kris/th5: Alternative TLS implementation in Go - th5

Alternative TLS implementation in Go

Filippo Valsorda 740fc926aa tris: add single line TLSDEBUG=short		7 yıl önce
_dev	tris: update to Go 1.8rc2	7 yıl önce
testdata	crypto/tls: enable ChaCha20-Poly1305 cipher suites by default.	8 yıl önce
.travis.yml	tris: add proper BoGo tests	7 yıl önce
13.go	tris: add single line TLSDEBUG=short	7 yıl önce
README.md	tris: import go wrapper and interoperability tests	7 yıl önce
alert.go	crypto/tls: use correct alerts	7 yıl önce
cipher_suites.go	[dev.tls] crypto/tls: implement TLS 1.3 cipher suites	7 yıl önce
common.go	crypto/tls: use correct alerts	7 yıl önce
conn.go	crypto/tls: disallow handshake messages fragmented across CCS	7 yıl önce
conn_test.go	crypto/tls: use io.ReadFull in conn_test.go	7 yıl önce
example_test.go	crypto/tls: add example for Config KeyLogWriter	8 yıl önce
generate_cert.go	crypto/tls: recommend P256 elliptic curve	7 yıl önce
handshake_client.go	crypto/tls: use correct alerts	7 yıl önce
handshake_client_test.go	crypto/tls: use correct alerts	7 yıl önce
handshake_messages.go	crypto/tls: use correct alerts	7 yıl önce
handshake_messages_test.go	crypto/tls: use correct alerts	7 yıl önce
handshake_server.go	crypto/tls: detect unexpected leftover handshake data	7 yıl önce
handshake_server_test.go	crypto/tls: use correct alerts	7 yıl önce
handshake_test.go	crypto/tls: switch to OpenSSL 1.1.0 for test data.	8 yıl önce
hkdf.go	crypto/tls: implement TLS 1.3 minimal server	7 yıl önce
key_agreement.go	crypto/tls: implement TLS 1.3 minimal server	7 yıl önce
prf.go	crypto/tls: return from Handshake before the Client Finished in 1.3	7 yıl önce
prf_test.go	crypto/tls: decouple handshake signatures from the handshake hash.	9 yıl önce
ticket.go	crypto/tls: use correct alerts	7 yıl önce
tls.go	crypto/tls: disable CBC cipher suites with SHA-256 by default	7 yıl önce
tls_test.go	crypto/tls: implement TLS 1.3 server 0-RTT	7 yıl önce

README.md

 _____ _     ____        _        _
|_   _| |   / ___|      | |_ _ __(_)___
  | | | |   \___ \ _____| __| '__| / __|
  | | | |___ ___) |_____| |_| |  | \__ \
  |_| |_____|____/       \__|_|  |_|___/

crypto/tls, now with 100% more 1.3.

DO NOT USE THIS FOR THE SAKE OF EVERYTHING THAT’S GOOD AND JUST.

Usage

Since crypto/tls is very deeply (and not that elegantly) coupled with the Go stdlib, tls-tris shouldn’t be used as an external package. It is also impossible to vendor it as crypto/tls because stdlib packages would import the standard one and mismatch.

So, to build with tls-tris, you need to use a custom GOROOT. A script is provided that will take care of it for you: ./_dev/go.sh. Just use that instead of the go tool.

The script also transparently fetches the custom Cloudflare Go compiler with the required backports.

./_dev/go.sh build ./_dev/tris-localserver
TLSDEBUG=error ./tris-localserver 127.0.0.1:4443

Debugging

When the environment variable TLSDEBUG is set to error, Tris will print a hexdump of the Client Hello and a stack trace if an handshake error occurs.

Building Caddy

./_dev/go.sh build github.com/mholt/caddy

Note: to get Caddy to use TLS 1.3 you’ll have to apply the patch at _dev/caddy/caddy.patch.

Testing with Firefox

Download the latest Firefox Nightly
Navigate to about:config and set security.tls.version.max to 4
Connect to https://tris.filippo.io/ or tris-localserver

Testing with BoringSSL/BoGo/NSS/Mint

./_dev/tris-localserver/start.sh --rm

docker build -t tls-tris:boring _dev/boring
docker run -i --rm tls-tris:boring $(docker inspect -f '{{ .NetworkSettings.IPAddress }}' tris-localserver):443

docker build -t tls-tris:bogo _dev/bogo
docker run -i --rm tls-tris:bogo $(docker inspect -f '{{ .NetworkSettings.IPAddress }}' tris-localserver):443

docker build -t tls-tris:tstclnt _dev/tstclnt
docker run -i --rm tls-tris:tstclnt $(docker inspect -f '{{ .NetworkSettings.IPAddress }}' tris-localserver):443

docker build -t tls-tris:mint _dev/mint
docker run -i --rm tls-tris:mint $(docker inspect -f '{{ .NetworkSettings.IPAddress }}' tris-localserver):443

To build a specific revision, use --build-arg REVISION=abcdef1234.