Inter-Process Communication for TLS Handling

2 posts · Feb 2017 – Nov 2018

What this trail covers

Cloudflare's TLS handling architecture has evolved to support early adoption of TLS 1.3. This involved implementing a custom TLS 1.3 stack in Go (tls-tris) and using SCM_RIGHTS to pass established TCP connections from an nginx-based SSL termination layer to the Go process. This allows for selective TLS version handling and rapid iteration on new TLS versions without impacting the broader stack. The implementation details for Go and Rust are provided, showcasing the use of UNIX domain sockets and the SCM_RIGHTS mechanism for inter-process communication of file descriptors.

All Cloudflare trails

Nov 2018Know your SCM_RIGHTSThis post details the use of SCM_RIGHTS to pass established TCP connections between an nginx process (handling older TLS versions) and a Go process (handling TLS 1.3). It provides code examples in Go and Rust for setting up UNIX domain sockets and using SCM_RIGHTS to send and receive file descriptors, enabling two different processes to share the same TCP socket.
Feb 2017NCC Group's Cryptography Services audits our Go TLS 1.3 stackThis post details the development of a custom Go implementation of TLS 1.3 (tls-tris) built upon the standard library. It highlights the use of SCM_RIGHTS for inter-process communication to pass established TCP connections from an nginx SSL termination layer to the Go process, enabling selective TLS version handling and rapid iteration. The post also announces the completion of an audit by NCC Group, which found a small number of issues that were promptly fixed, and mentions the goal of upstreaming the patches to the Go project.
Advertisement