igopher-tls.txt - gopher-tutorials - The gopher tutorials project. Err bitreich.org 70 hgit clone git://bitreich.org/gopher-tutorials/ git://enlrupgkhuxnvlhsf6lc3fziv5h2hhfrinws65d7roiv6bfj7d652fid.onion/gopher-tutorials/ URL:git://bitreich.org/gopher-tutorials/ git://enlrupgkhuxnvlhsf6lc3fziv5h2hhfrinws65d7roiv6bfj7d652fid.onion/gopher-tutorials/ bitreich.org 70 1Log /scm/gopher-tutorials/log.gph bitreich.org 70 1Files /scm/gopher-tutorials/files.gph bitreich.org 70 1Refs /scm/gopher-tutorials/refs.gph bitreich.org 70 1Tags /scm/gopher-tutorials/tag bitreich.org 70 i--- Err bitreich.org 70 igopher-tls.txt (3182B) Err bitreich.org 70 i--- Err bitreich.org 70 i 1 Adding TLS to Gopher Err bitreich.org 70 i 2 ==================== Err bitreich.org 70 i 3 The changes are minimal, do not break compatibility, and the support Err bitreich.org 70 i 4 for clients like hurl, curl or servers like geomyidae is already there. Err bitreich.org 70 i 5 Err bitreich.org 70 i 6 Context and challenge Err bitreich.org 70 i 7 --------------------- Err bitreich.org 70 i 8 Traditionnal clients use port 70 without encryption, for which we want Err bitreich.org 70 i 9 compatibility. Err bitreich.org 70 i 10 Err bitreich.org 70 i 11 The gophermap syntax, with gopher links, write down only one port Err bitreich.org 70 i 12 (usually 70), so bringing Gopher+TLS on a different port would require Err bitreich.org 70 i 13 changing the gophermap standard for everyone, and breaking compatibility, Err bitreich.org 70 i 14 and also asking everyone to change their content. Err bitreich.org 70 i 15 Err bitreich.org 70 i 16 The best compromise would be using port 70 for both plaintext and Err bitreich.org 70 i 17 encrypted gopher to preserve gophermaps, with no change for the plaintext Err bitreich.org 70 i 18 version to keep compatibility. Err bitreich.org 70 i 19 Err bitreich.org 70 i 20 It happen to be possible and not difficult to implement using only Err bitreich.org 70 i 21 standard (POSIX.1) features. Err bitreich.org 70 i 22 Err bitreich.org 70 i 23 If the client use raw TCP, the server communicate in raw TCP. Err bitreich.org 70 i 24 Err bitreich.org 70 i 25 If the client uses TLS, the server communicates in TLS right away. Err bitreich.org 70 i 26 Err bitreich.org 70 i 27 Without TLS Err bitreich.org 70 i 28 ----------- Err bitreich.org 70 i 29 [ Client open TCP to Server on port :70 ] Err bitreich.org 70 i 30 C: /page\r\n Err bitreich.org 70 i 31 S: Hello world! Err bitreich.org 70 i 32 Err bitreich.org 70 i 33 The client sends usual selector directly over TCP, in which case the Err bitreich.org 70 i 34 content is served over plain TCP (non-encrypted). Err bitreich.org 70 i 35 Err bitreich.org 70 i 36 With TLS Err bitreich.org 70 i 37 -------- Err bitreich.org 70 i 38 [ Client opens TCP to Server on port :70 ] Err bitreich.org 70 i 39 [ Client negotiate TLS with server ] Err bitreich.org 70 i 40 C: /page\r\n Err bitreich.org 70 i 41 S: Hello world! Err bitreich.org 70 i 42 Err bitreich.org 70 i 43 The client open TLS on the port 70. The server notices that the Err bitreich.org 70 i 44 first byte is 0x16, as always in TLS, and pursue with negotiation. Err bitreich.org 70 i 45 Err bitreich.org 70 i 46 How to implement Err bitreich.org 70 i 47 ---------------- Err bitreich.org 70 i 48 The only thing needed for negotiation is reading the first byte and check Err bitreich.org 70 i 49 if it is 0x16. Err bitreich.org 70 i 50 Err bitreich.org 70 i 51 In order to read without messing up the data stream from the client, Err bitreich.org 70 i 52 POSIX provides at least two ways to peek at the data without shifting Err bitreich.org 70 i 53 the read position, such as pread(2) and recv(2). Err bitreich.org 70 i 54 Err bitreich.org 70 i 55 Using recv(2): Err bitreich.org 70 i 56 Err bitreich.org 70 i 57 if (recv(sockfd, buf, 1, MSG_PEEK) < 1) Err bitreich.org 70 i 58 err("could not peek at first byte"); Err bitreich.org 70 i 59 if (buf[0] == 0x16) Err bitreich.org 70 i 60 istls = 1; Err bitreich.org 70 i 61 Err bitreich.org 70 i 62 > The MSG_PEEK flag causes the receive operation to return data from the Err bitreich.org 70 i 63 > beginning of the receive queue without removing that data from the queue. Err bitreich.org 70 i 64 > Thus, a subsequent receive call will return the same data. -- recv(2) Err bitreich.org 70 i 65 Err bitreich.org 70 i 66 [7|man page search:|/man.dcgi|perso.pw|70] Err bitreich.org 70 i 67 Err bitreich.org 70 i 68 Then we can pursue with plain TCP or with TLS right away without Err bitreich.org 70 i 69 negtciating anything nor breaking existing clients that only handle TCP. Err bitreich.org 70 i 70 Graceful fallback does not change anything for the client. Err bitreich.org 70 i 71 Err bitreich.org 70 i 72 Known implementations Err bitreich.org 70 i 73 --------------------- Err bitreich.org 70 i 74 Here are not listed generic tools that can add a layer of TLS encryption Err bitreich.org 70 i 75 which can also work for Gopher. Err bitreich.org 70 i 76 Err bitreich.org 70 i 77 ### Geomyidae (server) Err bitreich.org 70 i 78 Err bitreich.org 70 i 79 [1|project home page|/scm/geomyidae/files.gph|bitreich.org|70] Err bitreich.org 70 i 80 [1|commit 07240d76|/scm/geomyidae/commit/07240d76fd8e1d0a67c49bf7e123bb508613e691.gph|server|port] Err bitreich.org 70 i 81 Err bitreich.org 70 i 82 ### Hurl (client) Err bitreich.org 70 i 83 Err bitreich.org 70 i 84 Use gophers:// to explicitely use gopher on top of TLS. Err bitreich.org 70 i 85 Err bitreich.org 70 i 86 [1|project home page|/git/hurl/files.gph|git.codemadness.org|70] Err bitreich.org 70 i 87 [1|commit 9546c0f1|/git/hurl/commit/9546c0f17665658befbc25876245acaa9db4b08f.gph|git.codemadness.org|70] Err bitreich.org 70 i 88 Err bitreich.org 70 i 89 ### Curl (client) Err bitreich.org 70 i 90 Err bitreich.org 70 i 91 Use gophers:// to explicitely use gopher on top of TLS. Err bitreich.org 70 i 92 Err bitreich.org 70 i 93 [h|project home page|URL:https://curl.haxx.se/||] Err bitreich.org 70 i 94 [h|commit a1f06f32|URL:https://github.com/curl/curl/commit/a1f06f32b8603427535fc21183a84ce92a9b96f7||] Err bitreich.org 70 .