tarantool / go-tlsdialer / 31128422767
13%

DEFAULT BRANCH: master
Ran
Jobs 1
Files 7
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 13.435%. Remained the same
31128422767

push

github

bigbes 
docs: document the cipher suites the gostls backend supports

The pure-Go backend, unlike the OpenSSL one, has a fixed suite set, so it can
be enumerated. Replace the prose description in the Backends section with a
Cipher suites section listing all 32 registered TLS 1.2 suites, split by what
the tarantoolee suite actually verifies against Tarantool Enterprise:

- 18 AES suites (ECDHE-ECDSA / ECDHE-RSA / plain RSA, GCM and CBC) and the 4
  GOST suites are verified, mutual TLS included;
- the 6 DHE-RSA suites are registered but unnegotiable with Tarantool;
- the 3 ChaCha20-Poly1305 suites are implemented but outside the interop
  matrix, and IANA-GOST2012-GOST8912-GOST8912 is the assigned code point for
  a suite already listed.

The list only makes sense next to the server side, so point at Tarantool's own
ssl_ciphers listener parameter, which takes the same OpenSSL cipher-list
syntax; note that SslCiphers uses that syntax too and that an unknown name is
an error.

Give the DHE-RSA gap its own subsection, since the backend implements those
suites and it is the server that refuses them. Tarantool's URI parameters have
no ssl_dh_params, so the server falls back on OpenSSL's built-in DH parameters;
OpenSSL 3.0 rejects those at SECLEVEL=2 and OpenSSL 3.2 drops DHE from the
default cipher list. Appending @SECLEVEL=0 to the server's ssl_ciphers - the
only opt-out Tarantool accepts - still fails the handshake, so there is no
workaround on either side.

79 of 588 relevant lines covered (13.44%)

2.8 hits per line

Jobs
ID Job ID Ran Files Coverage
1 31128422767.1 7
13.44
 GitHub Action Run
Source Files on build 31128422767