mesalock-linux/mesalink

MesaLink is a memory-protected and OpenSSL-acceptable TLS library. Since 2014, the
change has viewed a expansive impact and loss attributable to memory vulnerabilities in TLS
stacks; such because the depraved « Heartbleed » malicious program. MesaLink is born with the aim of
eradicating memory vulnerabilities in TLS stacks; and it is miles written in Rust, a
programming language that ensures memory security. This critically reduces
the assault surfaces; which further facilitates auditing and proscribing the
closing assault surfaces. MesaLink is unsuitable-platform and affords
OpenSSL-acceptable APIs. It works seamlessly in desktop, mobile, and IoT
devices. With the growth of the ecosystem, MesaLink would also be adopted in the
server ambiance in due direction.

To recover performance alongside with sturdy security ensures, MesaLink
follows the following principles-of-thumb for hybrid memory-protected architecture
designing proposed by the Rust SGX SDK
venture.

1. Unsafe parts must no longer taint protected parts, especially for public APIs
   and records constructions.
2. Unsafe parts wants to be as puny as imaginable and decoupled from protected
   parts.
3. Unsafe parts wants to be explicitly marked all the intention in which by deployment and nice looking to
   make stronger.

Feature highlights

• Memory security. MesaLink and its dependencies are written in
  Rust, a programming language that ensures
  memory security. This extremely reduces assault surfaces of an TLS stack exposed
  in the wild, leaving the closing assault surfaces auditable and restricted.
• Flexibility. MesaLink gives flexible configurations tailored to varied
  wants, as an illustration IoT, connected residence, vehicles, the cloud and extra.
• Simplicity. MesaLink would no longer increase obselete or legacy TLS aspects, in
  case that misconfigurations introduce vulnerabilities.
• Compatibility. MesaLink affords OpenSSL-acceptable APIs. This makes it a
  creep to port an existing OpenSSL venture.
• Future proof. MesaLink will increase quantum-protected ciphersuites,
  protected-guarding TLS connections in opposition to even quantum computers.

MesaLink depends on two Rust crates: rustls and
sct. With them, MesaLink affords the following
aspects which shall be regarded as real for many consume cases:

• TLS 1.2 and TLS 1.three draft 22
• ALPN and SNI increase
• Compelled hostname validation
• Trustworthy and snappy crypto implementations from Google’s BoringSSL
• ECDHE key alternate with forward secrecy
• AES-256-GCM and Chacha20-Poly1305 bulk encryption
• Built-in Mozilla’s CA root certificates

Constructing the MesaLink library from supply

MesaLink is on the 2d greatest on hand on Linux, Android and macOS. We are in a position to
introduce increase for assorted platforms in future releases.

To assemble MesaLink from supply, the following instruments are wanted:

• m4
• autoconf
• automake
• libtool
• curl
• murder
• gcc
• rustc
• cargo

On Ubuntu, it’s good to perchance well perchance moreover set up them with:

$ sudo factual-collect set up m4 autoconf automake libtool murder gcc curl
$ curl https://sh.rustup.rs -sSf | sh

On assorted platforms, please consume the corresponding kit managing software program to
set up them earlier than persevering with. Level to that MesaLink repeatedly targets the
recent stable and nightly liberate of Rust. We assemble no longer guarantee backward
compatibility with older releases.

The availability code will also be downloaded from Github:

$ git clone https://github.com/mesalock-linux/mesalink.git

To configure MesaLink, assemble the following:

$ ./autogen.sh [OPTIONS]

By default, autogen.sh generates the configure script and runs it with the
default configuration. A non-exhaustive checklist of alternate suggestions that can also be passed to
either of those scripts are shown as follows:

  --prefix=PREFIX         set up architecture-autonomous recordsdata in PREFIX
                          [/usr/local]
  --includedir=DIR        C header recordsdata [PREFIX/include]
  --assemble=BUILD           configure for building on BUILD [guessed]
  --host=HOST             unsuitable-collect to assemble programs to plod on HOST [BUILD]
  --enable-debug          Add debug code/turns off optimizations (certain|no)
                          [default=no]
  --enable-rusthost       Location the Rust host for unsuitable compilation (default:
                          disabled)
  --enable-client         Enable TLS client-aspect APIs (default: enabled)
  --enable-server         Enable TLS server-aspect APIs (default: enabled)
  --enable-errorstrings   Enable error string table (default: enabled)
  --enable-aesgcm         Enable AES-GCM bulk encryption (default: enabled)
  --enable-chachapoly     Enable Chacha20Poly1305 bulk encryption (default:
                          enabled)
  --enable-tls13          Enable TLS 1.three draft (default: enabled)
  --enable-x25519         Enable Curve25519 for key alternate (default:
                          enabled)
  --enable-ecdh           Enable curve secp256r1 and secp384r1 for key
                          alternate (default: enabled)
  --enable-ecdsa          Enable curve secp256r1 and secp384r1 for signature
                          verification (default: enabled)

At the end of the configuration, a configuration abstract is shown. As an illustration,

Configuration abstract for mesalink model Zero.1.Zero

   * Installation prefix:        /usr/native
   * Host:                       x86_64-apple-darwin17.4.Zero
   * Rust Host:
   * C Compiler:                 gcc
   * C Compiler seller:          clang
   * C Flags:                    -Os -ffunction-sections -fdata-sections  -Werror -Wno-pragmas -Wall -Wno-strict-aliasing -Wextra -Wunknown-pragmas --param=ssp-buffer-size=1 -Waddress -Warray-bounds -Wbad-feature-cast -Wchar-subscripts -Wcomment -Wfloat-equal -Wformat-security -Wformat=2 -Wmissing-field-initializers -Wmissing-noreturn -Wmissing-prototypes -Wnested-externs -Wpointer-arith -Wpointer-label -Wredundant-decls -Wshadow -Wshorten-Sixty 4-to-32 -Wsign-compare -Wstrict-overflow=1 -Wstrict-prototypes -Wswitch-enum -Wundef -Wunused -Wunused-result -Wunused-variable -Wwrite-strings -fwrapv
   * Debug enabled:              no

   Aspects
   * Logging and error strings:  certain
   * AES-GCM:                    certain
   * Chacha20-Poly1305:          certain
   * TLS 1.three (draft):            certain
   * X25519 key alternate:        certain
   * EC key alternate:            certain
   * RSA signature verification: certain
   * EC signature verification:  certain

Lastly, easy plod murder to gather the MesaLink library.

$ murder

Examples

MesaLink comes with two examples that expose a TLS client and a TLS
server. Both of them are positioned at examples/.

The client example connects to a a long way-off HTTPS server and prints the server’s
response.

$ ./examples/client/client api.ipify.org
[+] Negotiated ciphersuite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, enc_length=Sixteen, model=TLS1.2
[+] Sent 85 bytes

GET / HTTP/1.Zero
Host: api.ipify.org
Connection: end
Obtain-Encoding: identity

HTTP/1.1 200 OK
Server: Cowboy
Connection: end
Announce material-Form: text/unsightly
Vary: Origin
Date: Thu, 15 Feb 2018 23:58:39 GMT
Announce material-Length: 10
By potential of: 1.1 vegur

1.2.three.4
[+] TLS protocol model: TLS1.2
[+] Received 177 bytes

The server example comes with a pair of certificate and non-public key. The
certificate file is in the PEM layout and comprises a series of certificates from
the server’s certificate to the root CA certificate. The non-public key file
comprises a PKCS8-encoded non-public key in the PEM layout. Once the server is up
and working, start https://127.Zero.Zero.1:8443 and are looking ahead to to
look for the hello message.

$ ./examples/server/server
Utilization: ./examples/server/server   
$ cd examples/server/server
$ ./server 8443 certificates private_key
[+] Listening at Zero.Zero.Zero.Zero:8443
[+] Negotiated ciphersuite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, enc_length=Sixteen, model=TLS1.2
[+] Received:
GET / HTTP/1.1
Host: 127.Zero.Zero.1:8443
Connection: support-alive
User-Agent: Mozilla/5.Zero (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/537.36
(KHTML, adore Gecko) Chrome/63.Zero.3239.eighty 4 Safari/537.36
Upgrade-Taken aback-Requests: 1
Obtain: text/html,utility/xhtml+xml,utility/xml;q=Zero.9,image/webp,image/apng
Obtain-Encoding: gzip, deflate, br
Obtain-Language: en-US,en;q=Zero.9

Unit assessments

MesaLink uses cargo for unit assessments. The test cases are designed for the the
default configuration of MesaLink, wherein all of the no longer obligatory aspects are
enabled. So earlier than working the test cases, please rebuild MesaLink with the
default configuration:

$ ./configure
$ murder
$ cargo test

BoringSSL SSL assessments

BoGo is BoringSSL’s
protocol stage test suite. Now we admire got ported BoGo for trying out the performance and
compatibility of MesaLink. To plod BoGo test cases, plod the following:

$ cargo assemble --liberate --examples
$ (cd bogo && ./collect-and-assemble && ./runme)

Crypto benchmarks

MesaLink’s underlying crypto library is
Ring, a real and snappy crypto the usage of
Rust. To raise into consideration the speed and throughput of MesaLink, we developed new
benchmarks for OpenSSL and wolfSSL constant with the
crypto-bench venture. A abstract of
the on hand benchmarks is shown as follows:

To plod the benchmarks, plod the following uncover with nightly Rust. Level to you
must admire OpenSSL/LibreSSL or wolfSSL installed to plod the corresponding
benchmarks.

$ rustup set up nightly-2017-12-24
$ rustup default nightly-2017-12-24
$ cd crypto-bench && ./bench_all

Acknowledgments

The MesaLink venture attach no longer need been imaginable with out the following tremendous quality
start supply initiatives in the Rust crew. Thanks for code and inspiration!

• rustls: A recent TLS library in Rust, maintained by Joseph Birr-Pixton
  @ctz
• sct.rs: Certificate transparency SCT verification library in rust,
  maintained by Joseph Birr-Pixton @ctz
• ring: Trustworthy, snappy, puny crypto the usage of Rust, by Brian Smith
  @briansmith
• webpki: WebPKI X.509 Certificate Validation in Rust, maintained by Brian Smith
  @briansmith
• crypto-bench: Benchmarks for crypto libraries, maintained by Brian Smith
  @briansmith
• Special thanks to Brian Smith for insights and precious discussion

Maintainer

• Yiming Jing @kevinis

Steerage Committee

License

MesaLink is equipped below the three-Clause BSD license. For a reproduction, look for the LICENSE
file.