj/Kr
|
||||
/T08jhtDv8D7e9m3wfSW/RqHKE31Yy21SXv/gpcHGunwzDoj/QUvRl/xTjJfx+S8
|
||||
2NHxSU8QOdexhJumsNFJe8kH8cRJMCMB8/hfiBpI0QANkUBJ1aaa/p7vZuEKJm+/
|
||||
85m3Yz+zn58/Bube06z6QzFeR8Edi+6hXk4/WoHltgXiNowD3d4xI48sPWEbe+QZ
|
||||
6u60sEdpY2a+3Xwt9m9R2R+sGP3QyDFd9GVaUPt21TeeLdfS3kPqwO2k+UXB8nV3
|
||||
Yh1Hvyx67u0tX3wBVe40CNaAu7iW+e4aXjksG2dxk71lNq5CHJCOtbRK4LUArjy5
|
||||
cw4KAXWoaR8YIC3BWgg=
|
||||
-----END CERTIFICATE-----
|
||||
@ -1,28 +0,0 @@
|
||||
-----BEGIN PRIVATE KEY-----
|
||||
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDQNCtaUJ+KPKW6
|
||||
3PbxpMFP1YOe8Faknnfm38KW3ijae/cKnonG9RXNiR0q5otHb3mDIQHH0lIeJnE+
|
||||
Img9V+nCKCYbRH0e8HIAbmuFpBtC332emgFocymzWLXZXHEXLXJqplbqavCscx9X
|
||||
vXqtnYwDNbHtR+G62WgFh56W6LOINZRIS4Z4kbuQd29S0ZiVtF38SUVYc58BDs5z
|
||||
xRSMQdayiuSpyKrIARFX8f2GvlFqn8n8RFwULxs15xLi3ViH3xaAi6f8xtwEpDOj
|
||||
UuxaY5B2ZowGgbyDWZhFs1qnwb/5pBuN9GLXM3TJpbXC2UugEmY2AuPBiBpL/lR7
|
||||
Lk1kx1s3AgEDAoIBAQCKzXI8Nb+xfcPR6KShGIDf460UoDnDFE/vP9cPPsXm/U9c
|
||||
abEvTg6JBhNx7weE9PuswKvajDa+xEt+wZrTj/EsGsQSLai/Svaq9EeubWeB6lO/
|
||||
EVZFohvM5c6Q6EtkyPbxxDnxnKBy92o6flHJE7KsznaeL+vR5kVZBRRkmyJazS4s
|
||||
Z5rbrN9AhSIfyHs9GCQGgsXT6HMsyoJYFastwQ2qj+9L2ypcM8TW+KGzGfJipoJb
|
||||
l/N/8WHb4ZumA67lfWq4v5JTA5qAUKcfPszEBrUfQ34Tk+73Iiov9f7SXPYxWxVJ
|
||||
g9PuzfewvJrp6CPv+/mKNt8PmBYkaXlnyjr9tCwLAoGBAPjAVZapQVuIqftcOZtf
|
||||
Re9fAV9Vvv1FEO8bKJeIsPDlRkdg+TfTMgxhZU0I3P4XdEj7Fa87w4wkA6GkIrOO
|
||||
W9/usPOYzSdTP5aVEsdGbT8yD2vTST7Aw/GESKTRJA/Fe1PIb5Nz3OijyTusvFE+
|
||||
XSR3EXb1myX+2rFS0Wbiz2U5AoGBANZFWoeFzREnBcDG60RayjiTg71E1/T4zhvU
|
||||
e/w+71FNbLZXBrNqgV20F73xOme/Mb13yr+YgXxIEQfFtR6hRxZ8u1jndEzw66Jf
|
||||
YfHt7EGVceMV2pdP4md5ebebEj7qICfXPxF9IZicwZG3QMR5u0tvnx40iNMWhW0M
|
||||
rY4FabPvAoGBAKXVjmRw1j0FxqeS0RI/g/TqAOo5Kf4uC0oSGw+wdfXuLtpApiU3
|
||||
drLrmN4F6Klk+DCnY8on17LCrRZtbHe0PT/0dfe7M2+M1Q8ODITZniohX503hinV
|
||||
1/ZYMG3gwrUuUjfa9Qz36JsX230d0uDUPhhPYPn5EhlUkcuMi5nsikN7AoGBAI7Y
|
||||
5wUD3gtvWSsvR4LnMXsNAn4t5U37NBKNp/1/SjYznc7kryJHAOkiun6g0Zp/dn5P
|
||||
3H+7AP2FYK/ZI2nA2g790jtE+DNLR8GU6/aenYEOS+y5PGTf7ET7pnpnYX9GwBqP
|
||||
f2D+FmW91mEk1dhRJ4efv2l4WzdkWPNdyQlY8SKfAoGAEIWmowo7EpbR5Boxc2o3
|
||||
Tl0JbGi1CNJAHtDjEJCd1OxKrMUrK07hOeEKF6y8K/WBuQhFvI2pu16oT4sMal9Z
|
||||
mEiJdJAFErefPLQGomHLXfq9mDEY13Ug/xAd9aMyYcubIg5XjAqLMrB60HcrLr7Q
|
||||
2hMCSDdVP2V/F3QVh8DEirE=
|
||||
-----END PRIVATE KEY-----
|
||||
@ -1,15 +0,0 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIBbTCCAROgAwIBAgIQZCsHZcs5ZkzV+zC2E6j5RzAKBggqhkjOPQQDAjASMRAw
|
||||
DgYDVQQKEwdBY21lIENvMB4XDTE2MDkyNDE3NTE1OFoXDTI2MDkyMjE3NTE1OFow
|
||||
EjEQMA4GA1UEChMHQWNtZSBDbzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABDTO
|
||||
B3IyzjYfKCp2HWy+P3QHxhdBT4AUGYgwTiSEj5phumPIahFNcOSWptN0UzlZvJdN
|
||||
MMjVmrFYK/FjF4abkNKjSzBJMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUEDDAKBggr
|
||||
BgEFBQcDATAMBgNVHRMBAf8EAjAAMBQGA1UdEQQNMAuCCWxvY2FsaG9zdDAKBggq
|
||||
hkjOPQQDAgNIADBFAiEAp9W157PM1IadPBc33Cbj7vaFvp+rXs/hSuMCzP8pgV8C
|
||||
IHCswo1qiC0ZjQmWsBlmz5Zbp9rOorIzBYmGRhRdNs3j
|
||||
-----END CERTIFICATE-----
|
||||
-----BEGIN EC PRIVATE KEY-----
|
||||
MHcCAQEEIFdhO7IW5UIwpB1e2Vunm9QyKvUHWcVwGfLjhpOajuR7oAoGCCqGSM49
|
||||
AwEHoUQDQgAENM4HcjLONh8oKnYdbL4/dAfGF0FPgBQZiDBOJISPmmG6Y8hqEU1w
|
||||
5Jam03RTOVm8l00wyNWasVgr8WMXhpuQ0g==
|
||||
-----END EC PRIVATE KEY-----
|
||||
@ -1,5 +0,0 @@
|
||||
GET / HTTP/1.1
|
||||
Host: example.com
|
||||
Connection: close
|
||||
|
||||
|
||||
@ -1,45 +0,0 @@
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEpAIBAAKCAQEA1DHcIM3SThFqy8nAkPQFX0E7ph8jqh8EATXryjKHGuVjR3Xh
|
||||
OQ0BSPoJxyfdg/VEwevFrtmZAfz0WCbxvP2SVCmf7oobg4V2KPSo3nNt9vlBFUne
|
||||
RtIyHRQ8YRnGSWaRHzJbX6ffltnG2aD+8qUfk161rdZgxBA9G0Ga47IkwQhT2Hqu
|
||||
H3dW2Uu4W2WMyt6gX/tdyEAV57MOPcoceknr7Nb2kfiuDPR7h6wFrW3I6eoj8oX2
|
||||
SkIOuVNt1Z31BAUcPJDUjqopI0o9tolM/7X13M8dEY0OJQVr7FQYDF9JeSYeEMyb
|
||||
wizjBaHDm48mSghP1o5UssQBbNNC83btXCjiLQIDAQABAoIBACzvGgRAUYaCnbDl
|
||||
2kdXxUN0luMIuQ6vXrO67WF17bI+XRWm2riwDlObzzJDON9Wsua1vLjYD1SickOw
|
||||
i4RP1grIfbuPt1/UhT8LAC+LFgA0rBmL+OvaWw5ZWKffQ2QLujN3AG5zKB/Tog43
|
||||
z4UmfldAuQxE11zta2M4M0qAUNQnQj1oiuI8RUdG0VvvLw8Htdi1ogH0CI5R669z
|
||||
NjHt+JV+2gzKx6EX0s8mQL3yXGkC2xXItRbFclyCMJEhPS7QbBu+tru35N6WpzAq
|
||||
BCl2Q7LQogvSA6MXuMOx6CyuExVfgmhbfeoheLE8gmXwl0Y37n/g6ZBZFAtpCjcs
|
||||
UckPv0ECgYEA1orl7RwgIsZljMap6vWtMGoRIHKmT91DGpMmkh4suZe+yAk85maU
|
||||
49Vd+8ZfIN41AH37yrsGOcPHgz5o5QufELpoub6DCsQ7u9F1vQp55cp+qyBWzAgz
|
||||
b/xUuVnIyv3kLan3fpk7ZGCBXFBpLG0QXMFOHtda3Mlk5SmuoEYaYRkCgYEA/TLR
|
||||
u4neKqyqwsqMuRJGC1iKFVmfCjZeNMtPNbTWpdqez/vvT8APnEpIumUGt8YROLGZ
|
||||
8biUr5/ViOkmaP3wmQbO9m2/cE01lMTYv75w1cw2KVQe6kAHJkOx+JEx9xg53RJ/
|
||||
QlFtG5MQUy2599Gxp8BMGaXLH5yo4qwvNvY6CDUCgYEArxr7AwX7rKZlZ/sV4HHY
|
||||
gzVu+R7aY0DibiRATO5X7rrNuhLgI+UCDNqvNLn6FqeGdvpcsmDneeozQwmDL77G
|
||||
ey7KHyBBcF4tquQQxtRwHX+i1yUz8p+W7AX1WLrRSezjeenJ2QhUE1849hGjZeE2
|
||||
g546lq2Kub2enfPhVWsiSLECgYEA72T5QCPeVuLioUH5Q5Kvf1K7W+xcnr9A2xHP
|
||||
Vqwgtre5qFQ/tFuXZuIlWXbjnyY6aiwhrZYjntm0f7pRgrt2nHj/fafOdVPK8Voc
|
||||
xU4+SSbHntPWVw0qtVcUEjzVzRauvwMaJ43tZ0DpEnwNdO5i1oTObwF+x+jLFWZP
|
||||
TdwIinECgYBzjZeCxxOMk5SlPpTsLUtgC+q3m1AavXhUVNEPP2gKMOIPTETPbhbG
|
||||
LBxB2vVbJiS3J7itQy8gceT89O0vSEZnaTPXiM/Ws1QbkBJ8yW7KI7X4WuzN4Imq
|
||||
/cLBRXLb8R328U27YyQFNGMjr2tX/+vx5FulJjSloWMRNuFWUngv7w==
|
||||
-----END RSA PRIVATE KEY-----
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIC+jCCAeKgAwIBAgIRANBDimJ/ww2tz77qcYIhuZowDQYJKoZIhvcNAQELBQAw
|
||||
EjEQMA4GA1UEChMHQWNtZSBDbzAeFw0xNjA5MjQxNzI5MTlaFw0yNjA5MjIxNzI5
|
||||
MTlaMBIxEDAOBgNVBAoTB0FjbWUgQ28wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
|
||||
ggEKAoIBAQDUMdwgzdJOEWrLycCQ9AVfQTumHyOqHwQBNevKMoca5WNHdeE5DQFI
|
||||
+gnHJ92D9UTB68Wu2ZkB/PRYJvG8/ZJUKZ/uihuDhXYo9Kjec232+UEVSd5G0jId
|
||||
FDxhGcZJZpEfMltfp9+W2cbZoP7ypR+TXrWt1mDEED0bQZrjsiTBCFPYeq4fd1bZ
|
||||
S7hbZYzK3qBf+13IQBXnsw49yhx6Sevs1vaR+K4M9HuHrAWtbcjp6iPyhfZKQg65
|
||||
U23VnfUEBRw8kNSOqikjSj22iUz/tfXczx0RjQ4lBWvsVBgMX0l5Jh4QzJvCLOMF
|
||||
ocObjyZKCE/WjlSyxAFs00Lzdu1cKOItAgMBAAGjSzBJMA4GA1UdDwEB/wQEAwIF
|
||||
oDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMBQGA1UdEQQNMAuC
|
||||
CWxvY2FsaG9zdDANBgkqhkiG9w0BAQsFAAOCAQEAygPV4enmvwSuMd1JarxOXpOK
|
||||
Z4Nsk7EKlfCPgzxQUOkFdLIr5ZG1kUkQt/omzTmoIWjLAsoYzT0ZCPOrioczKsWj
|
||||
MceFUIkT0w+eIl+8DzauPy34o8rjcApglF165UG3iphlpI+jdPzv5TBarUAbwsFb
|
||||
ClMLEiNJQ0OMxAIaRtb2RehD4q3OWlpWf6joJ36PRBqL8T5+f2x6Tg3c64UR+QPX
|
||||
98UcCQHHdEhm7y2z5Z2Wt0B48tZ+UAxDEoEwMghNyw7wUD79IRlXGYypBnXaMuLX
|
||||
46aGxbsSQ7Rfg62Co3JG7vo+eJd0AoZHrtFUnfM8V70IFzMBZnSwRslHRJe56Q==
|
||||
-----END CERTIFICATE-----
|
||||
@ -1,8 +0,0 @@
|
||||
#! /bin/sh
|
||||
set -e
|
||||
|
||||
/boringssl/build/tool/bssl client -grease -min-version tls1.3 -max-version tls1.3 \
|
||||
-session-out /session -connect "$@" < /httpreq.txt
|
||||
exec /boringssl/build/tool/bssl client -grease -min-version tls1.3 -max-version tls1.3 \
|
||||
-session-in /session -connect "$@" < /httpreq.txt
|
||||
|
||||
@ -1,32 +0,0 @@
|
||||
#!/bin/sh
|
||||
PATH=/boringssl/build/tool:$PATH
|
||||
set -x
|
||||
|
||||
# RSA
|
||||
bssl server \
|
||||
-key rsa.pem \
|
||||
-min-version tls1.2 -max-version tls1.3 \
|
||||
-accept 1443 -loop -www 2>&1 &
|
||||
|
||||
# ECDSA
|
||||
bssl server \
|
||||
-key ecdsa.pem \
|
||||
-min-version tls1.2 -max-version tls1.3 \
|
||||
-accept 2443 -loop -www 2>&1 &
|
||||
|
||||
# Require client authentication (with ECDSA)
|
||||
bssl server \
|
||||
-key ecdsa.pem \
|
||||
-min-version tls1.2 -max-version tls1.3 \
|
||||
-accept 6443 -loop -www \
|
||||
-require-any-client-cert -debug 2>&1 &
|
||||
|
||||
# ECDSA and SIDH/P503-X25519
|
||||
bssl server \
|
||||
-key ecdsa.pem \
|
||||
-curves X25519-SIDHp503:X25519:P-256:P-384:P-521 \
|
||||
-min-version tls1.2 -max-version tls1.3 \
|
||||
-accept 7443 -loop -www \
|
||||
-debug 2>&1 &
|
||||
|
||||
wait
|
||||
File diff suppressed because it is too large
Load Diff
@ -1,13 +0,0 @@
|
||||
tris.filippo.io {
|
||||
tls bip@filippo.io
|
||||
log stdout
|
||||
proxy / https://blog.filippo.io
|
||||
}
|
||||
|
||||
echo.filippo.io {
|
||||
tls bip@filippo.io
|
||||
log stdout
|
||||
proxy / http://{$ECHO_PORT_80_TCP_ADDR}:{$ECHO_PORT_80_TCP_PORT} {
|
||||
transparent
|
||||
}
|
||||
}
|
||||
@ -1,17 +0,0 @@
|
||||
FROM scratch
|
||||
|
||||
# docker create -v /root/.caddy --name caddy-data caddy /bin/true
|
||||
# docker run --restart=always -d --volumes-from caddy-data --link echo -p 80:80 -p 443:443 caddy
|
||||
|
||||
# GOOS=linux ../go.sh build -v -i github.com/mholt/caddy/caddy
|
||||
ADD caddy caddy
|
||||
ADD Caddyfile Caddyfile
|
||||
ADD https://mkcert.org/generate/ /etc/ssl/certs/ca-certificates.crt
|
||||
|
||||
EXPOSE 80
|
||||
EXPOSE 443
|
||||
|
||||
ENV TLSDEBUG short
|
||||
ENV HOME /root/
|
||||
|
||||
CMD [ "/caddy" ]
|
||||
@ -1,7 +0,0 @@
|
||||
FROM scratch
|
||||
|
||||
# docker run --restart=always -d --name echo -P echo
|
||||
|
||||
ADD echo echo
|
||||
EXPOSE 80
|
||||
CMD [ "/echo", "0.0.0.0:80" ]
|
||||
@ -1,21 +0,0 @@
|
||||
diff --git a/caddytls/config.go b/caddytls/config.go
|
||||
index 6632aed..767886c 100644
|
||||
--- a/caddytls/config.go
|
||||
+++ b/caddytls/config.go
|
||||
@@ -372,7 +372,7 @@ func SetDefaultTLSParams(config *Config) {
|
||||
config.ProtocolMinVersion = tls.VersionTLS11
|
||||
}
|
||||
if config.ProtocolMaxVersion == 0 {
|
||||
- config.ProtocolMaxVersion = tls.VersionTLS12
|
||||
+ config.ProtocolMaxVersion = tls.VersionTLS13
|
||||
}
|
||||
|
||||
// Prefer server cipher suites
|
||||
@@ -394,6 +394,7 @@ var supportedProtocols = map[string]uint16{
|
||||
"tls1.0": tls.VersionTLS10,
|
||||
"tls1.1": tls.VersionTLS11,
|
||||
"tls1.2": tls.VersionTLS12,
|
||||
+ "tls1.3": tls.VersionTLS13,
|
||||
}
|
||||
|
||||
// Map of supported ciphers, used only for parsing config.
|
||||
@ -1,25 +0,0 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"html"
|
||||
"log"
|
||||
"net/http"
|
||||
"os"
|
||||
)
|
||||
|
||||
var htmlBody = []byte(`
|
||||
<!DOCTYPE html>
|
||||
<p>Hello!
|
||||
<code><pre>
|
||||
`)
|
||||
|
||||
func main() {
|
||||
http.HandleFunc("/", func(rw http.ResponseWriter, r *http.Request) {
|
||||
rw.Write(htmlBody)
|
||||
for name, value := range r.Header {
|
||||
fmt.Fprintf(rw, "%s: %s\n", name, html.EscapeString(value[0]))
|
||||
}
|
||||
})
|
||||
log.Println(http.ListenAndServe(os.Args[1], nil))
|
||||
}
|
||||
12
_dev/go.sh
12
_dev/go.sh
@ -1,12 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
#
|
||||
# THIS FILE IS ONLY USED BY _dev/bogo. It will be removed in future
|
||||
set -e
|
||||
|
||||
BASEDIR=$(cd "$(dirname "$0")" && pwd)
|
||||
GOENV="$(go env GOHOSTOS)_$(go env GOHOSTARCH)"
|
||||
|
||||
BUILD_DIR=${BASEDIR}/GOROOT make -f $BASEDIR/Makefile >&2
|
||||
|
||||
export GOROOT="$BASEDIR/GOROOT/$GOENV"
|
||||
exec go "$@"
|
||||
@ -1,308 +0,0 @@
|
||||
#!/usr/bin/env python2
|
||||
|
||||
import docker
|
||||
import unittest
|
||||
import re
|
||||
import time
|
||||
|
||||
# Regex patterns used for testing
|
||||
|
||||
# Checks if TLS 1.3 was negotiated
|
||||
RE_PATTERN_HELLO_TLS_13_NORESUME = "^.*Hello TLS 1.3 \(draft .*\) _o/$|^.*Hello TLS 1.3 _o/$"
|
||||
# Checks if TLS 1.3 was resumed
|
||||
RE_PATTERN_HELLO_TLS_13_RESUME = "Hello TLS 1.3 \[resumed\] _o/"
|
||||
# Checks if 0-RTT was used and NOT confirmed
|
||||
RE_PATTERN_HELLO_0RTT = "^.*Hello TLS 1.3 .*\[resumed\] \[0-RTT\] _o/$"
|
||||
# Checks if 0-RTT was used and confirmed
|
||||
RE_PATTERN_HELLO_0RTT_CONFIRMED = "^.*Hello TLS 1.3 .*\[resumed\] \[0-RTT confirmed\] _o/$"
|
||||
# ALPN
|
||||
RE_PATTERN_ALPN = "ALPN protocol: npn_proto$"
|
||||
# Successful TLS establishement from TRIS
|
||||
RE_TRIS_ALL_PASSED = ".*All handshakes passed.*"
|
||||
# TLS handshake from BoringSSL with SIDH/P503-X25519
|
||||
RE_BORINGSSL_P503 = "ECDHE curve: X25519-SIDHp503"
|
||||
|
||||
class Docker(object):
|
||||
''' Utility class used for starting/stoping servers and clients during tests'''
|
||||
def __init__(self):
|
||||
self.d = docker.from_env()
|
||||
|
||||
def get_ip(self, server):
|
||||
tris_localserver_container = self.d.containers.get(server)
|
||||
return tris_localserver_container.attrs['NetworkSettings']['IPAddress']
|
||||
|
||||
def run_client(self, image_name, cmd):
|
||||
''' Runs client and returns tuple (status_code, logs) '''
|
||||
c = self.d.containers.create(image=image_name, command=cmd)
|
||||
c.start()
|
||||
res = c.wait()
|
||||
ret = c.logs()
|
||||
c.remove()
|
||||
return (res['StatusCode'], ret)
|
||||
|
||||
def run_server(self, image_name, cmd=None, ports=None, entrypoint=None):
|
||||
''' Starts server and returns docker container '''
|
||||
c = self.d.containers.create(image=image_name, detach=True, command=cmd, ports=ports, entrypoint=entrypoint)
|
||||
c.start()
|
||||
# TODO: maybe can be done better?
|
||||
time.sleep(3)
|
||||
return c
|
||||
|
||||
class RegexSelfTest(unittest.TestCase):
|
||||
''' Ensures that those regexe's actually work '''
|
||||
|
||||
LINE_HELLO_TLS ="\nsomestuff\nHello TLS 1.3 _o/\nsomestuff"
|
||||
LINE_HELLO_DRAFT_TLS="\nsomestuff\nHello TLS 1.3 (draft 23) _o/\nsomestuff"
|
||||
|
||||
LINE_HELLO_RESUMED ="\nsomestuff\nHello TLS 1.3 [resumed] _o/\nsomestuff"
|
||||
LINE_HELLO_MIXED ="\nsomestuff\nHello TLS 1.3 (draft 23) _o/\nHello TLS 1.3 (draft 23) [resumed] _o/\nsomestuff"
|
||||
LINE_HELLO_TLS_12 ="\nsomestuff\nHello TLS 1.2 (draft 23) [resumed] _o/\nsomestuff"
|
||||
LINE_HELLO_TLS_13_0RTT="\nsomestuff\nHello TLS 1.3 (draft 23) [resumed] [0-RTT] _o/\nsomestuff"
|
||||
LINE_HELLO_TLS_13_0RTT_CONFIRMED="\nsomestuff\nHello TLS 1.3 (draft 23) [resumed] [0-RTT confirmed] _o/\nsomestuff"
|
||||
def test_regexes(self):
|
||||
self.assertIsNotNone(
|
||||
re.search(RE_PATTERN_HELLO_TLS_13_NORESUME, RegexSelfTest.LINE_HELLO_TLS, re.MULTILINE))
|
||||
self.assertIsNotNone(
|
||||
re.search(RE_PATTERN_HELLO_TLS_13_NORESUME, RegexSelfTest.LINE_HELLO_DRAFT_TLS, re.MULTILINE))
|
||||
self.assertIsNotNone(
|
||||
re.search(RE_PATTERN_HELLO_TLS_13_RESUME, RegexSelfTest.LINE_HELLO_RESUMED, re.MULTILINE))
|
||||
self.assertIsNotNone(
|
||||
re.search(RE_PATTERN_HELLO_0RTT, RegexSelfTest.LINE_HELLO_TLS_13_0RTT, re.MULTILINE))
|
||||
self.assertIsNotNone(
|
||||
re.search(RE_PATTERN_HELLO_0RTT_CONFIRMED, RegexSelfTest.LINE_HELLO_TLS_13_0RTT_CONFIRMED, re.MULTILINE))
|
||||
|
||||
# negative cases
|
||||
|
||||
# expects 1.3, but 1.2 received
|
||||
self.assertIsNone(
|
||||
re.search(RE_PATTERN_HELLO_TLS_13_NORESUME, RegexSelfTest.LINE_HELLO_TLS_12, re.MULTILINE))
|
||||
# expects 0-RTT
|
||||
self.assertIsNone(
|
||||
re.search(RE_PATTERN_HELLO_TLS_13_RESUME, RegexSelfTest.LINE_HELLO_TLS_13_0RTT, re.MULTILINE))
|
||||
# expectes 0-RTT confirmed
|
||||
self.assertIsNone(
|
||||
re.search(RE_PATTERN_HELLO_0RTT, RegexSelfTest.LINE_HELLO_TLS_13_0RTT_CONFIRMED, re.MULTILINE))
|
||||
# expects resume without 0-RTT
|
||||
self.assertIsNone(
|
||||
re.search(RE_PATTERN_HELLO_TLS_13_RESUME, RegexSelfTest.LINE_HELLO_TLS_13_0RTT, re.MULTILINE))
|
||||
|
||||
|
||||
class InteropServer(object):
|
||||
''' Instantiates TRIS as a server '''
|
||||
|
||||
TRIS_SERVER_NAME = "tris-localserver"
|
||||
|
||||
@classmethod
|
||||
def setUpClass(self):
|
||||
self.d = Docker()
|
||||
self.server = self.d.run_server(self.TRIS_SERVER_NAME)
|
||||
|
||||
@classmethod
|
||||
def tearDownClass(self):
|
||||
self.server.kill()
|
||||
self.server.remove()
|
||||
|
||||
@property
|
||||
def server_ip(self):
|
||||
return self.d.get_ip(self.server.name)
|
||||
|
||||
# Mixins for testing server functionality
|
||||
|
||||
class ServerNominalMixin(object):
|
||||
''' Nominal tests for TLS 1.3 - client tries to perform handshake with server '''
|
||||
def test_rsa(self):
|
||||
res = self.d.run_client(self.CLIENT_NAME, self.server_ip+":"+'1443')
|
||||
self.assertTrue(res[0] == 0)
|
||||
# Check there was TLS hello without resume
|
||||
self.assertIsNotNone(
|
||||
re.search(RE_PATTERN_HELLO_TLS_13_NORESUME, res[1], re.MULTILINE))
|
||||
# Check there was TLS hello with resume
|
||||
self.assertIsNotNone(
|
||||
re.search(RE_PATTERN_HELLO_TLS_13_RESUME, res[1], re.MULTILINE))
|
||||
|
||||
def test_ecdsa(self):
|
||||
res = self.d.run_client(self.CLIENT_NAME, self.server_ip+":"+'2443')
|
||||
self.assertTrue(res[0] == 0)
|
||||
# Check there was TLS hello without resume
|
||||
self.assertIsNotNone(
|
||||
re.search(RE_PATTERN_HELLO_TLS_13_NORESUME, res[1], re.MULTILINE))
|
||||
# Check there was TLS hello with resume
|
||||
self.assertIsNotNone(
|
||||
re.search(RE_PATTERN_HELLO_TLS_13_RESUME, res[1], re.MULTILINE))
|
||||
|
||||
class ServerClientAuthMixin(object):
|
||||
''' Client authentication testing '''
|
||||
def test_client_auth(self):
|
||||
args = ''.join([self.server_ip+':6443',' -key client_rsa.key -cert client_rsa.crt -debug'])
|
||||
res = self.d.run_client(self.CLIENT_NAME, args)
|
||||
self.assertEqual(res[0], 0)
|
||||
# Check there was TLS hello without resume
|
||||
self.assertIsNotNone(
|
||||
re.search(RE_PATTERN_HELLO_TLS_13_NORESUME, res[1], re.MULTILINE))
|
||||
# Check there was TLS hello with resume
|
||||
self.assertIsNotNone(
|
||||
re.search(RE_PATTERN_HELLO_TLS_13_RESUME, res[1], re.MULTILINE))
|
||||
|
||||
class ClientNominalMixin(object):
|
||||
|
||||
def test_rsa(self):
|
||||
res = self.d.run_client(self.CLIENT_NAME, '-ecdsa=false '+self.server_ip+":1443")
|
||||
self.assertEqual(res[0], 0)
|
||||
|
||||
def test_ecdsa(self):
|
||||
res = self.d.run_client(self.CLIENT_NAME, '-rsa=false '+self.server_ip+":2443")
|
||||
self.assertEqual(res[0], 0)
|
||||
|
||||
|
||||
class ClientClientAuthMixin(object):
|
||||
''' Client authentication testing - tris on client side '''
|
||||
|
||||
def test_client_auth(self):
|
||||
res = self.d.run_client('tris-testclient', '-rsa=false -cliauth '+self.server_ip+":6443")
|
||||
self.assertTrue(res[0] == 0)
|
||||
|
||||
class ServerZeroRttMixin(object):
|
||||
''' Zero RTT testing '''
|
||||
|
||||
def test_zero_rtt(self):
|
||||
# rejecting 0-RTT
|
||||
res = self.d.run_client(self.CLIENT_NAME, self.server_ip+":3443")
|
||||
self.assertEqual(res[0], 0)
|
||||
self.assertIsNotNone(
|
||||
re.search(RE_PATTERN_HELLO_TLS_13_RESUME, res[1], re.MULTILINE))
|
||||
self.assertIsNone(
|
||||
re.search(RE_PATTERN_HELLO_0RTT, res[1], re.MULTILINE))
|
||||
|
||||
# accepting 0-RTT
|
||||
res = self.d.run_client(self.CLIENT_NAME, self.server_ip+":4443")
|
||||
self.assertEqual(res[0], 0)
|
||||
self.assertIsNotNone(
|
||||
re.search(RE_PATTERN_HELLO_0RTT, res[1], re.MULTILINE))
|
||||
|
||||
# confirming 0-RTT
|
||||
res = self.d.run_client(self.CLIENT_NAME, self.server_ip+":5443")
|
||||
self.assertEqual(res[0], 0)
|
||||
self.assertIsNotNone(
|
||||
re.search(RE_PATTERN_HELLO_0RTT_CONFIRMED, res[1], re.MULTILINE))
|
||||
|
||||
class InteropClient(object):
|
||||
''' Instantiates TRIS as a client '''
|
||||
|
||||
CLIENT_NAME = "tris-testclient"
|
||||
|
||||
@classmethod
|
||||
def setUpClass(self):
|
||||
self.d = Docker()
|
||||
self.server = self.d.run_server(
|
||||
self.SERVER_NAME,
|
||||
ports={ '1443/tcp': 1443, '2443/tcp': 2443, '6443/tcp': 6443, '7443/tcp': 7443},
|
||||
entrypoint="/server.sh")
|
||||
|
||||
@classmethod
|
||||
def tearDownClass(self):
|
||||
self.server.kill()
|
||||
self.server.remove()
|
||||
|
||||
@property
|
||||
def server_ip(self):
|
||||
return self.d.get_ip(self.server.name)
|
||||
|
||||
# Actual test definition
|
||||
|
||||
# TRIS as a server, BoringSSL as a client
|
||||
class InteropServer_BoringSSL(InteropServer, ServerNominalMixin, ServerClientAuthMixin, unittest.TestCase):
|
||||
|
||||
CLIENT_NAME = "tls-tris:boring"
|
||||
|
||||
def test_ALPN(self):
|
||||
'''
|
||||
Checks wether ALPN is sent back by tris server in EncryptedExtensions in case of TLS 1.3. The
|
||||
ALPN protocol is set to 'npn_proto', which is hardcoded in TRIS test server.
|
||||
'''
|
||||
res = self.d.run_client(self.CLIENT_NAME, self.server_ip+":1443 "+'-alpn-protos npn_proto')
|
||||
self.assertEqual(res[0], 0)
|
||||
self.assertIsNotNone(re.search(RE_PATTERN_ALPN, res[1], re.MULTILINE))
|
||||
|
||||
def test_SIDH(self):
|
||||
'''
|
||||
Connects to TRIS server listening on 7443 and tries to perform key agreement with SIDH/P503-X25519
|
||||
'''
|
||||
res = self.d.run_client(self.CLIENT_NAME, self.server_ip+":7443 "+'-curves X25519-SIDHp503')
|
||||
self.assertEqual(res[0], 0)
|
||||
self.assertIsNotNone(re.search(RE_BORINGSSL_P503, res[1], re.MULTILINE))
|
||||
self.assertIsNotNone(re.search(RE_PATTERN_HELLO_TLS_13_NORESUME, res[1], re.MULTILINE))
|
||||
|
||||
# PicoTLS doesn't seem to implement draft-23 correctly. It will
|
||||
# be enabled when draft-28 is implemented.
|
||||
# class InteropServer_PicoTLS(
|
||||
# InteropServer,
|
||||
# ServerNominalMixin,
|
||||
# ServerZeroRttMixin,
|
||||
# unittest.TestCase
|
||||
# ): CLIENT_NAME = "tls-tris:picotls"
|
||||
|
||||
class InteropServer_NSS(
|
||||
InteropServer,
|
||||
ServerNominalMixin,
|
||||
ServerZeroRttMixin,
|
||||
unittest.TestCase
|
||||
): CLIENT_NAME = "tls-tris:tstclnt"
|
||||
|
||||
# TRIS as a client, BoringSSL as a server
|
||||
class InteropClient_BoringSSL(InteropClient, ClientNominalMixin, ClientClientAuthMixin, unittest.TestCase):
|
||||
|
||||
SERVER_NAME = "boring-localserver"
|
||||
|
||||
def test_SIDH(self):
|
||||
'''
|
||||
Connects to BoringSSL server listening on 7443 and tries to perform key agreement with SIDH/P503-X25519
|
||||
'''
|
||||
res = self.d.run_client(self.CLIENT_NAME, '-rsa=false -ecdsa=true -groups X25519-SIDHp503 ' + self.server_ip+":7443")
|
||||
self.assertEqual(res[0], 0)
|
||||
self.assertIsNotNone(re.search(RE_TRIS_ALL_PASSED, res[1], re.MULTILINE))
|
||||
|
||||
def test_SIDH_TLSv12(self):
|
||||
'''
|
||||
Connects to TRIS server listening on 7443 and tries to perform key agreement with SIDH/P503-X25519
|
||||
This connection will be over TLSv12 and hence it should fall back to X25519
|
||||
'''
|
||||
res = self.d.run_client(self.CLIENT_NAME, '-tls_version=1.2 -rsa=false -ecdsa=true -groups X25519-SIDHp503:P-256 -ciphers TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 ' + self.server_ip+":7443")
|
||||
self.assertEqual(res[0], 0)
|
||||
# Go doesn't provide API to get NamedGroup ID, but boringssl on port 7443 accepts only TLS1.2
|
||||
# so if handshake was successful, then that's all what we need
|
||||
self.assertIsNotNone(re.search(RE_TRIS_ALL_PASSED, res[1], re.MULTILINE))
|
||||
|
||||
class InteropClient_NSS(
|
||||
InteropClient,
|
||||
ClientNominalMixin,
|
||||
unittest.TestCase
|
||||
): SERVER_NAME = "tstclnt-localserver"
|
||||
|
||||
# TRIS as a client
|
||||
class InteropServer_TRIS(ClientNominalMixin, InteropServer, unittest.TestCase):
|
||||
|
||||
CLIENT_NAME = 'tris-testclient'
|
||||
|
||||
def test_client_auth(self):
|
||||
# I need to block TLS v1.2 as test server needs some rework
|
||||
res = self.d.run_client(self.CLIENT_NAME, '-rsa=false -ecdsa=false -cliauth '+self.server_ip+":6443")
|
||||
self.assertEqual(res[0], 0)
|
||||
|
||||
def test_SIDH(self):
|
||||
res = self.d.run_client(self.CLIENT_NAME, '-rsa=false -ecdsa=true -groups X25519-SIDHp503 '+self.server_ip+":7443")
|
||||
self.assertEqual(res[0], 0)
|
||||
|
||||
def test_SIKE(self):
|
||||
res = self.d.run_client(self.CLIENT_NAME, '-rsa=false -ecdsa=true -groups X25519-SIKEp503 '+self.server_ip+":7443")
|
||||
self.assertEqual(res[0], 0)
|
||||
|
||||
def test_server_doesnt_support_SIDH(self):
|
||||
'''
|
||||
Client advertises HybridSIDH and ECDH. Server supports ECDH only. Checks weather
|
||||
TLS session can still be established.
|
||||
'''
|
||||
res = self.d.run_client(self.CLIENT_NAME, '-rsa=false -ecdsa=true '+self.server_ip+":7443")
|
||||
self.assertEqual(res[0], 0)
|
||||
|
||||
if __name__ == '__main__':
|
||||
unittest.main()
|
||||
@ -1,21 +0,0 @@
|
||||
FROM golang:1.7-alpine
|
||||
|
||||
RUN apk add --update \
|
||||
git \
|
||||
&& rm -rf /var/cache/apk/*
|
||||
|
||||
RUN go get github.com/bifurcation/mint
|
||||
|
||||
# Draft 18
|
||||
ARG REVISION=52f9f98
|
||||
|
||||
RUN cd /go/src/github.com/bifurcation/mint && git fetch https://github.com/FiloSottile/mint
|
||||
RUN cd /go/src/github.com/bifurcation/mint && git checkout $REVISION
|
||||
|
||||
ADD mint-client.go /mint-client.go
|
||||
RUN GOBIN=/ go install /mint-client.go
|
||||
|
||||
ENV MINT_LOG=*
|
||||
|
||||
ADD run.sh /run.sh
|
||||
ENTRYPOINT ["/run.sh"]
|
||||
@ -1,41 +0,0 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"log"
|
||||
"net"
|
||||
"net/http"
|
||||
"os"
|
||||
|
||||
"github.com/bifurcation/mint"
|
||||
)
|
||||
|
||||
func main() {
|
||||
c := &mint.Config{
|
||||
PSKs: &mint.PSKMapCache{},
|
||||
}
|
||||
|
||||
tr := &http.Transport{
|
||||
DialTLS: func(network, addr string) (net.Conn, error) {
|
||||
return mint.Dial(network, addr, c)
|
||||
},
|
||||
DisableKeepAlives: true,
|
||||
}
|
||||
client := &http.Client{Transport: tr}
|
||||
|
||||
resp, err := client.Get("https://" + os.Args[1])
|
||||
if err != nil {
|
||||
log.Fatal(err)
|
||||
}
|
||||
if err := resp.Write(os.Stdout); err != nil {
|
||||
log.Fatal(err)
|
||||
}
|
||||
|
||||
// Resumption
|
||||
resp, err = client.Get("https://" + os.Args[1])
|
||||
if err != nil {
|
||||
log.Fatal(err)
|
||||
}
|
||||
if err := resp.Write(os.Stdout); err != nil {
|
||||
log.Fatal(err)
|
||||
}
|
||||
}
|
||||
@ -1,3 +0,0 @@
|
||||
#! /bin/sh
|
||||
|
||||
exec /mint-client "$@"
|
||||
@ -1,63 +0,0 @@
|
||||
From 88253a956a753213617d95af3f42a23a78798473 Mon Sep 17 00:00:00 2001
|
||||
From: Filippo Valsorda <filippo@cloudflare.com>
|
||||
Date: Mon, 28 Nov 2016 05:24:21 +0000
|
||||
Subject: [PATCH] net/http: attach TLSConnContextKey to the request Context
|
||||
|
||||
Change-Id: Ic59c84f992c829dc7da741b128dd6899366fa1d2
|
||||
---
|
||||
src/net/http/request.go | 4 +++-
|
||||
src/net/http/server.go | 12 ++++++++++++
|
||||
2 files changed, 15 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/net/http/request.go b/src/net/http/request.go
|
||||
index 13f367c1a8..b2827ff123 100644
|
||||
--- a/src/net/http/request.go
|
||||
+++ b/src/net/http/request.go
|
||||
@@ -275,7 +275,9 @@ type Request struct {
|
||||
// was received. This field is not filled in by ReadRequest.
|
||||
// The HTTP server in this package sets the field for
|
||||
// TLS-enabled connections before invoking a handler;
|
||||
- // otherwise it leaves the field nil.
|
||||
+ // otherwise it leaves the field nil. The value is fixed
|
||||
+ // at the state of the connection immediately after Handshake,
|
||||
+ // for an immediate value use TLSConnContextKey.
|
||||
// This field is ignored by the HTTP client.
|
||||
TLS *tls.ConnectionState
|
||||
|
||||
diff --git a/src/net/http/server.go b/src/net/http/server.go
|
||||
index 2fa8ab23d8..b0542cdbc3 100644
|
||||
--- a/src/net/http/server.go
|
||||
+++ b/src/net/http/server.go
|
||||
@@ -223,6 +223,12 @@ var (
|
||||
// the local address the connection arrived on.
|
||||
// The associated value will be of type net.Addr.
|
||||
LocalAddrContextKey = &contextKey{"local-addr"}
|
||||
+
|
||||
+ // TLSConnContextKey is a context key. It can be used in
|
||||
+ // HTTP handlers with context.WithValue to access the
|
||||
+ // underlying *tls.Conn being served. If the connection
|
||||
+ // is not TLS, the key is not set.
|
||||
+ TLSConnContextKey = &contextKey{"tls-conn"}
|
||||
)
|
||||
|
||||
// A conn represents the server side of an HTTP connection.
|
||||
@@ -969,6 +975,9 @@ func (c *conn) readRequest(ctx context.Context) (w *response, err error) {
|
||||
delete(req.Header, "Host")
|
||||
|
||||
ctx, cancelCtx := context.WithCancel(ctx)
|
||||
+ if tlsConn, ok := c.rwc.(*tls.Conn); ok {
|
||||
+ ctx = context.WithValue(ctx, TLSConnContextKey, tlsConn)
|
||||
+ }
|
||||
req.ctx = ctx
|
||||
req.RemoteAddr = c.remoteAddr
|
||||
req.TLS = c.tlsState
|
||||
@@ -3161,6 +3170,9 @@ func (h initNPNRequest) ServeHTTP(rw ResponseWriter, req *Request) {
|
||||
if req.RemoteAddr == "" {
|
||||
req.RemoteAddr = h.c.RemoteAddr().String()
|
||||
}
|
||||
+ if req.ctx != nil && req.ctx.Value(TLSConnContextKey) == nil {
|
||||
+ req.ctx = context.WithValue(req.ctx, TLSConnContextKey, h.c)
|
||||
+ }
|
||||
h.h.ServeHTTP(rw, req)
|
||||
}
|
||||
|
||||
@ -1,26 +0,0 @@
|
||||
FROM alpine
|
||||
|
||||
RUN apk add --update \
|
||||
git \
|
||||
cmake \
|
||||
build-base \
|
||||
openssl-dev \
|
||||
bash \
|
||||
&& rm -rf /var/cache/apk/*
|
||||
|
||||
RUN git clone https://github.com/h2o/picotls
|
||||
|
||||
# Draft -18
|
||||
#ARG REVISION=a6c1c65
|
||||
|
||||
# Draft -22
|
||||
ARG REVISION=843ccdc
|
||||
|
||||
RUN cd picotls && git fetch && git checkout $REVISION
|
||||
|
||||
RUN cd picotls && git submodule update --init
|
||||
RUN cd picotls && cmake . && make
|
||||
|
||||
ADD httpreq.txt /httpreq.txt
|
||||
ADD run.sh /run.sh
|
||||
ENTRYPOINT ["/run.sh"]
|
||||
@ -1,5 +0,0 @@
|
||||
GET / HTTP/1.1
|
||||
Host: example.com
|
||||
Connection: close
|
||||
|
||||
|
||||
@ -1,10 +0,0 @@
|
||||
#! /bin/bash
|
||||
set -e
|
||||
|
||||
IFS=':' read -ra ADDR <<< "$1"
|
||||
shift
|
||||
HOST="${ADDR[0]}"
|
||||
PORT="${ADDR[1]}"
|
||||
|
||||
/picotls/cli -s /session -e "$@" $HOST $PORT < /httpreq.txt
|
||||
/picotls/cli -s /session -e "$@" $HOST $PORT < /httpreq.txt
|
||||
26
_dev/testdata/Dockerfile
vendored
26
_dev/testdata/Dockerfile
vendored
@ -1,26 +0,0 @@
|
||||
# docker build -t tls-tris:testdata _dev/testdata
|
||||
# GOOS=linux ./_dev/go.sh test -c crypto/tls
|
||||
# docker run -it --rm -v "$(pwd):$(pwd)" -w "$(pwd)" tls-tris:testdata
|
||||
# ./tls.test -update -test.v -test.run SCTs
|
||||
## === RUN TestHandshakClientSCTs
|
||||
## Wrote testdata/Client-TLSv12-SCT
|
||||
## --- PASS: TestHandshakClientSCTs (0.62s)
|
||||
## PASS
|
||||
|
||||
FROM alpine
|
||||
|
||||
RUN apk add --update \
|
||||
wget \
|
||||
build-base \
|
||||
perl \
|
||||
ca-certificates \
|
||||
linux-headers \
|
||||
&& rm -rf /var/cache/apk/*
|
||||
|
||||
RUN wget https://www.openssl.org/source/openssl-1.1.0c.tar.gz
|
||||
RUN tar xvf openssl-1.1.0c.tar.gz
|
||||
RUN cd openssl-1.1.0c && perl ./Configure enable-weak-ssl-ciphers enable-ssl3 enable-ssl3-method -static linux-x86_64
|
||||
RUN cd openssl-1.1.0c && make
|
||||
RUN cd openssl-1.1.0c && make install
|
||||
|
||||
ENTRYPOINT ["/bin/sh"]
|
||||
@ -1,7 +0,0 @@
|
||||
# Used to build examples. Must be compiled from current directory and after "make build-all"
|
||||
|
||||
build:
|
||||
GOROOT=../GOROOT/linux_amd64 go build ems_client.go
|
||||
|
||||
run:
|
||||
./ems_client google.com:443
|
||||
@ -1,75 +0,0 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
"crypto/tls"
|
||||
"flag"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"os"
|
||||
)
|
||||
|
||||
var tlsVersionToName = map[string]uint16{
|
||||
"tls10": tls.VersionTLS10,
|
||||
"tls11": tls.VersionTLS11,
|
||||
"tls12": tls.VersionTLS12,
|
||||
"tls13": tls.VersionTLS13,
|
||||
}
|
||||
|
||||
// Usage client args host:port
|
||||
func main() {
|
||||
var version string
|
||||
var addr string
|
||||
var enableEMS bool
|
||||
var resume bool
|
||||
var config tls.Config
|
||||
var cache tls.ClientSessionCache
|
||||
cache = tls.NewLRUClientSessionCache(0)
|
||||
flag.StringVar(&version, "version", "tls12", "Version of TLS to use")
|
||||
flag.BoolVar(&enableEMS, "m", false, "Enable EMS")
|
||||
flag.BoolVar(&resume, "r", false, "Attempt Resumption")
|
||||
flag.Parse()
|
||||
config.MinVersion = tlsVersionToName[version]
|
||||
config.MaxVersion = tlsVersionToName[version]
|
||||
config.InsecureSkipVerify = true
|
||||
config.UseExtendedMasterSecret = !enableEMS
|
||||
config.ClientSessionCache = cache
|
||||
var iters int
|
||||
if resume {
|
||||
iters = 2
|
||||
} else {
|
||||
iters = 1
|
||||
}
|
||||
addr = flag.Arg(0)
|
||||
for ; iters > 0; iters-- {
|
||||
conn, err := tls.Dial("tcp", addr, &config)
|
||||
if err != nil {
|
||||
fmt.Println("Error %s", err)
|
||||
os.Exit(1)
|
||||
}
|
||||
var req http.Request
|
||||
var response *http.Response
|
||||
req.Method = "GET"
|
||||
req.URL, err = url.Parse("https://" + addr + "/")
|
||||
if err != nil {
|
||||
fmt.Println("Failed to parse url")
|
||||
os.Exit(1)
|
||||
}
|
||||
req.Write(conn)
|
||||
reader := bufio.NewReader(conn)
|
||||
response, err = http.ReadResponse(reader, nil)
|
||||
if err != nil {
|
||||
fmt.Println("HTTP problem")
|
||||
fmt.Println(err)
|
||||
os.Exit(1)
|
||||
}
|
||||
io.Copy(os.Stdout, response.Body)
|
||||
conn.Close()
|
||||
if resume && iters == 2 {
|
||||
fmt.Println("Attempting resumption")
|
||||
}
|
||||
}
|
||||
os.Exit(0)
|
||||
}
|
||||
@ -1,16 +0,0 @@
|
||||
FROM buildpack-deps
|
||||
|
||||
ENV TLSDEBUG error
|
||||
|
||||
EXPOSE 1443
|
||||
EXPOSE 2443
|
||||
EXPOSE 3443
|
||||
EXPOSE 4443
|
||||
EXPOSE 5443
|
||||
EXPOSE 6443
|
||||
EXPOSE 7443
|
||||
|
||||
ADD tris-localserver /
|
||||
ADD runner.sh /
|
||||
|
||||
CMD [ "./runner.sh" ]
|
||||
@ -1,11 +0,0 @@
|
||||
#!/bin/sh
|
||||
|
||||
./tris-localserver -b 0.0.0.0:1443 -cert=rsa -rtt0=n 2>&1 & # first port: ECDSA (and no 0-RTT)
|
||||
./tris-localserver -b 0.0.0.0:2443 -cert=ecdsa -rtt0=a 2>&1 & # second port: RSA (and accept 0-RTT but not offer it)
|
||||
./tris-localserver -b 0.0.0.0:3443 -cert=ecdsa -rtt0=o 2>&1 & # third port: offer and reject 0-RTT
|
||||
./tris-localserver -b 0.0.0.0:4443 -cert=ecdsa -rtt0=oa 2>&1 & # fourth port: offer and accept 0-RTT
|
||||
./tris-localserver -b 0.0.0.0:5443 -cert=ecdsa -rtt0=oa -rtt0ack 2>&1 & # fifth port: offer and accept 0-RTT but confirm
|
||||
./tris-localserver -b 0.0.0.0:6443 -cert=rsa -cliauth 2>&1 & # sixth port: RSA with required client authentication
|
||||
./tris-localserver -b 0.0.0.0:7443 -cert=ecdsa -pq=c & # Enables support for both - post-quantum and classical KEX algorithms
|
||||
|
||||
wait
|
||||
@ -1,316 +0,0 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"crypto/x509"
|
||||
"encoding/hex"
|
||||
"errors"
|
||||
"flag"
|
||||
"fmt"
|
||||
"github.com/henrydcase/trs"
|
||||
"io/ioutil"
|
||||
"log"
|
||||
"net/http"
|
||||
"os"
|
||||
"strings"
|
||||
"time"
|
||||
)
|
||||
|
||||
type ZeroRTT_t int
|
||||
type PubKeyAlgo_t int
|
||||
|
||||
// Bitset
|
||||
const (
|
||||
ZeroRTT_None ZeroRTT_t = 0
|
||||
ZeroRTT_Offer = 1 << 0
|
||||
ZeroRTT_Accept = 1 << 1
|
||||
)
|
||||
|
||||
type server struct {
|
||||
Address string
|
||||
ZeroRTT ZeroRTT_t
|
||||
TLS tls.Config
|
||||
}
|
||||
|
||||
var tlsVersionToName = map[uint16]string{
|
||||
tls.VersionTLS10: "1.0",
|
||||
tls.VersionTLS11: "1.1",
|
||||
tls.VersionTLS12: "1.2",
|
||||
tls.VersionTLS13: "1.3",
|
||||
}
|
||||
|
||||
func NewServer() *server {
|
||||
s := new(server)
|
||||
s.ZeroRTT = ZeroRTT_None
|
||||
s.Address = "0.0.0.0:443"
|
||||
s.TLS = tls.Config{
|
||||
GetConfigForClient: func(*tls.ClientHelloInfo) (*tls.Config, error) {
|
||||
// If we send the first flight too fast, NSS sends empty early data.
|
||||
time.Sleep(500 * time.Millisecond)
|
||||
return nil, nil
|
||||
},
|
||||
MaxVersion: tls.VersionTLS13,
|
||||
ClientAuth: tls.NoClientCert,
|
||||
}
|
||||
|
||||
return s
|
||||
}
|
||||
|
||||
func enablePQ(s *server, enableDefault bool) {
|
||||
var pqGroups = []tls.CurveID{tls.HybridSIDHp503Curve25519, tls.HybridSIKEp503Curve25519}
|
||||
if enableDefault {
|
||||
var defaultCurvePreferences = []tls.CurveID{tls.X25519, tls.CurveP256, tls.CurveP384, tls.CurveP521}
|
||||
s.TLS.CurvePreferences = append(s.TLS.CurvePreferences, defaultCurvePreferences...)
|
||||
}
|
||||
s.TLS.CurvePreferences = append(s.TLS.CurvePreferences, pqGroups...)
|
||||
}
|
||||
|
||||
func (s *server) start() {
|
||||
var err error
|
||||
if (s.ZeroRTT & ZeroRTT_Offer) == ZeroRTT_Offer {
|
||||
s.TLS.Max0RTTDataSize = 100 * 1024
|
||||
}
|
||||
|
||||
if keyLogFile := os.Getenv("SSLKEYLOGFILE"); keyLogFile != "" {
|
||||
s.TLS.KeyLogWriter, err = os.OpenFile(keyLogFile, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0600)
|
||||
if err != nil {
|
||||
log.Fatalf("Cannot open keylog file: %v", err)
|
||||
}
|
||||
log.Println("Enabled keylog")
|
||||
}
|
||||
|
||||
s.TLS.ClientCAs = x509.NewCertPool()
|
||||
s.TLS.ClientCAs.AppendCertsFromPEM([]byte(rsaCa_client))
|
||||
s.TLS.Accept0RTTData = ((s.ZeroRTT & ZeroRTT_Accept) == ZeroRTT_Accept)
|
||||
s.TLS.NextProtos = []string{"npn_proto"}
|
||||
|
||||
httpServer := &http.Server{
|
||||
Addr: s.Address,
|
||||
TLSConfig: &s.TLS,
|
||||
}
|
||||
log.Fatal(httpServer.ListenAndServeTLS("", ""))
|
||||
}
|
||||
|
||||
// setServerCertificateFromArgs sets server certificate from an argument provided by the caller. Possible values
|
||||
// for arg_cert:
|
||||
// * "rsa": sets hardcoded RSA keypair
|
||||
// * "ecdsa": sets hardcoded ECDSA keypair
|
||||
// * FILE1:FILE2: Uses private key from FILE1 and public key from FILE2. Both must be in PEM format. FILE2 can
|
||||
// be single certificate or certificate chain.
|
||||
// * nil: fallbacks to "rsa"
|
||||
//
|
||||
// Function generate a panic in case certificate can't be correctly set
|
||||
func (s *server) setServerCertificateFromArgs(arg_cert *string) {
|
||||
var certStr, keyStr []byte
|
||||
var cert tls.Certificate
|
||||
var err error
|
||||
|
||||
if arg_cert == nil {
|
||||
// set rsa by default
|
||||
certStr, keyStr = []byte(rsaCert), []byte(rsaKey)
|
||||
} else {
|
||||
switch *arg_cert {
|
||||
case "rsa":
|
||||
certStr, keyStr = []byte(rsaCert), []byte(rsaKey)
|
||||
case "ecdsa":
|
||||
certStr, keyStr = []byte(ecdsaCert), []byte(ecdsaKey)
|
||||
default:
|
||||
files := strings.Split(*arg_cert, ":")
|
||||
if len(files) != 2 {
|
||||
err = errors.New("Wrong format provided after -cert.")
|
||||
goto err
|
||||
}
|
||||
keyStr, err = ioutil.ReadFile(files[0])
|
||||
if err != nil {
|
||||
goto err
|
||||
}
|
||||
certStr, err = ioutil.ReadFile(files[1])
|
||||
if err != nil {
|
||||
goto err
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
cert, err = tls.X509KeyPair(certStr, keyStr)
|
||||
if err != nil {
|
||||
goto err
|
||||
}
|
||||
|
||||
s.TLS.Certificates = []tls.Certificate{cert}
|
||||
err:
|
||||
if err != nil {
|
||||
// Not possible to proceed really
|
||||
log.Fatal(err)
|
||||
panic(err)
|
||||
}
|
||||
}
|
||||
|
||||
func main() {
|
||||
|
||||
s := NewServer()
|
||||
|
||||
arg_addr := flag.String("b", "0.0.0.0:443", "Address:port used for binding")
|
||||
arg_cert := flag.String("cert", "rsa", "Public algorithm to use:\nOptions [rsa, ecdsa, PrivateKeyFile:CertificateChainFile]")
|
||||
arg_zerortt := flag.String("rtt0", "n", `0-RTT, accepts following values [n: None, a: Accept, o: Offer, oa: Offer and Accept]`)
|
||||
arg_confirm := flag.Bool("rtt0ack", false, "0-RTT confirm")
|
||||
arg_clientauth := flag.Bool("cliauth", false, "Performs client authentication (RequireAndVerifyClientCert used)")
|
||||
arg_pq := flag.String("pq", "", "Enable quantum-resistant algorithms [c: Support classical and Quantum-Resistant, q: Enable Quantum-Resistant only]")
|
||||
flag.Parse()
|
||||
|
||||
s.Address = *arg_addr
|
||||
|
||||
s.setServerCertificateFromArgs(arg_cert)
|
||||
|
||||
if *arg_zerortt == "a" {
|
||||
s.ZeroRTT = ZeroRTT_Accept
|
||||
} else if *arg_zerortt == "o" {
|
||||
s.ZeroRTT = ZeroRTT_Offer
|
||||
} else if *arg_zerortt == "oa" {
|
||||
s.ZeroRTT = ZeroRTT_Offer | ZeroRTT_Accept
|
||||
}
|
||||
|
||||
if *arg_clientauth {
|
||||
s.TLS.ClientAuth = tls.RequireAndVerifyClientCert
|
||||
}
|
||||
|
||||
if *arg_pq == "c" {
|
||||
enablePQ(s, true)
|
||||
} else if *arg_pq == "q" {
|
||||
enablePQ(s, false)
|
||||
}
|
||||
|
||||
http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
|
||||
tlsConn := r.Context().Value(http.TLSConnContextKey).(*tls.Conn)
|
||||
|
||||
with0RTT := ""
|
||||
if !tlsConn.ConnectionState().HandshakeConfirmed {
|
||||
with0RTT = " [0-RTT]"
|
||||
}
|
||||
if *arg_confirm || r.URL.Path == "/confirm" {
|
||||
if err := tlsConn.ConfirmHandshake(); err != nil {
|
||||
log.Fatal(err)
|
||||
}
|
||||
if with0RTT != "" {
|
||||
with0RTT = " [0-RTT confirmed]"
|
||||
}
|
||||
if !tlsConn.ConnectionState().HandshakeConfirmed {
|
||||
panic("HandshakeConfirmed false after ConfirmHandshake")
|
||||
}
|
||||
}
|
||||
|
||||
resumed := ""
|
||||
if r.TLS.DidResume {
|
||||
resumed = " [resumed]"
|
||||
}
|
||||
|
||||
http2 := ""
|
||||
if r.ProtoMajor == 2 {
|
||||
http2 = " [HTTP/2]"
|
||||
}
|
||||
|
||||
fmt.Fprintf(w, "<!DOCTYPE html><p>Hello TLS %s%s%s%s _o/\n", tlsVersionToName[r.TLS.Version], resumed, with0RTT, http2)
|
||||
})
|
||||
|
||||
http.HandleFunc("/ch", func(w http.ResponseWriter, r *http.Request) {
|
||||
w.Header().Set("Content-Type", "text/plain")
|
||||
fmt.Fprintf(w, "Client Hello packet (%d bytes):\n%s", len(r.TLS.ClientHello), hex.Dump(r.TLS.ClientHello))
|
||||
})
|
||||
|
||||
s.start()
|
||||
}
|
||||
|
||||
const (
|
||||
rsaKey = `-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEpAIBAAKCAQEA1DHcIM3SThFqy8nAkPQFX0E7ph8jqh8EATXryjKHGuVjR3Xh
|
||||
OQ0BSPoJxyfdg/VEwevFrtmZAfz0WCbxvP2SVCmf7oobg4V2KPSo3nNt9vlBFUne
|
||||
RtIyHRQ8YRnGSWaRHzJbX6ffltnG2aD+8qUfk161rdZgxBA9G0Ga47IkwQhT2Hqu
|
||||
H3dW2Uu4W2WMyt6gX/tdyEAV57MOPcoceknr7Nb2kfiuDPR7h6wFrW3I6eoj8oX2
|
||||
SkIOuVNt1Z31BAUcPJDUjqopI0o9tolM/7X13M8dEY0OJQVr7FQYDF9JeSYeEMyb
|
||||
wizjBaHDm48mSghP1o5UssQBbNNC83btXCjiLQIDAQABAoIBACzvGgRAUYaCnbDl
|
||||
2kdXxUN0luMIuQ6vXrO67WF17bI+XRWm2riwDlObzzJDON9Wsua1vLjYD1SickOw
|
||||
i4RP1grIfbuPt1/UhT8LAC+LFgA0rBmL+OvaWw5ZWKffQ2QLujN3AG5zKB/Tog43
|
||||
z4UmfldAuQxE11zta2M4M0qAUNQnQj1oiuI8RUdG0VvvLw8Htdi1ogH0CI5R669z
|
||||
NjHt+JV+2gzKx6EX0s8mQL3yXGkC2xXItRbFclyCMJEhPS7QbBu+tru35N6WpzAq
|
||||
BCl2Q7LQogvSA6MXuMOx6CyuExVfgmhbfeoheLE8gmXwl0Y37n/g6ZBZFAtpCjcs
|
||||
UckPv0ECgYEA1orl7RwgIsZljMap6vWtMGoRIHKmT91DGpMmkh4suZe+yAk85maU
|
||||
49Vd+8ZfIN41AH37yrsGOcPHgz5o5QufELpoub6DCsQ7u9F1vQp55cp+qyBWzAgz
|
||||
b/xUuVnIyv3kLan3fpk7ZGCBXFBpLG0QXMFOHtda3Mlk5SmuoEYaYRkCgYEA/TLR
|
||||
u4neKqyqwsqMuRJGC1iKFVmfCjZeNMtPNbTWpdqez/vvT8APnEpIumUGt8YROLGZ
|
||||
8biUr5/ViOkmaP3wmQbO9m2/cE01lMTYv75w1cw2KVQe6kAHJkOx+JEx9xg53RJ/
|
||||
QlFtG5MQUy2599Gxp8BMGaXLH5yo4qwvNvY6CDUCgYEArxr7AwX7rKZlZ/sV4HHY
|
||||
gzVu+R7aY0DibiRATO5X7rrNuhLgI+UCDNqvNLn6FqeGdvpcsmDneeozQwmDL77G
|
||||
ey7KHyBBcF4tquQQxtRwHX+i1yUz8p+W7AX1WLrRSezjeenJ2QhUE1849hGjZeE2
|
||||
g546lq2Kub2enfPhVWsiSLECgYEA72T5QCPeVuLioUH5Q5Kvf1K7W+xcnr9A2xHP
|
||||
Vqwgtre5qFQ/tFuXZuIlWXbjnyY6aiwhrZYjntm0f7pRgrt2nHj/fafOdVPK8Voc
|
||||
xU4+SSbHntPWVw0qtVcUEjzVzRauvwMaJ43tZ0DpEnwNdO5i1oTObwF+x+jLFWZP
|
||||
TdwIinECgYBzjZeCxxOMk5SlPpTsLUtgC+q3m1AavXhUVNEPP2gKMOIPTETPbhbG
|
||||
LBxB2vVbJiS3J7itQy8gceT89O0vSEZnaTPXiM/Ws1QbkBJ8yW7KI7X4WuzN4Imq
|
||||
/cLBRXLb8R328U27YyQFNGMjr2tX/+vx5FulJjSloWMRNuFWUngv7w==
|
||||
-----END RSA PRIVATE KEY-----`
|
||||
rsaCert = `-----BEGIN CERTIFICATE-----
|
||||
MIIC+jCCAeKgAwIBAgIRANBDimJ/ww2tz77qcYIhuZowDQYJKoZIhvcNAQELBQAw
|
||||
EjEQMA4GA1UEChMHQWNtZSBDbzAeFw0xNjA5MjQxNzI5MTlaFw0yNjA5MjIxNzI5
|
||||
MTlaMBIxEDAOBgNVBAoTB0FjbWUgQ28wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
|
||||
ggEKAoIBAQDUMdwgzdJOEWrLycCQ9AVfQTumHyOqHwQBNevKMoca5WNHdeE5DQFI
|
||||
+gnHJ92D9UTB68Wu2ZkB/PRYJvG8/ZJUKZ/uihuDhXYo9Kjec232+UEVSd5G0jId
|
||||
FDxhGcZJZpEfMltfp9+W2cbZoP7ypR+TXrWt1mDEED0bQZrjsiTBCFPYeq4fd1bZ
|
||||
S7hbZYzK3qBf+13IQBXnsw49yhx6Sevs1vaR+K4M9HuHrAWtbcjp6iPyhfZKQg65
|
||||
U23VnfUEBRw8kNSOqikjSj22iUz/tfXczx0RjQ4lBWvsVBgMX0l5Jh4QzJvCLOMF
|
||||
ocObjyZKCE/WjlSyxAFs00Lzdu1cKOItAgMBAAGjSzBJMA4GA1UdDwEB/wQEAwIF
|
||||
oDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMBQGA1UdEQQNMAuC
|
||||
CWxvY2FsaG9zdDANBgkqhkiG9w0BAQsFAAOCAQEAygPV4enmvwSuMd1JarxOXpOK
|
||||
Z4Nsk7EKlfCPgzxQUOkFdLIr5ZG1kUkQt/omzTmoIWjLAsoYzT0ZCPOrioczKsWj
|
||||
MceFUIkT0w+eIl+8DzauPy34o8rjcApglF165UG3iphlpI+jdPzv5TBarUAbwsFb
|
||||
ClMLEiNJQ0OMxAIaRtb2RehD4q3OWlpWf6joJ36PRBqL8T5+f2x6Tg3c64UR+QPX
|
||||
98UcCQHHdEhm7y2z5Z2Wt0B48tZ+UAxDEoEwMghNyw7wUD79IRlXGYypBnXaMuLX
|
||||
46aGxbsSQ7Rfg62Co3JG7vo+eJd0AoZHrtFUnfM8V70IFzMBZnSwRslHRJe56Q==
|
||||
-----END CERTIFICATE-----`
|
||||
rsaCa_client = `-----BEGIN CERTIFICATE-----
|
||||
MIIF6zCCA9OgAwIBAgIUC4U4HlbkVMrKKTFK0mNrMFDpRskwDQYJKoZIhvcNAQEL
|
||||
BQAwfTELMAkGA1UEBhMCRlIxDTALBgNVBAgMBFBBQ0ExFzAVBgNVBAcMDkNhZ25l
|
||||
cyBzdXIgTWVyMSIwIAYDVQQLDBlDZXJ0IFRlc3RpbmcgT3JnYW5pemF0aW9uMSIw
|
||||
IAYDVQQDDBlDZXJ0IFRlc3RpbmcgT3JnYW5pemF0aW9uMB4XDTE5MDIyMjAwNDIz
|
||||
OVoXDTQ2MDcwOTAwNDIzOVowfTELMAkGA1UEBhMCRlIxDTALBgNVBAgMBFBBQ0Ex
|
||||
FzAVBgNVBAcMDkNhZ25lcyBzdXIgTWVyMSIwIAYDVQQLDBlDZXJ0IFRlc3Rpbmcg
|
||||
T3JnYW5pemF0aW9uMSIwIAYDVQQDDBlDZXJ0IFRlc3RpbmcgT3JnYW5pemF0aW9u
|
||||
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0z+DMLb7YIMFFNZpn+ve
|
||||
NdT7GL9DPyV9ZWSHpUuDyme6Og6Mp5IpCLlKjNXtizX5aQ9xQ746slt70fivSV/r
|
||||
tiEtayZkcwS7zHtc5f+U/S0hR1q5Zh3DaLQH9diSeuNFQN5pg7zQT5csJFlxf6EB
|
||||
j/ioSBC+J1E8A2FAh0qDq+TvPPyZEEjcJy0oBuNHUnkC3rwjt24DAUI26rN/Qk9P
|
||||
a6KR9bBOdHFFul3DEP/uPqWV9TvV5tJhP3J2RbfS79WljFy/lFIwvJvfQHYEjMt4
|
||||
/gq8yTSUgJ8zmgJQ1sgOKH1FzJd4EdAMquSYbElkc35jX8gggUNOUcwsIfJBnu41
|
||||
SC51JQruNT256zse76o8Dx3lSHiz5c6luZyJnZWWt6xWtfGEGMnckpn6cVvcbbgq
|
||||
eWqmttgE2QTpgYoYUVcX/XFtsmZVTu05r8MZoqje5rgW9nEvvW+3M+eT5h0M9eGQ
|
||||
bIT3D3tdXB2XWCjUWqxpZscFwyumGu7vdykBKLhMVR3nEpFfORnH+534vwi49fjz
|
||||
WnN6fXAZZLPnGtEdWXNgs9JtgI5UheAQbcA3FT+M3maa88V2JrETLps405NYp6hJ
|
||||
6msbS/AmV/eSilRmbGVj9TfKHb/BVHNYwVQ0Bu/QN2YQNQ9olOpIxXgKr6Y4tKZt
|
||||
wTOMiCxZrnDQneQOTnW0NAMCAwEAAaNjMGEwHQYDVR0OBBYEFNLiS6YezH2bWiZ3
|
||||
TNbkQzMoBBB2MB8GA1UdIwQYMBaAFNLiS6YezH2bWiZ3TNbkQzMoBBB2MA8GA1Ud
|
||||
EwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4ICAQAQ
|
||||
cWIFOusSLKizqcqMsbMIY/Jzy0Tq5jzeOAQEQBztu7eJb208SG2EJtD6ylBQCF8t
|
||||
FCxUbvWNrly1MJoMSXdn3uMz3kLKNQa6RENckwA1UuYZpdhvTUtmPun9QqFPJdqm
|
||||
oi0paOVut9q3dplDy6MUknGN4tNWp2ZDfyvom3mUMfYGEO/FCWTy8eFd6cHRE9bw
|
||||
tHkcX5r7GpDHH5vKXOF/deMp1Xgep5ZTasL13YwPiYgctst91pEfdcztjHW0mQNT
|
||||
ZH/TUQDgs2UCjcvyeOlgoZixWOpkf1Qyje15k9qMb89/5hdarxvAQbG2BezQtzyk
|
||||
bbCu1MQa2DBdAKbhQxas/DPSvSkA/y8v+hiovTWtPKErPnQqZqVy59KUTBWj8ZAj
|
||||
5dkDVjBvUcsJ/6zHv0X9puEnIDZ8pK+Xn9LbcbPE7Nf1ikDyOqHmLmhGfWlEGvoD
|
||||
3Q8f8zUySZ40mfqtVhc7OYqA66Q9quNQ4VBESVNiEJ/LuWHRXe74KqFdggsQqtS6
|
||||
UQQgw5lFnKHZ9pk2VlKzgpkmd5fLMOhcHWQbsah9TFOuW5vEhWGHNhGCyGouWTzD
|
||||
mkwlPS8arj/ymUn6t/oiwSOA6GbjQLnTXvoAjdBxnukQlNY6TUDk+lSQw0qfZGIA
|
||||
xZywUgRbLZH8TFUnuEQps35XnWrY8rrXVj9+9h0B4g==
|
||||
-----END CERTIFICATE-----`
|
||||
ecdsaCert = `-----BEGIN CERTIFICATE-----
|
||||
MIIBbTCCAROgAwIBAgIQZCsHZcs5ZkzV+zC2E6j5RzAKBggqhkjOPQQDAjASMRAw
|
||||
DgYDVQQKEwdBY21lIENvMB4XDTE2MDkyNDE3NTE1OFoXDTI2MDkyMjE3NTE1OFow
|
||||
EjEQMA4GA1UEChMHQWNtZSBDbzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABDTO
|
||||
B3IyzjYfKCp2HWy+P3QHxhdBT4AUGYgwTiSEj5phumPIahFNcOSWptN0UzlZvJdN
|
||||
MMjVmrFYK/FjF4abkNKjSzBJMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUEDDAKBggr
|
||||
BgEFBQcDATAMBgNVHRMBAf8EAjAAMBQGA1UdEQQNMAuCCWxvY2FsaG9zdDAKBggq
|
||||
hkjOPQQDAgNIADBFAiEAp9W157PM1IadPBc33Cbj7vaFvp+rXs/hSuMCzP8pgV8C
|
||||
IHCswo1qiC0ZjQmWsBlmz5Zbp9rOorIzBYmGRhRdNs3j
|
||||
-----END CERTIFICATE-----`
|
||||
ecdsaKey = `-----BEGIN EC PRIVATE KEY-----
|
||||
MHcCAQEEIFdhO7IW5UIwpB1e2Vunm9QyKvUHWcVwGfLjhpOajuR7oAoGCCqGSM49
|
||||
AwEHoUQDQgAENM4HcjLONh8oKnYdbL4/dAfGF0FPgBQZiDBOJISPmmG6Y8hqEU1w
|
||||
5Jam03RTOVm8l00wyNWasVgr8WMXhpuQ0g==
|
||||
-----END EC PRIVATE KEY-----`
|
||||
)
|
||||
@ -1,5 +0,0 @@
|
||||
#! /bin/sh
|
||||
set -e
|
||||
|
||||
exec docker run --name tris-localserver --env TLSDEBUG=error "$@" tris-localserver
|
||||
|
||||
@ -1,7 +0,0 @@
|
||||
FROM buildpack-deps
|
||||
|
||||
ENV TLSDEBUG error
|
||||
|
||||
ADD tris-testclient /
|
||||
|
||||
ENTRYPOINT ["/tris-testclient"]
|
||||
@ -1,303 +0,0 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"crypto/x509"
|
||||
"errors"
|
||||
"flag"
|
||||
"fmt"
|
||||
"github.com/henrydcase/trs"
|
||||
"io"
|
||||
"log"
|
||||
"os"
|
||||
"strings"
|
||||
)
|
||||
|
||||
var tlsVersionToName = map[uint16]string{
|
||||
tls.VersionTLS10: "1.0",
|
||||
tls.VersionTLS11: "1.1",
|
||||
tls.VersionTLS12: "1.2",
|
||||
tls.VersionTLS13: "1.3",
|
||||
}
|
||||
|
||||
var cipherSuiteIdToName = map[uint16]string{
|
||||
tls.TLS_RSA_WITH_AES_128_CBC_SHA: "TLS_RSA_WITH_AES_128_CBC_SHA",
|
||||
tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
|
||||
tls.TLS_AES_128_GCM_SHA256: "TLS_AES_128_GCM_SHA256",
|
||||
tls.TLS_AES_256_GCM_SHA384: "TLS_AES_256_GCM_SHA384",
|
||||
tls.TLS_CHACHA20_POLY1305_SHA256: "TLS_CHACHA20_POLY1305_SHA256",
|
||||
}
|
||||
|
||||
var namedGroupsToName = map[uint16]string{
|
||||
uint16(tls.HybridSIDHp503Curve25519): "X25519-SIDHp503",
|
||||
uint16(tls.HybridSIKEp503Curve25519): "X25519-SIKEp503",
|
||||
uint16(tls.X25519): "X25519",
|
||||
uint16(tls.CurveP256): "P-256",
|
||||
uint16(tls.CurveP384): "P-384",
|
||||
uint16(tls.CurveP521): "P-521",
|
||||
}
|
||||
|
||||
func getIDByName(m map[uint16]string, name string) (uint16, error) {
|
||||
for key, value := range m {
|
||||
if value == name {
|
||||
return key, nil
|
||||
}
|
||||
}
|
||||
return 0, errors.New("Unknown value")
|
||||
}
|
||||
|
||||
var failed uint
|
||||
|
||||
type Client struct {
|
||||
TLS tls.Config
|
||||
addr string
|
||||
}
|
||||
|
||||
func NewClient() *Client {
|
||||
var c Client
|
||||
c.TLS.InsecureSkipVerify = true
|
||||
return &c
|
||||
}
|
||||
|
||||
func (c *Client) clone() *Client {
|
||||
var clone Client
|
||||
clone.TLS = *c.TLS.Clone()
|
||||
clone.addr = c.addr
|
||||
return &clone
|
||||
}
|
||||
|
||||
func (c *Client) setMinMaxTLS(ver uint16) {
|
||||
c.TLS.MinVersion = ver
|
||||
c.TLS.MaxVersion = ver
|
||||
}
|
||||
|
||||
func (c *Client) run() {
|
||||
fmt.Printf("TLS %s with %s\n", tlsVersionToName[c.TLS.MinVersion], cipherSuiteIdToName[c.TLS.CipherSuites[0]])
|
||||
|
||||
con, err := tls.Dial("tcp", c.addr, &c.TLS)
|
||||
if err != nil {
|
||||
fmt.Printf("handshake failed: %v\n\n", err)
|
||||
failed++
|
||||
return
|
||||
}
|
||||
defer con.Close()
|
||||
|
||||
_, err = con.Write([]byte("GET / HTTP/1.1\r\nHost: localhost\r\n\r\n"))
|
||||
if err != nil {
|
||||
fmt.Printf("Write failed: %v\n\n", err)
|
||||
failed++
|
||||
return
|
||||
}
|
||||
|
||||
buf := make([]byte, 1024)
|
||||
n, err := con.Read(buf)
|
||||
// A non-zero read with EOF is acceptable and occurs when a close_notify
|
||||
// is received right after reading data (observed with NSS selfserv).
|
||||
if !(n > 0 && err == io.EOF) && err != nil {
|
||||
fmt.Printf("Read failed: %v\n\n", err)
|
||||
failed++
|
||||
return
|
||||
}
|
||||
fmt.Printf("[TLS: %s] Read %d bytes\n", tlsVersionToName[con.ConnectionState().Version], n)
|
||||
fmt.Println("OK\n")
|
||||
}
|
||||
|
||||
func result() {
|
||||
if failed > 0 {
|
||||
log.Fatalf("Failed handshakes: %d\n", failed)
|
||||
} else {
|
||||
fmt.Println("All handshakes passed")
|
||||
}
|
||||
}
|
||||
|
||||
// Usage client args host:port
|
||||
func main() {
|
||||
var keylog_file, tls_version, named_groups, named_ciphers string
|
||||
var enable_rsa, enable_ecdsa, client_auth bool
|
||||
|
||||
flag.StringVar(&keylog_file, "keylogfile", "", "Secrets will be logged here")
|
||||
flag.BoolVar(&enable_rsa, "rsa", true, "Whether to enable RSA cipher suites")
|
||||
flag.BoolVar(&enable_ecdsa, "ecdsa", true, "Whether to enable ECDSA cipher suites")
|
||||
flag.BoolVar(&client_auth, "cliauth", false, "Whether to enable client authentication")
|
||||
flag.StringVar(&tls_version, "tls_version", "1.3", "TLS version to use")
|
||||
flag.StringVar(&named_groups, "groups", "X25519:P-256:P-384:P-521", "NamedGroups IDs to use")
|
||||
flag.StringVar(&named_ciphers, "ciphers", "TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384", "Named cipher IDs to use")
|
||||
flag.Parse()
|
||||
if flag.NArg() != 1 {
|
||||
flag.Usage()
|
||||
os.Exit(1)
|
||||
}
|
||||
|
||||
client := NewClient()
|
||||
client.addr = flag.Arg(0)
|
||||
if !strings.Contains(client.addr, ":") {
|
||||
client.addr += ":443"
|
||||
}
|
||||
|
||||
if keylog_file == "" {
|
||||
keylog_file = os.Getenv("SSLKEYLOGFILE")
|
||||
}
|
||||
if keylog_file != "" {
|
||||
keylog_writer, err := os.OpenFile(keylog_file, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0600)
|
||||
if err != nil {
|
||||
log.Fatalf("Cannot open keylog file: %v", err)
|
||||
}
|
||||
client.TLS.KeyLogWriter = keylog_writer
|
||||
log.Println("Enabled keylog")
|
||||
}
|
||||
|
||||
if client_auth {
|
||||
var err error
|
||||
client_cert, err := tls.X509KeyPair([]byte(client_crt), []byte(client_key))
|
||||
if err != nil {
|
||||
panic("Can't load client certificate")
|
||||
}
|
||||
|
||||
client.TLS.Certificates = []tls.Certificate{client_cert}
|
||||
client.TLS.RootCAs = x509.NewCertPool()
|
||||
if !client.TLS.RootCAs.AppendCertsFromPEM([]byte(client_ca)) {
|
||||
panic("Can't load client CA cert")
|
||||
}
|
||||
}
|
||||
|
||||
if enable_rsa {
|
||||
// Sanity check: TLS 1.2 with the mandatory cipher suite from RFC 5246
|
||||
c := client.clone()
|
||||
c.TLS.CipherSuites = []uint16{tls.TLS_RSA_WITH_AES_128_CBC_SHA}
|
||||
c.setMinMaxTLS(tls.VersionTLS12)
|
||||
c.run()
|
||||
}
|
||||
|
||||
if enable_ecdsa {
|
||||
// Sane cipher suite for TLS 1.2 with an ECDSA cert (as used by boringssl)
|
||||
c := client.clone()
|
||||
c.TLS.CipherSuites = []uint16{tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256}
|
||||
c.setMinMaxTLS(tls.VersionTLS12)
|
||||
c.run()
|
||||
}
|
||||
|
||||
// Set requested DH groups
|
||||
client.TLS.CurvePreferences = []tls.CurveID{}
|
||||
for _, ng := range strings.Split(named_groups, ":") {
|
||||
id, err := getIDByName(namedGroupsToName, ng)
|
||||
if err != nil {
|
||||
panic("Wrong group name provided")
|
||||
}
|
||||
client.TLS.CurvePreferences = append(client.TLS.CurvePreferences, tls.CurveID(id))
|
||||
}
|
||||
|
||||
// Perform TLS handshake with each each requested CipherSuite
|
||||
tlsID, err := getIDByName(tlsVersionToName, tls_version)
|
||||
if err != nil {
|
||||
panic("Unknown TLS version")
|
||||
}
|
||||
for _, cn := range strings.Split(named_ciphers, ":") {
|
||||
id, err := getIDByName(cipherSuiteIdToName, cn)
|
||||
if err != nil {
|
||||
panic("Wrong cipher name provided")
|
||||
}
|
||||
client.setMinMaxTLS(tlsID)
|
||||
client.TLS.CipherSuites = []uint16{id}
|
||||
client.run()
|
||||
}
|
||||
|
||||
// TODO test other kex methods besides X25519, like MTI secp256r1
|
||||
// TODO limit supported groups?
|
||||
|
||||
result()
|
||||
}
|
||||
|
||||
const (
|
||||
client_ca = `-----BEGIN CERTIFICATE-----
|
||||
MIIF6zCCA9OgAwIBAgIUC4U4HlbkVMrKKTFK0mNrMFDpRskwDQYJKoZIhvcNAQEL
|
||||
BQAwfTELMAkGA1UEBhMCRlIxDTALBgNVBAgMBFBBQ0ExFzAVBgNVBAcMDkNhZ25l
|
||||
cyBzdXIgTWVyMSIwIAYDVQQLDBlDZXJ0IFRlc3RpbmcgT3JnYW5pemF0aW9uMSIw
|
||||
IAYDVQQDDBlDZXJ0IFRlc3RpbmcgT3JnYW5pemF0aW9uMB4XDTE5MDIyMjAwNDIz
|
||||
OVoXDTQ2MDcwOTAwNDIzOVowfTELMAkGA1UEBhMCRlIxDTALBgNVBAgMBFBBQ0Ex
|
||||
FzAVBgNVBAcMDkNhZ25lcyBzdXIgTWVyMSIwIAYDVQQLDBlDZXJ0IFRlc3Rpbmcg
|
||||
T3JnYW5pemF0aW9uMSIwIAYDVQQDDBlDZXJ0IFRlc3RpbmcgT3JnYW5pemF0aW9u
|
||||
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0z+DMLb7YIMFFNZpn+ve
|
||||
NdT7GL9DPyV9ZWSHpUuDyme6Og6Mp5IpCLlKjNXtizX5aQ9xQ746slt70fivSV/r
|
||||
tiEtayZkcwS7zHtc5f+U/S0hR1q5Zh3DaLQH9diSeuNFQN5pg7zQT5csJFlxf6EB
|
||||
j/ioSBC+J1E8A2FAh0qDq+TvPPyZEEjcJy0oBuNHUnkC3rwjt24DAUI26rN/Qk9P
|
||||
a6KR9bBOdHFFul3DEP/uPqWV9TvV5tJhP3J2RbfS79WljFy/lFIwvJvfQHYEjMt4
|
||||
/gq8yTSUgJ8zmgJQ1sgOKH1FzJd4EdAMquSYbElkc35jX8gggUNOUcwsIfJBnu41
|
||||
SC51JQruNT256zse76o8Dx3lSHiz5c6luZyJnZWWt6xWtfGEGMnckpn6cVvcbbgq
|
||||
eWqmttgE2QTpgYoYUVcX/XFtsmZVTu05r8MZoqje5rgW9nEvvW+3M+eT5h0M9eGQ
|
||||
bIT3D3tdXB2XWCjUWqxpZscFwyumGu7vdykBKLhMVR3nEpFfORnH+534vwi49fjz
|
||||
WnN6fXAZZLPnGtEdWXNgs9JtgI5UheAQbcA3FT+M3maa88V2JrETLps405NYp6hJ
|
||||
6msbS/AmV/eSilRmbGVj9TfKHb/BVHNYwVQ0Bu/QN2YQNQ9olOpIxXgKr6Y4tKZt
|
||||
wTOMiCxZrnDQneQOTnW0NAMCAwEAAaNjMGEwHQYDVR0OBBYEFNLiS6YezH2bWiZ3
|
||||
TNbkQzMoBBB2MB8GA1UdIwQYMBaAFNLiS6YezH2bWiZ3TNbkQzMoBBB2MA8GA1Ud
|
||||
EwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4ICAQAQ
|
||||
cWIFOusSLKizqcqMsbMIY/Jzy0Tq5jzeOAQEQBztu7eJb208SG2EJtD6ylBQCF8t
|
||||
FCxUbvWNrly1MJoMSXdn3uMz3kLKNQa6RENckwA1UuYZpdhvTUtmPun9QqFPJdqm
|
||||
oi0paOVut9q3dplDy6MUknGN4tNWp2ZDfyvom3mUMfYGEO/FCWTy8eFd6cHRE9bw
|
||||
tHkcX5r7GpDHH5vKXOF/deMp1Xgep5ZTasL13YwPiYgctst91pEfdcztjHW0mQNT
|
||||
ZH/TUQDgs2UCjcvyeOlgoZixWOpkf1Qyje15k9qMb89/5hdarxvAQbG2BezQtzyk
|
||||
bbCu1MQa2DBdAKbhQxas/DPSvSkA/y8v+hiovTWtPKErPnQqZqVy59KUTBWj8ZAj
|
||||
5dkDVjBvUcsJ/6zHv0X9puEnIDZ8pK+Xn9LbcbPE7Nf1ikDyOqHmLmhGfWlEGvoD
|
||||
3Q8f8zUySZ40mfqtVhc7OYqA66Q9quNQ4VBESVNiEJ/LuWHRXe74KqFdggsQqtS6
|
||||
UQQgw5lFnKHZ9pk2VlKzgpkmd5fLMOhcHWQbsah9TFOuW5vEhWGHNhGCyGouWTzD
|
||||
mkwlPS8arj/ymUn6t/oiwSOA6GbjQLnTXvoAjdBxnukQlNY6TUDk+lSQw0qfZGIA
|
||||
xZywUgRbLZH8TFUnuEQps35XnWrY8rrXVj9+9h0B4g==
|
||||
-----END CERTIFICATE-----`
|
||||
client_crt = `-----BEGIN CERTIFICATE-----
|
||||
MIIFSjCCAzKgAwIBAgIUCKk2npLYEX2Z3Ceu1CwSKK50j04wDQYJKoZIhvcNAQEL
|
||||
BQAwfTELMAkGA1UEBhMCRlIxDTALBgNVBAgMBFBBQ0ExFzAVBgNVBAcMDkNhZ25l
|
||||
cyBzdXIgTWVyMSIwIAYDVQQLDBlDZXJ0IFRlc3RpbmcgT3JnYW5pemF0aW9uMSIw
|
||||
IAYDVQQDDBlDZXJ0IFRlc3RpbmcgT3JnYW5pemF0aW9uMB4XDTE5MDIyMjAwNDMz
|
||||
MloXDTQ2MDcwOTAwNDMzMlowfTELMAkGA1UEBhMCRlIxDTALBgNVBAgMBFBBQ0Ex
|
||||
FzAVBgNVBAcMDkNhZ25lcyBzdXIgTWVyMSIwIAYDVQQLDBlDZXJ0IFRlc3Rpbmcg
|
||||
T3JnYW5pemF0aW9uMSIwIAYDVQQDDBlDZXJ0IFRlc3RpbmcgT3JnYW5pemF0aW9u
|
||||
MIIBIDANBgkqhkiG9w0BAQEFAAOCAQ0AMIIBCAKCAQEA0DQrWlCfijylutz28aTB
|
||||
T9WDnvBWpJ535t/Clt4o2nv3Cp6JxvUVzYkdKuaLR295gyEBx9JSHiZxPiJoPVfp
|
||||
wigmG0R9HvByAG5rhaQbQt99npoBaHMps1i12VxxFy1yaqZW6mrwrHMfV716rZ2M
|
||||
AzWx7UfhutloBYeeluiziDWUSEuGeJG7kHdvUtGYlbRd/ElFWHOfAQ7Oc8UUjEHW
|
||||
sorkqciqyAERV/H9hr5Rap/J/ERcFC8bNecS4t1Yh98WgIun/MbcBKQzo1LsWmOQ
|
||||
dmaMBoG8g1mYRbNap8G/+aQbjfRi1zN0yaW1wtlLoBJmNgLjwYgaS/5Uey5NZMdb
|
||||
NwIBA6OBwzCBwDAJBgNVHRMEAjAAMBEGCWCGSAGG+EIBAQQEAwIFoDAxBglghkgB
|
||||
hvhCAQ0EJBYiQ2VydCBUZXN0aW5nIEludGVybWVkaWF0ZSAtIENsaWVudDAdBgNV
|
||||
HQ4EFgQULlrGFPbxwz525ywQYPs72P7YnL4wHwYDVR0jBBgwFoAU0uJLph7MfZta
|
||||
JndM1uRDMygEEHYwDgYDVR0PAQH/BAQDAgXgMB0GA1UdJQQWMBQGCCsGAQUFBwMC
|
||||
BggrBgEFBQcDBDANBgkqhkiG9w0BAQsFAAOCAgEAwLc+Xg5Fyfbgu5iFs1y7E0Et
|
||||
4E/5lF0A4iqDVX3e7/upoUIBFZFv2PlAqIlhQ49NgGlIfrBlwEijZJ9kgVmUcKDS
|
||||
UrqBvKUn+99dTC8Zn/Py9ofLNcJy+qNJg4TpbpBxXaP1MXdZYXdYkGtyyPIGo31U
|
||||
oHibNLQDCtKFMoEPCvFuCBtJgyT46l5KN7VQCA0ZDm84fVmIgEEOXWwz0mDIhGWm
|
||||
hDhmqONznl0+aHirqJxsBaplBaFVV1N02ksR53sPPy/UfDsAD3Fpp8R1DAMEyy0o
|
||||
kTqm8QINVL961YT1Y/oI+GlypjPq9cL0dEHdxwu6gyCHPMMGGGIDHmLoqJJuj/Kr
|
||||
/T08jhtDv8D7e9m3wfSW/RqHKE31Yy21SXv/gpcHGunwzDoj/QUvRl/xTjJfx+S8
|
||||
2NHxSU8QOdexhJumsNFJe8kH8cRJMCMB8/hfiBpI0QANkUBJ1aaa/p7vZuEKJm+/
|
||||
85m3Yz+zn58/Bube06z6QzFeR8Edi+6hXk4/WoHltgXiNowD3d4xI48sPWEbe+QZ
|
||||
6u60sEdpY2a+3Xwt9m9R2R+sGP3QyDFd9GVaUPt21TeeLdfS3kPqwO2k+UXB8nV3
|
||||
Yh1Hvyx67u0tX3wBVe40CNaAu7iW+e4aXjksG2dxk71lNq5CHJCOtbRK4LUArjy5
|
||||
cw4KAXWoaR8YIC3BWgg=
|
||||
-----END CERTIFICATE-----`
|
||||
client_key = `-----BEGIN PRIVATE KEY-----
|
||||
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDQNCtaUJ+KPKW6
|
||||
3PbxpMFP1YOe8Faknnfm38KW3ijae/cKnonG9RXNiR0q5otHb3mDIQHH0lIeJnE+
|
||||
Img9V+nCKCYbRH0e8HIAbmuFpBtC332emgFocymzWLXZXHEXLXJqplbqavCscx9X
|
||||
vXqtnYwDNbHtR+G62WgFh56W6LOINZRIS4Z4kbuQd29S0ZiVtF38SUVYc58BDs5z
|
||||
xRSMQdayiuSpyKrIARFX8f2GvlFqn8n8RFwULxs15xLi3ViH3xaAi6f8xtwEpDOj
|
||||
UuxaY5B2ZowGgbyDWZhFs1qnwb/5pBuN9GLXM3TJpbXC2UugEmY2AuPBiBpL/lR7
|
||||
Lk1kx1s3AgEDAoIBAQCKzXI8Nb+xfcPR6KShGIDf460UoDnDFE/vP9cPPsXm/U9c
|
||||
abEvTg6JBhNx7weE9PuswKvajDa+xEt+wZrTj/EsGsQSLai/Svaq9EeubWeB6lO/
|
||||
EVZFohvM5c6Q6EtkyPbxxDnxnKBy92o6flHJE7KsznaeL+vR5kVZBRRkmyJazS4s
|
||||
Z5rbrN9AhSIfyHs9GCQGgsXT6HMsyoJYFastwQ2qj+9L2ypcM8TW+KGzGfJipoJb
|
||||
l/N/8WHb4ZumA67lfWq4v5JTA5qAUKcfPszEBrUfQ34Tk+73Iiov9f7SXPYxWxVJ
|
||||
g9PuzfewvJrp6CPv+/mKNt8PmBYkaXlnyjr9tCwLAoGBAPjAVZapQVuIqftcOZtf
|
||||
Re9fAV9Vvv1FEO8bKJeIsPDlRkdg+TfTMgxhZU0I3P4XdEj7Fa87w4wkA6GkIrOO
|
||||
W9/usPOYzSdTP5aVEsdGbT8yD2vTST7Aw/GESKTRJA/Fe1PIb5Nz3OijyTusvFE+
|
||||
XSR3EXb1myX+2rFS0Wbiz2U5AoGBANZFWoeFzREnBcDG60RayjiTg71E1/T4zhvU
|
||||
e/w+71FNbLZXBrNqgV20F73xOme/Mb13yr+YgXxIEQfFtR6hRxZ8u1jndEzw66Jf
|
||||
YfHt7EGVceMV2pdP4md5ebebEj7qICfXPxF9IZicwZG3QMR5u0tvnx40iNMWhW0M
|
||||
rY4FabPvAoGBAKXVjmRw1j0FxqeS0RI/g/TqAOo5Kf4uC0oSGw+wdfXuLtpApiU3
|
||||
drLrmN4F6Klk+DCnY8on17LCrRZtbHe0PT/0dfe7M2+M1Q8ODITZniohX503hinV
|
||||
1/ZYMG3gwrUuUjfa9Qz36JsX230d0uDUPhhPYPn5EhlUkcuMi5nsikN7AoGBAI7Y
|
||||
5wUD3gtvWSsvR4LnMXsNAn4t5U37NBKNp/1/SjYznc7kryJHAOkiun6g0Zp/dn5P
|
||||
3H+7AP2FYK/ZI2nA2g790jtE+DNLR8GU6/aenYEOS+y5PGTf7ET7pnpnYX9GwBqP
|
||||
f2D+FmW91mEk1dhRJ4efv2l4WzdkWPNdyQlY8SKfAoGAEIWmowo7EpbR5Boxc2o3
|
||||
Tl0JbGi1CNJAHtDjEJCd1OxKrMUrK07hOeEKF6y8K/WBuQhFvI2pu16oT4sMal9Z
|
||||
mEiJdJAFErefPLQGomHLXfq9mDEY13Ug/xAd9aMyYcubIg5XjAqLMrB60HcrLr7Q
|
||||
2hMCSDdVP2V/F3QVh8DEirE=
|
||||
-----END PRIVATE KEY-----`
|
||||
)
|
||||
@ -1,61 +0,0 @@
|
||||
FROM buildpack-deps
|
||||
|
||||
RUN hg clone https://hg.mozilla.org/projects/nspr
|
||||
RUN hg clone https://hg.mozilla.org/projects/nss
|
||||
|
||||
ENV USE_64=1 NSS_ENABLE_TLS_1_3=1
|
||||
# Incremental build snapshot disabled as dependencies don't seem to be solid:
|
||||
# the same value changed in a header file would apply to one .c file and not another
|
||||
# RUN cd nss && make nss_build_all
|
||||
|
||||
# Draft 15
|
||||
# ARG REVISION=c483e5f9e0bc
|
||||
|
||||
# Draft 16
|
||||
# ARG REVISION=3e7b53b18112
|
||||
|
||||
# Draft 18
|
||||
# ARG REVISION=b6dfef6d0ff0
|
||||
|
||||
# Draft 18, NSS_3_34_1_RTM (with TLS 1.3 keylogging support)
|
||||
# ARG REVISION=e61c0f657100
|
||||
|
||||
# Draft 22
|
||||
#ARG REVISION=88c3f3fa581b
|
||||
|
||||
# Draft 23
|
||||
# ARG REVISION=16c622c9e1cc
|
||||
|
||||
# Latest
|
||||
ARG REVISION=ee357b00f2e6
|
||||
|
||||
RUN cd nss && hg pull
|
||||
RUN cd nss && hg checkout -C $REVISION
|
||||
|
||||
ADD *.patch ./
|
||||
RUN for p in *.patch; do patch -p1 -d nss < $p; done
|
||||
|
||||
RUN cd nss && make nss_build_all
|
||||
|
||||
# ENV HOST=localhost
|
||||
# RUN cd nss/tests/ssl_gtests && ./ssl_gtests.sh
|
||||
|
||||
RUN cd nss && make install
|
||||
|
||||
RUN mv /dist/$(uname -s)$(uname -r | cut -f 1-2 -d . -)_$(uname -m)_${CC:-cc}_glibc_PTH_64_$([ -n "$BUILD_OPT" ] && echo OPT || echo DBG).OBJ /dist/OBJ-PATH
|
||||
|
||||
ENV LD_LIBRARY_PATH=/dist/OBJ-PATH/lib
|
||||
|
||||
ENV SSLTRACE=100 SSLDEBUG=100
|
||||
|
||||
# Init test key using an empty noise (seed) file (-z /dev/null).
|
||||
# Use different subjects, otherwise NSS seems to merge keys under the same nickname.
|
||||
RUN mkdir /certdb && \
|
||||
/dist/OBJ-PATH/bin/certutil -d /certdb -N --empty-password && \
|
||||
/dist/OBJ-PATH/bin/certutil -d /certdb -S -n rsa-server -t u -x -s CN=localhost -k rsa -z /dev/null && \
|
||||
/dist/OBJ-PATH/bin/certutil -d /certdb -S -n ecdsa-server -t u -x -s CN=localhost,O=EC -k ec -z /dev/null -q nistp256
|
||||
|
||||
ADD httpreq.txt /httpreq.txt
|
||||
ADD run.sh /run.sh
|
||||
ADD server.sh /server.sh
|
||||
ENTRYPOINT ["/run.sh"]
|
||||
@ -1,5 +0,0 @@
|
||||
GET / HTTP/1.1
|
||||
Host: example.com
|
||||
Connection: close
|
||||
|
||||
|
||||
@ -1,37 +0,0 @@
|
||||
diff -r 15c6a01b9fe8 cmd/tstclnt/tstclnt.c
|
||||
--- a/cmd/tstclnt/tstclnt.c Fri Jun 10 18:34:00 2016 +0100
|
||||
+++ b/cmd/tstclnt/tstclnt.c Thu Jun 16 16:26:29 2016 +0100
|
||||
@@ -713,7 +713,6 @@
|
||||
return NSS_GetClientAuthData(arg, socket, caNames, pRetCert, pRetKey);
|
||||
}
|
||||
|
||||
-#if defined(WIN32) || defined(OS2)
|
||||
void
|
||||
thread_main(void *arg)
|
||||
{
|
||||
@@ -746,7 +745,6 @@
|
||||
PR_Close(ps);
|
||||
}
|
||||
|
||||
-#endif
|
||||
|
||||
static void
|
||||
printHostNameAndAddr(const char *host, const PRNetAddr *addr)
|
||||
@@ -1545,7 +1543,8 @@
|
||||
npds = 2;
|
||||
std_out = PR_GetSpecialFD(PR_StandardOutput);
|
||||
|
||||
-#if defined(WIN32) || defined(OS2)
|
||||
+ // Enabled PR_Poll compatibility mode for running in docker run. (sigh).
|
||||
+
|
||||
/* PR_Poll cannot be used with stdin on Windows or OS/2. (sigh).
|
||||
** But use of PR_Poll and non-blocking sockets is a major feature
|
||||
** of this program. So, we simulate a pollable stdin with a
|
||||
@@ -1573,7 +1572,6 @@
|
||||
goto done;
|
||||
}
|
||||
}
|
||||
-#endif
|
||||
|
||||
if (serverCertAuth.testFreshStatusFromSideChannel) {
|
||||
SSL_ForceHandshake(s);
|
||||
@ -1,8 +0,0 @@
|
||||
#! /bin/bash
|
||||
|
||||
IFS=':' read -ra ADDR <<< "$1"
|
||||
shift
|
||||
HOST="${ADDR[0]}"
|
||||
PORT="${ADDR[1]}"
|
||||
|
||||
exec /dist/OBJ-PATH/bin/tstclnt -D -V tls1.3:tls1.3 -o -O -h $HOST -p $PORT -v -A /httpreq.txt -L 2 -Z "$@"
|
||||
@ -1,11 +0,0 @@
|
||||
#!/bin/sh
|
||||
PATH=/dist/OBJ-PATH/bin:$PATH
|
||||
set -x
|
||||
|
||||
# RSA
|
||||
selfserv -n rsa-server -p 1443 -d /certdb -V tls1.2:tls1.3 -v -Z &
|
||||
|
||||
# ECDSA
|
||||
selfserv -n ecdsa-server -p 2443 -d /certdb -V tls1.2:tls1.3 -v -Z &
|
||||
|
||||
wait
|
||||
@ -1,20 +0,0 @@
|
||||
#!/bin/sh
|
||||
# Copyright 2012 The Go Authors. All rights reserved.
|
||||
# Use of this source code is governed by a BSD-style
|
||||
# license that can be found in the LICENSE file.
|
||||
|
||||
gofiles=$(find . -iname "*.go" ! -path "*/_dev/*")
|
||||
#[ -z "$gofiles" ] && exit 0
|
||||
|
||||
unformatted=$(gofmt -l $gofiles)
|
||||
[ -z "$unformatted" ] && exit 0
|
||||
|
||||
# Some files are not gofmt'd. Print message and fail.
|
||||
|
||||
echo >&2 "Go files must be formatted with gofmt. Please run:"
|
||||
for fn in $unformatted; do
|
||||
echo >&2 " gofmt -w $PWD/$fn"
|
||||
done
|
||||
|
||||
exit 1
|
||||
|
||||
@ -1,27 +0,0 @@
|
||||
#!/bin/sh
|
||||
# Copyright 2012 The Go Authors. All rights reserved.
|
||||
# Use of this source code is governed by a BSD-style
|
||||
# license that can be found in the LICENSE file.
|
||||
|
||||
# git gofmt pre-commit hook
|
||||
#
|
||||
# To use, store as .git/hooks/pre-commit inside your repository and make sure
|
||||
# it has execute permissions.
|
||||
#
|
||||
# This script does not handle file names that contain spaces.
|
||||
|
||||
gofiles=$(git diff --cached --name-only --diff-filter=ACM | grep '\.go$')
|
||||
[ -z "$gofiles" ] && exit 0
|
||||
|
||||
unformatted=$(gofmt -l $gofiles)
|
||||
[ -z "$unformatted" ] && exit 0
|
||||
|
||||
# Some files are not gofmt'd. Print message and fail.
|
||||
|
||||
echo >&2 "Go files must be formatted with gofmt. Please run:"
|
||||
for fn in $unformatted; do
|
||||
echo >&2 " gofmt -w $PWD/$fn"
|
||||
done
|
||||
|
||||
exit 1
|
||||
|
||||
Loading…
Reference in New Issue
Block a user