tttls1.3 0.2.13 → 0.2.14
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.github/workflows/{main.yml → ci.yml} +5 -3
- data/.rubocop.yml +1 -1
- data/README.md +1 -1
- data/example/https_client.rb +1 -1
- data/example/https_client_using_0rtt.rb +1 -1
- data/example/https_client_using_hrr.rb +1 -1
- data/example/https_client_using_hrr_and_ticket.rb +1 -1
- data/example/https_client_using_status_request.rb +1 -1
- data/example/https_client_using_ticket.rb +1 -1
- data/example/https_server.rb +1 -1
- data/interop/client_spec.rb +6 -6
- data/interop/server_spec.rb +6 -6
- data/lib/tttls1.3/connection.rb +5 -5
- data/lib/tttls1.3/cryptograph/aead.rb +20 -7
- data/lib/tttls1.3/version.rb +1 -1
- data/spec/fixtures/rsa_rsa.crt +15 -15
- data/spec/fixtures/rsa_rsa.key +25 -25
- metadata +7 -7
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 3861f9a9864268fda75836b387c4a1f83e4edea0e885595155f2a352f69695ea
|
4
|
+
data.tar.gz: 617f9b12aa8ac8e39367b1b5f9fcba57d1bd3dc669fe645c7c6888a7140795bd
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 1f97901b82520b9c0a1fbc864e7e101749d9dacba3554e721eaf223fb1d4026384bf0756c8e9ac4578bcab37eb9c7b8e9c50b0387f3dfd7e8cf2d8456e709b14
|
7
|
+
data.tar.gz: a0d104b2e5dba0e7e7f8297a51b858f0912007f59350e1842e026639c1cc27d107c2737292f01cc2bf1fbc6c3374cb3426696f00ee2462c72d014c841ea3ce7d
|
@@ -1,4 +1,4 @@
|
|
1
|
-
name:
|
1
|
+
name: CI
|
2
2
|
|
3
3
|
on:
|
4
4
|
push:
|
@@ -13,15 +13,17 @@ jobs:
|
|
13
13
|
runs-on: ubuntu-latest
|
14
14
|
strategy:
|
15
15
|
matrix:
|
16
|
-
ruby-version: ['2.6.x']
|
16
|
+
ruby-version: ['2.6.x', '2.7.x']
|
17
17
|
steps:
|
18
|
-
- uses: thekuwayama/openssl
|
18
|
+
- uses: docker://thekuwayama/openssl:latest
|
19
19
|
- name: Set up Ruby
|
20
20
|
uses: actions/setup-ruby@v1
|
21
21
|
- uses: actions/checkout@v1
|
22
22
|
- name: Install dependencies
|
23
23
|
run: |
|
24
|
+
gem --version
|
24
25
|
gem install bundler
|
26
|
+
bundle --version
|
25
27
|
bundle install
|
26
28
|
- name: Run test
|
27
29
|
run: |
|
data/.rubocop.yml
CHANGED
data/README.md
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
# tttls1.3
|
2
2
|
|
3
3
|
[](https://badge.fury.io/rb/tttls1.3)
|
4
|
-
[](https://github.com/thekuwayama/tttls1.3/actions?workflow=CI)
|
5
5
|
[](https://codeclimate.com/github/thekuwayama/tttls1.3/maintainability)
|
6
6
|
|
7
7
|
tttls1.3 is Ruby implementation of [TLS 1.3](https://tools.ietf.org/html/rfc8446) protocol.
|
data/example/https_client.rb
CHANGED
@@ -36,7 +36,7 @@ succeed_early_data = false
|
|
36
36
|
settings_2nd
|
37
37
|
].each_with_index do |settings, i|
|
38
38
|
socket = TCPSocket.new(hostname, port)
|
39
|
-
client = TTTLS13::Client.new(socket, hostname, settings)
|
39
|
+
client = TTTLS13::Client.new(socket, hostname, **settings)
|
40
40
|
|
41
41
|
# send message using early data; 0-RTT
|
42
42
|
client.early_data(req) if i == 1 && settings.include?(:ticket)
|
@@ -13,7 +13,7 @@ settings = {
|
|
13
13
|
key_share_groups: [], # empty KeyShareClientHello.client_shares
|
14
14
|
alpn: ['http/1.1']
|
15
15
|
}
|
16
|
-
client = TTTLS13::Client.new(socket, hostname, settings)
|
16
|
+
client = TTTLS13::Client.new(socket, hostname, **settings)
|
17
17
|
client.connect
|
18
18
|
client.write(req)
|
19
19
|
print recv_http_response(client)
|
@@ -35,7 +35,7 @@ settings_1st = {
|
|
35
35
|
settings_2nd
|
36
36
|
].each do |settings|
|
37
37
|
socket = TCPSocket.new(hostname, port)
|
38
|
-
client = TTTLS13::Client.new(socket, hostname, settings)
|
38
|
+
client = TTTLS13::Client.new(socket, hostname, **settings)
|
39
39
|
client.connect
|
40
40
|
client.write(req)
|
41
41
|
print recv_http_response(client)
|
@@ -22,7 +22,7 @@ settings = {
|
|
22
22
|
check_certificate_status: true,
|
23
23
|
process_certificate_status: process_certificate_status
|
24
24
|
}
|
25
|
-
client = TTTLS13::Client.new(socket, hostname, settings)
|
25
|
+
client = TTTLS13::Client.new(socket, hostname, **settings)
|
26
26
|
client.connect
|
27
27
|
client.write(req)
|
28
28
|
|
@@ -34,7 +34,7 @@ settings_1st = {
|
|
34
34
|
settings_2nd
|
35
35
|
].each do |settings|
|
36
36
|
socket = TCPSocket.new(hostname, port)
|
37
|
-
client = TTTLS13::Client.new(socket, hostname, settings)
|
37
|
+
client = TTTLS13::Client.new(socket, hostname, **settings)
|
38
38
|
client.connect
|
39
39
|
client.write(req)
|
40
40
|
print recv_http_response(client)
|
data/example/https_server.rb
CHANGED
data/interop/client_spec.rb
CHANGED
@@ -7,14 +7,13 @@ FIXTURES_DIR = __dir__ + '/../spec/fixtures'
|
|
7
7
|
PORT = 4433
|
8
8
|
|
9
9
|
RSpec.describe Client do
|
10
|
-
# testcases
|
11
10
|
# normal [Boolean] Is this nominal scenarios?
|
12
11
|
# opt [String] openssl s_server options
|
13
12
|
# crt [String] server crt file path
|
14
13
|
# key [String] server key file path
|
15
14
|
# settings [Hash] TTTLS13::Server settings
|
16
|
-
|
17
|
-
|
15
|
+
# rubocop: disable Layout/LineLength
|
16
|
+
testcases = [
|
18
17
|
[
|
19
18
|
true,
|
20
19
|
'-ciphersuites TLS_AES_256_GCM_SHA384',
|
@@ -163,8 +162,9 @@ RSpec.describe Client do
|
|
163
162
|
'rsa_rsa.key',
|
164
163
|
compatibility_mode: false
|
165
164
|
]
|
166
|
-
|
167
|
-
|
165
|
+
]
|
166
|
+
# rubocop: enable Layout/LineLength
|
167
|
+
testcases.each do |normal, opt, crt, key, settings|
|
168
168
|
context 'client interop' do
|
169
169
|
before do
|
170
170
|
cmd = 'openssl s_server ' \
|
@@ -187,7 +187,7 @@ RSpec.describe Client do
|
|
187
187
|
hostname = 'localhost'
|
188
188
|
@socket = TCPSocket.new(hostname, PORT)
|
189
189
|
settings[:ca_file] = FIXTURES_DIR + '/rsa_ca.crt'
|
190
|
-
Client.new(@socket, hostname, settings)
|
190
|
+
Client.new(@socket, hostname, **settings)
|
191
191
|
end
|
192
192
|
|
193
193
|
after do
|
data/interop/server_spec.rb
CHANGED
@@ -9,14 +9,13 @@ PORT = 4433
|
|
9
9
|
tcpserver = TCPServer.open(PORT)
|
10
10
|
|
11
11
|
RSpec.describe Server do
|
12
|
-
# testcases
|
13
12
|
# normal [Boolean] Is this nominal scenarios?
|
14
13
|
# opt [String] openssl s_client options
|
15
14
|
# crt [String] server crt file path
|
16
15
|
# key [String] server key file path
|
17
16
|
# settings [Hash] TTTLS13::Client settins
|
18
|
-
|
19
|
-
|
17
|
+
# rubocop: disable Layout/LineLength
|
18
|
+
testcases = [
|
20
19
|
[
|
21
20
|
true,
|
22
21
|
'-groups P-256:P-384:P-521 -ciphersuites TLS_AES_256_GCM_SHA384',
|
@@ -172,8 +171,9 @@ RSpec.describe Server do
|
|
172
171
|
FIXTURES_DIR + '/rsa_rsa.key',
|
173
172
|
compatibility_mode: false
|
174
173
|
]
|
175
|
-
|
176
|
-
|
174
|
+
]
|
175
|
+
# rubocop: enable Layout/LineLength
|
176
|
+
testcases.each do |normal, opt, crt, key, settings|
|
177
177
|
context 'server interop' do
|
178
178
|
let(:server) do
|
179
179
|
loop do
|
@@ -182,7 +182,7 @@ RSpec.describe Server do
|
|
182
182
|
end
|
183
183
|
settings[:crt_file] = crt
|
184
184
|
settings[:key_file] = key
|
185
|
-
Server.new(@socket, settings)
|
185
|
+
Server.new(@socket, **settings)
|
186
186
|
end
|
187
187
|
|
188
188
|
let(:client) do
|
data/lib/tttls1.3/connection.rb
CHANGED
@@ -514,22 +514,22 @@ module TTTLS13
|
|
514
514
|
def do_select_signature_algorithms(signature_algorithms, crt)
|
515
515
|
spki = OpenSSL::Netscape::SPKI.new
|
516
516
|
spki.public_key = crt.public_key
|
517
|
-
|
518
|
-
|
517
|
+
pka = OpenSSL::ASN1.decode(spki.to_der)
|
518
|
+
.value.first.value.first.value.first.value.first.value
|
519
519
|
signature_algorithms.select do |sa|
|
520
520
|
case sa
|
521
521
|
when SignatureScheme::ECDSA_SECP256R1_SHA256,
|
522
522
|
SignatureScheme::ECDSA_SECP384R1_SHA384,
|
523
523
|
SignatureScheme::ECDSA_SECP521R1_SHA512
|
524
|
-
|
524
|
+
pka == 'id-ecPublicKey'
|
525
525
|
when SignatureScheme::RSA_PSS_PSS_SHA256,
|
526
526
|
SignatureScheme::RSA_PSS_PSS_SHA384,
|
527
527
|
SignatureScheme::RSA_PSS_PSS_SHA512
|
528
|
-
|
528
|
+
pka == 'rsassaPss'
|
529
529
|
when SignatureScheme::RSA_PSS_RSAE_SHA256,
|
530
530
|
SignatureScheme::RSA_PSS_RSAE_SHA384,
|
531
531
|
SignatureScheme::RSA_PSS_RSAE_SHA512
|
532
|
-
|
532
|
+
pka == 'rsaEncryption'
|
533
533
|
else
|
534
534
|
# RSASSA-PKCS1-v1_5 algorithms refer solely to signatures which appear
|
535
535
|
# in certificates and are not defined for use in signed TLS handshake
|
@@ -44,8 +44,7 @@ module TTTLS13
|
|
44
44
|
#
|
45
45
|
# @return [String]
|
46
46
|
def encrypt(content, type)
|
47
|
-
reset_cipher
|
48
|
-
cipher = @cipher.encrypt
|
47
|
+
cipher = reset_cipher
|
49
48
|
plaintext = content + type + "\x00" * @length_of_padding
|
50
49
|
cipher.auth_data = additional_data(plaintext.length)
|
51
50
|
encrypted_data = cipher.update(plaintext) + cipher.final
|
@@ -66,8 +65,7 @@ module TTTLS13
|
|
66
65
|
# @return [String]
|
67
66
|
# @return [TTTLS13::Message::ContentType]
|
68
67
|
def decrypt(encrypted_record, auth_data)
|
69
|
-
|
70
|
-
decipher = @cipher.decrypt
|
68
|
+
decipher = reset_decipher
|
71
69
|
auth_tag = encrypted_record[-@auth_tag_len..-1]
|
72
70
|
decipher.auth_tag = auth_tag
|
73
71
|
decipher.auth_data = auth_data # record header of TLSCiphertext
|
@@ -105,11 +103,26 @@ module TTTLS13
|
|
105
103
|
+ ciphertext_len.to_uint16
|
106
104
|
end
|
107
105
|
|
106
|
+
# @return [OpenSSL::Cipher]
|
108
107
|
def reset_cipher
|
109
|
-
@cipher.
|
110
|
-
|
108
|
+
cipher = @cipher.encrypt
|
109
|
+
cipher.reset
|
110
|
+
cipher.key = @write_key
|
111
111
|
iv_len = CipherSuite.iv_len(@cipher_suite)
|
112
|
-
|
112
|
+
cipher.iv = @sequence_number.xor(@write_iv, iv_len)
|
113
|
+
|
114
|
+
cipher
|
115
|
+
end
|
116
|
+
|
117
|
+
# @return [OpenSSL::Cipher]
|
118
|
+
def reset_decipher
|
119
|
+
decipher = @cipher.decrypt
|
120
|
+
decipher.reset
|
121
|
+
decipher.key = @write_key
|
122
|
+
iv_len = CipherSuite.iv_len(@cipher_suite)
|
123
|
+
decipher.iv = @sequence_number.xor(@write_iv, iv_len)
|
124
|
+
|
125
|
+
decipher
|
113
126
|
end
|
114
127
|
|
115
128
|
# @param clear [String]
|
data/lib/tttls1.3/version.rb
CHANGED
data/spec/fixtures/rsa_rsa.crt
CHANGED
@@ -1,18 +1,18 @@
|
|
1
1
|
-----BEGIN CERTIFICATE-----
|
2
|
-
|
3
|
-
|
2
|
+
MIIC2TCCAcGgAwIBAgIJALo0YKZBVqYnMA0GCSqGSIb3DQEBCwUAMBIxEDAOBgNV
|
3
|
+
BAMMB3Rlc3QtY2EwHhcNMjAwNzE1MTU0NTE4WhcNMzAwNzEzMTU0NTE4WjAUMRIw
|
4
4
|
EAYDVQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
|
5
|
-
|
6
|
-
|
7
|
-
|
8
|
-
|
9
|
-
|
10
|
-
|
11
|
-
|
12
|
-
|
13
|
-
|
14
|
-
|
15
|
-
|
16
|
-
|
17
|
-
|
5
|
+
AQC65xzvPQrsXXRVsQ4rcrmvOF0gdWV38JKlhHUrS50//T0S55FUSBkuVXUDCZDx
|
6
|
+
dOf0y/5HaMb3hm68+ld5B/oNtoPlJWW6Sgc8OLERQy9qGpwR0mXND4SnZ9or7RDV
|
7
|
+
8tAEg/Hzq5rm6Xy2WClSR+nHg2tVh2Szde39j7o8ivJpHPzfEyZh37y9oIiY2/FP
|
8
|
+
QpbAe8n3Ses04D3jhZRoysdcuneWuG3h5DJ9X4IhZUBM54nEO5IQElyYnF6xY/Lt
|
9
|
+
Gykf8+ydiuAZpZF5FGGfoiKB7XdIwhSlK1XRFeBbHRqyAFjpSNtqy6RPdJINLseb
|
10
|
+
wG6DNSxcLm91C6ZJaaqu7Qp1AgMBAAGjMDAuMAkGA1UdEwQCMAAwCwYDVR0PBAQD
|
11
|
+
AgWgMBQGA1UdEQQNMAuCCWxvY2FsaG9zdDANBgkqhkiG9w0BAQsFAAOCAQEALqaQ
|
12
|
+
J5H9jB2VmIEDxhXAQTeqW1Hmp0oHhL1XcAvNS+JILjFfAdjMe/3Kei3hQJv8j8sE
|
13
|
+
uck3o7iA4kcE0ydUzO7TM7efjqcksyZrmWSB0xj+NHjcybwhD4Selr1vBSCU0IHN
|
14
|
+
Ap+zYbBX7eQawm2lIzniBvS6MmP+dgZjhy73FVQ4oSz+wTcg1iPkhulYL4iV/HSG
|
15
|
+
fND5gUvlRbLHGTETpCdq7iJNOpNl/OYboJLPvVpx8H7Jc+L2bQl05fj/koO35xaL
|
16
|
+
JuZGj5aVOKw45WvqERpe1RI3077dWE6bAr9DzrW13IqmFMbPD817pcB6+ILZnMAF
|
17
|
+
RhobWRU6PA4TdDP8bg==
|
18
18
|
-----END CERTIFICATE-----
|
data/spec/fixtures/rsa_rsa.key
CHANGED
@@ -1,27 +1,27 @@
|
|
1
1
|
-----BEGIN RSA PRIVATE KEY-----
|
2
|
-
|
3
|
-
|
4
|
-
|
5
|
-
|
6
|
-
|
7
|
-
|
8
|
-
|
9
|
-
|
10
|
-
|
11
|
-
|
12
|
-
|
13
|
-
|
14
|
-
|
15
|
-
|
16
|
-
|
17
|
-
|
18
|
-
|
19
|
-
|
20
|
-
|
21
|
-
|
22
|
-
|
23
|
-
|
24
|
-
/
|
25
|
-
|
26
|
-
|
2
|
+
MIIEowIBAAKCAQEAuucc7z0K7F10VbEOK3K5rzhdIHVld/CSpYR1K0udP/09EueR
|
3
|
+
VEgZLlV1AwmQ8XTn9Mv+R2jG94ZuvPpXeQf6DbaD5SVlukoHPDixEUMvahqcEdJl
|
4
|
+
zQ+Ep2faK+0Q1fLQBIPx86ua5ul8tlgpUkfpx4NrVYdks3Xt/Y+6PIryaRz83xMm
|
5
|
+
Yd+8vaCImNvxT0KWwHvJ90nrNOA944WUaMrHXLp3lrht4eQyfV+CIWVATOeJxDuS
|
6
|
+
EBJcmJxesWPy7RspH/PsnYrgGaWReRRhn6Iige13SMIUpStV0RXgWx0asgBY6Ujb
|
7
|
+
asukT3SSDS7Hm8BugzUsXC5vdQumSWmqru0KdQIDAQABAoIBABPIjNaB9psIVV0Q
|
8
|
+
rbhJn3/9jlX2NzRX4Z3lhGV9znpMet96ZXavXwL5hrY4mAAG6NqPkS3L2Guw7h3Q
|
9
|
+
vduQzZYQAKwLplXuqg9kzNFP9D/d6zEzvRTUlK0HoB9QK50J45zmvoCVZIMWqd2/
|
10
|
+
PTh5ZjR5I65c83rPe86AHS11Y61edr+vvGtI07kvj7EzR3jie0Lzzpj7TbmjTt5U
|
11
|
+
v9rskcxjulQOmp8t/3ouptUhi16PRXPof0yzRGo6rrCUoQ7Cuy1dbFZ96dIBxrt4
|
12
|
+
h9suE6MtpXdsGfI5FZPOKHqUcw8hZfUgeOYm4OTV3vBYie0xJ77i9YgqR+UwymjA
|
13
|
+
NK4AOY0CgYEA553JtUvl8py76HjL3DxfbU38Dq22AF9sdUAs9Xwy9B8Y6R9SyrPI
|
14
|
+
nab+3EE0gz5NnFLFCILK4A7ewe3OB3bE7/P4mc7JlUWM2LAcBz7K50seIKD3r+cj
|
15
|
+
VzLHarOBi/VZ0pe1lDj/cuQ6cXTLHbKtk2XGCRnCBMJlog4ruFMYJ+sCgYEAzpRD
|
16
|
+
3YtuQcT0rtvK05BcdWD3nGgsrAauLvKz80LIu4zX9nfz/H6lNRpZYJ2jrLR1ikbX
|
17
|
+
XVWIsNlWizAuWEbGokUEYDTuhkh3591nrdPyB6/0Lm2Snl+q7mKIUFrZ08MXe7U8
|
18
|
+
Z/qPq2VLVSzCyoGX0l4GuNymgDH6NVR/i5yQXx8CgYBNJ1OUz+aWbb1ukCagg3/q
|
19
|
+
QksPfLAe6aqQWENhtvCmP2Gl7mg+26qdUY6eQh5DBdMGms/FqQP5pRpxEU1LUTYD
|
20
|
+
FIsgeTDPR67GU8vSYglnCK/NgLFhaCZumpyxH4Cs5Zr5Os4ixOXbGMmbF6O9jdKi
|
21
|
+
Qgm46FqoCTWfyQapTQzD5wKBgGQV4WuNCjZDPmkZhANMhf84o77bmgkek3WbkSPi
|
22
|
+
z25OprN7GnLSySgZRARTW+Fo7Sm5eM53impkYlG9XjbW05X66kvSWV4l7jIgSwMl
|
23
|
+
FLY0wZFc9RRWNXKZuoF0AuVeOBpvjHy0ILdhtEXoEdgbQXtios8d2G1zyU3dSo5R
|
24
|
+
pIDxAoGBAIlXeI9tB0X9ywXKylI3CyHi8ex/k6o4WTj/5fH4bYp4faHBRm78Ho81
|
25
|
+
Ih9rewMw7fMC3YUN3rcyvHRQqbJ2Wcxpyf0k45GMxTRasoVXCXgV/sMNCHh/ddZM
|
26
|
+
Gf5ZTeq10gJPofBlPObg5VrlCLRnIFaNI4izpq2A+/FqTrEvSGlf
|
27
27
|
-----END RSA PRIVATE KEY-----
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: tttls1.3
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.2.
|
4
|
+
version: 0.2.14
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- thekuwayama
|
8
|
-
autorequire:
|
8
|
+
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2020-
|
11
|
+
date: 2020-07-16 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: bundler
|
@@ -59,7 +59,7 @@ executables: []
|
|
59
59
|
extensions: []
|
60
60
|
extra_rdoc_files: []
|
61
61
|
files:
|
62
|
-
- ".github/workflows/
|
62
|
+
- ".github/workflows/ci.yml"
|
63
63
|
- ".gitignore"
|
64
64
|
- ".rspec"
|
65
65
|
- ".rubocop.yml"
|
@@ -179,7 +179,7 @@ homepage: https://github.com/thekuwayama/tttls1.3
|
|
179
179
|
licenses:
|
180
180
|
- MIT
|
181
181
|
metadata: {}
|
182
|
-
post_install_message:
|
182
|
+
post_install_message:
|
183
183
|
rdoc_options: []
|
184
184
|
require_paths:
|
185
185
|
- lib
|
@@ -194,8 +194,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
194
194
|
- !ruby/object:Gem::Version
|
195
195
|
version: '0'
|
196
196
|
requirements: []
|
197
|
-
rubygems_version: 3.
|
198
|
-
signing_key:
|
197
|
+
rubygems_version: 3.1.2
|
198
|
+
signing_key:
|
199
199
|
specification_version: 4
|
200
200
|
summary: TLS 1.3 implementation in Ruby (Tiny Trial TLS1.3 aka tttls1.3)
|
201
201
|
test_files:
|