#moontls

// A client: put what the socket gives into `receive`, send what `take` gives.
let config = @tls.Client::new(@roots.mozilla(), alpn=["h2", "http/1.1"])
let conn = @tls.Conn::client(config, "example.com", rand~, now~)
socket.write(conn.take())                     // the ClientHello
while !conn.is_connected() {
  conn.receive(socket.read()[:])
  socket.write(conn.take())
}
conn.alpn()                                   // Some("h2")
conn.write(request[:])

// A server: the same three calls. The key is any PEM file `openssl` writes.
let chain = @x509.pems(cert_pem)                              // leaf first
let config = @tls.Server::new(chain, @x509.PrivateKey::pem(key_pem), alpn=["h2"])
let server = @tls.Conn::server(config, rand~)

test {
  let early = @keys.early()                       // no PSK: the zero secret
  let shared = b"\x8b\xd4\x05\x4f\xb5\x5b\x9d\x63\xfd\xfb\xac\xf9\xf0\x4b\x9f\x0d\x35\xe6\xd6\x3f\x53\x75\x63\xef\xd4\x62\x72\x90\x0f\x89\x49\x2d"
  let handshake = @keys.handshake(early[:], shared[:])   // salted by the key exchange
  let transcript = @keys.Transcript::new()
  transcript.add(b"\x01\x00\x00\x00"[:])              // a ClientHello, for the shape of it
  let secret = @keys.client_handshake(handshake[:], transcript.hash()[:])
  assert_eq(
    @base16.encode(secret[:]),
    "ab4fc9e2370723165814c074381ab62cbb2c32fd421b15db6910f5df5b1756a3",
  )
}

test {
  let suite = @record.Aes128Gcm
  let secret = @base16.decode("ab4fc9e2370723165814c074381ab62cbb2c32fd421b15db6910f5df5b1756a3")
  let writer = @record.Cipher::new(secret[:], suite~)
  let record = writer.seal(@record.Handshake, b"hello"[:])
  assert_eq(@base16.encode(record[:]), "1703030016ea041db0127f9d1812962e71632919c00bfbe245872d")
  // The same secret on the other side opens it: the content type moved inside, and came back.
  let reader = @record.Cipher::new(secret[:], suite~)
  let (kind, content) = reader.open(record[:])
  assert_eq(kind, @record.Handshake)
  assert_eq(content, b"hello")
}

// A DTLS 1.3 client: datagrams in and out, and a clock you supply.
let conn = @dtls.Conn13::client(config, "example.com", rand~, now~, wall~)
socket.send(conn.take())
while !conn.is_connected() {
  conn.receive(socket.recv()[:], now~=monotonic_ms())
  socket.send(conn.take())
  if conn.deadline() is Some(due) && monotonic_ms() >= due {
    conn.tick(now~=monotonic_ms())
  }
}

#Packages

#The digest is a parameter

@keys.early()                  // SHA-256, the suite RFC 8446 §9.1 makes mandatory
@keys.early(digest=Sha384)     // 48 octets instead of 32, all the way down

#What is not here

#Verification

#Conformance

#Interop

• DTLS 1.3's version numbers. supported_versions named 1.3 as 0x0304, which is TLS 1.3's number; RFC 9147 §5.3 gives DTLS its own, 0xfefc. Any conforming datagram peer refused the handshake, and because this library was on both ends of every DTLS test it had, it never noticed. The same applies to 1.2 and below (0xfefd down to 0xfeff), to the frozen legacy_version field, and to legacy_session_id, which DTLS must leave empty and never echo.
• The handshake CertificateRequest's context. RFC 8446 §4.3.2 requires it to be empty in the handshake and non-empty after it; it was 32 random octets either way. BoringSSL refuses to parse the message; OpenSSL does not.
• DTLS 1.2's ServerHello version. It said 0x0303 over a datagram; RFC 6347 §4.2.1 says 0xfefd. pion's client refuses it, OpenSSL's does not.

#tlsfuzzer

#License