tttls1.3 0.2.1 → 0.2.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 98d9d2196c5b71c0bef8d7abb8838afb1c6d6bc42cdf5b09f24402591cb259ce
-  data.tar.gz: 7fa9dbb492a6a1b8b1b4040b212c8678aaa1fa384da421faa550bb64891908c1
+  metadata.gz: 356ce310f2323bede1cdfd21f6c18050d2ce9aca6da4c8ed67b439b597c92ba0
+  data.tar.gz: d1bcb99ae830df4c8c40688d85e5c7efcda76e0c608ef0707b5201862a5baff8
 SHA512:
-  metadata.gz: ee9f193f6d30c8248cebe79a34c949dbbd39529eb5df949dfd02e6fb164c474334d6767b3d2c9ce99794fb04368744ccb24063e92ca078bdf45e64f05004ec70
-  data.tar.gz: 974e0c1bfd02a73fa38ce1e46fb22032e68d43c8823692b1f0b79e6c3f417e4cf94206e9d865ef3aea7ece3c8d4268e235248c88f664264cf2e83a2df8963ecc
+  metadata.gz: ae23baf431d2908aceae8e411deb2b8ebf33f8696e67602081c3f07b2d9dad523f8a21a251d5333243e2f44405e8efa0e6595e0af7a744c9fda05c026a824346
+  data.tar.gz: '0978b73204cc49a3fac033904c98c17eb05f45a2793a5f326298414db09599d065ab599ce34e4cc73bbd928abed9cb988a35ef7248ec9af1ff8a121f6378da61'

data/README.md

@@ -67,6 +67,7 @@ tttls1.3 provides client API with the following features:
 tttls1.3 provides server API with the following features:
 
 * Simple 1-RTT Handshake
+* HelloRetryRequest
 
 **NOT supports** certificate with OID RSASSA-PSS, X25519, X448, FFDHE, AES-CCM, Client Authentication, Post-Handshake Authentication, KeyUpdate, external PSKs.
 

data/Rakefile

@@ -17,7 +17,7 @@ directory TMP_DIR
 
 file CA_KEY => TMP_DIR do
   puts "generate #{CA_KEY}..."
-  ca_key = OpenSSL::PKey::RSA.generate(4096)
+  ca_key = OpenSSL::PKey::RSA.generate(2048)
   File.write(CA_KEY, ca_key.to_pem)
 end
 
@@ -32,7 +32,7 @@ file CA_CRT => [TMP_DIR, CA_KEY] do
   ca_crt.not_before = Time.now
   ca_crt.not_after = Time.now + (60 * 60 * 24 * 365 * 10)
   ca_crt.public_key = ca_key.public_key
-  ca_crt.serial = 1
+  ca_crt.serial = OpenSSL::BN.rand(64)
   ca_crt.version = 2
   ca_crt.issuer = issu
   ca_crt.subject = sub
@@ -83,7 +83,7 @@ file SERVER_CRT => [TMP_DIR, CA_CRT, SERVER_KEY] do
   server_crt.not_before = Time.now
   server_crt.not_after = Time.now + (60 * 60 * 24 * 365)
   server_crt.public_key = server_key.public_key
-  server_crt.serial = 2
+  server_crt.serial = OpenSSL::BN.rand(64)
   server_crt.version = 2
   server_crt.issuer = ca_crt.issuer
   server_crt.subject = sub

data/example/https_client_using_hrr_and_ticket.rb

@@ -0,0 +1,40 @@
+# encoding: ascii-8bit
+# frozen_string_literal: true
+
+require_relative 'helper'
+
+hostname, port = (ARGV[0] || 'localhost:4433').split(':')
+req = simple_http_request(hostname)
+
+settings_2nd = {
+  ca_file: __dir__ + '/../tmp/ca.crt'
+}
+process_new_session_ticket = proc do |nst, rms, cs|
+  return if Time.now.to_i - nst.timestamp > nst.ticket_lifetime
+
+  settings_2nd[:key_share_groups] = [] # empty KeyShareClientHello.client_shares
+  settings_2nd[:ticket] = nst.ticket
+  settings_2nd[:resumption_master_secret] = rms
+  settings_2nd[:psk_cipher_suite] = cs
+  settings_2nd[:ticket_nonce] = nst.ticket_nonce
+  settings_2nd[:ticket_age_add] = nst.ticket_age_add
+  settings_2nd[:ticket_timestamp] = nst.timestamp
+end
+settings_1st = {
+  ca_file: __dir__ + '/../tmp/ca.crt',
+  process_new_session_ticket: process_new_session_ticket
+}
+
+[
+  # Initial Handshake:
+  settings_1st,
+  # Subsequent Handshake:
+  settings_2nd
+].each do |settings|
+  socket = TCPSocket.new(hostname, port)
+  client = TTTLS13::Client.new(socket, hostname, settings)
+  client.connect
+  client.write(req)
+  print recv_http_response(client)
+  client.close
+end

data/interop/client_spec.rb

@@ -118,6 +118,14 @@ RSpec.describe Client do
       signature_algorithms_cert: [SignatureScheme::RSA_PKCS1_SHA256],
       signature_algorithms: [SignatureScheme::ECDSA_SECP521R1_SHA512]
     ],
+    [
+      true,
+      '-sigalgs RSA-PSS+SHA256',
+      'rsa_rsassaPss.crt',
+      'rsa_rsassaPss.key',
+      signature_algorithms_cert: [SignatureScheme::RSA_PSS_RSAE_SHA256],
+      signature_algorithms: [SignatureScheme::RSA_PSS_RSAE_SHA256]
+    ],
     [
       false,
       '-sigalgs ECDSA+SHA256:ECDSA+SHA384:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256',
@@ -132,6 +140,13 @@ RSpec.describe Client do
       'rsa_rsa.crt',
       'rsa_rsa.key',
       {}
+    ],
+    [
+      true,
+      '',
+      'rsa_rsa.crt',
+      'rsa_rsa.key',
+      key_share_groups: []
     ]
     # rubocop: enable Metrics/LineLength
   ].each do |normal, opt, crt, key, settings|

data/interop/server_spec.rb

@@ -119,6 +119,14 @@ RSpec.describe Server do
       signature_algorithms_cert: [SignatureScheme::RSA_PKCS1_SHA256],
       signature_algorithms: [SignatureScheme::ECDSA_SECP521R1_SHA512]
     ],
+    [
+      true,
+      '-groups P-256:P-384:P-521 -sigalgs RSA-PSS+SHA256',
+      FIXTURES_DIR + '/rsa_rsassaPss.crt',
+      FIXTURES_DIR + '/rsa_rsassaPss.key',
+      signature_algorithms_cert: [SignatureScheme::RSA_PSS_RSAE_SHA256],
+      signature_algorithms: [SignatureScheme::RSA_PSS_RSAE_SHA256]
+    ],
     [
       false,
       '-groups P-256:P-384:P-521 -sigalgs ECDSA+SHA256:ECDSA+SHA384:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256',