#moontls

// A client: put what the socket gives into `receive`, send what `take` gives.
let config = @tls.Client::new(@roots.mozilla(), alpn=["h2", "http/1.1"])
let conn = @tls.Conn::client(config, "example.com", rand~, now~)
socket.write(conn.take())                     // the ClientHello
while !conn.is_connected() {
  conn.receive(socket.read()[:])
  socket.write(conn.take())
}
conn.alpn()                                   // Some("h2")
conn.write(request[:])

// A server: the same three calls. The key is any PEM file `openssl` writes.
let chain = @x509.pems(cert_pem)                              // leaf first
let config = @tls.Server::new(chain, @x509.PrivateKey::pem(key_pem), alpn=["h2"])
let server = @tls.Conn::server(config, rand~)

test {
  let early = @keys.early()                       // no PSK: the zero secret
  let shared = b"\x8b\xd4\x05\x4f\xb5\x5b\x9d\x63\xfd\xfb\xac\xf9\xf0\x4b\x9f\x0d\x35\xe6\xd6\x3f\x53\x75\x63\xef\xd4\x62\x72\x90\x0f\x89\x49\x2d"
  let handshake = @keys.handshake(early[:], shared[:])   // salted by the key exchange
  let transcript = @keys.Transcript::new()
  transcript.add(b"\x01\x00\x00\x00"[:])              // a ClientHello, for the shape of it
  let secret = @keys.client_handshake(handshake[:], transcript.hash()[:])
  assert_eq(
    @base16.encode(secret[:]),
    "ab4fc9e2370723165814c074381ab62cbb2c32fd421b15db6910f5df5b1756a3",
  )
}

test {
  let suite = @record.Aes128Gcm
  let secret = @base16.decode("ab4fc9e2370723165814c074381ab62cbb2c32fd421b15db6910f5df5b1756a3")
  let writer = @record.Cipher::new(secret[:], suite~)
  let record = writer.seal(@record.Handshake, b"hello"[:])
  assert_eq(@base16.encode(record[:]), "1703030016ea041db0127f9d1812962e71632919c00bfbe245872d")
  // The same secret on the other side opens it: the content type moved inside, and came back.
  let reader = @record.Cipher::new(secret[:], suite~)
  let (kind, content) = reader.open(record[:])
  assert_eq(kind, @record.Handshake)
  assert_eq(content, b"hello")
}

// A DTLS 1.3 client: datagrams in and out, and a clock you supply.
let conn = @dtls.Conn13::client(config, "example.com", rand~, now~, wall~)
socket.send(conn.take())
while !conn.is_connected() {
  conn.receive(socket.recv()[:], now~=monotonic_ms())
  socket.send(conn.take())
  if conn.deadline() is Some(due) && monotonic_ms() >= due {
    conn.tick(now~=monotonic_ms())
  }
}

#Packages

#The digest is a parameter

@keys.early()                  // SHA-256, the suite RFC 8446 §9.1 makes mandatory
@keys.early(digest=Sha384)     // 48 octets instead of 32, all the way down

#What is not here

#Verification

#Conformance

#Interop

• DTLS 1.3's version numbers. supported_versions named 1.3 as 0x0304, which is TLS 1.3's number; RFC 9147 §5.3 gives DTLS its own, 0xfefc. Any conforming datagram peer refused the handshake, and because this library was on both ends of every DTLS test it had, it never noticed. The same applies to 1.2 and below (0xfefd down to 0xfeff), to the frozen legacy_version field, and to legacy_session_id, which DTLS must leave empty and never echo.
• The handshake CertificateRequest's context. RFC 8446 §4.3.2 requires it to be empty in the handshake and non-empty after it; it was 32 random octets either way. BoringSSL refuses to parse the message; OpenSSL does not.
• DTLS 1.2's ServerHello version. It said 0x0303 over a datagram; RFC 6347 §4.2.1 says 0xfefd. pion's client refuses it, OpenSSL's does not.
• TLS 1.0 and 1.1 as the client. The RSA premaster secret repeated 0x0303 — the frozen legacy_version — where RFC 5246 §7.4.7.1 asks for the version the hello offered. OpenSSL reads a higher number there as a rollback attempt and substitutes a random secret, so the first protected record failed bad_record_mac. Both versions now complete, and tls/legacy_exchange_test.mbt holds the pair of cases that go red without the fix.
• record_size_limit on the client. A limit was enforced against every record, including the ones a peer sends before it has agreed to anything: OpenSSL's server, which never advertises one, kept sending its 16 KiB records and the connection ended with record_overflow. RFC 8449 §4 makes the limit part of a negotiation, and the check now binds only a peer that named a limit of its own. Unprotected records — a ServerHello carrying a post-quantum share is the one that does not fit — stay outside the limit, as the section says.

• DTLS 1.2's transcript. RFC 6347 §4.2.2 puts every handshake message under a twelve-octet header that numbers it, and the transcript — EMS's session hash, the certificate verify, every Finished — is taken over the message as it went on the wire. This library hashed the body under TLS's four-octet header, and because both ends read it that way the handshake completed with itself and never with anyone else. OpenSSL's keylog is what pinned it: its master secret for a handshake matches only when the message number, the fragment offset and the fragment length are part of what is hashed. Handshake::number12 is the transport saying so.
• DTLS 1.2's AEAD nonce. RFC 6347 §4.1.2.4 borrows RFC 5288's GCM suites unchanged, so the eight-octet nonce_explicit TLS 1.2 writes at the front of the body is there in a datagram too. This library read the record number off the header instead: AES-GCM records failed with bad_record_mac while ChaCha20-Poly1305, which has no explicit nonce (RFC 7905 §2), worked.
• The ClientHello that answers a HelloVerifyRequest. RFC 6347 §4.2.1 asks for the hello again with a cookie in it, and pion compares the octets either side of the cookie field, refusing a retry that moved anything else. The retry was rebuilt from the configuration, which drew a new random number and a new key share, so pion answered illegal_parameter. The entropy the first hello drew is now kept and replayed, and the second hello is the first one with a cookie in it.

#tlsfuzzer

#License