Blogs›Cloudflare›Inter-Process Communication for TLS Handling
Cloudflare has evolved its TLS handling architecture to support early adoption of TLS 1.3. This involved implementing a custom TLS 1.3 stack in Go (tls-tris) and using SCM_RIGHTS to pass established TCP connections from an nginx-based SSL termination layer to the Go process. This allows for selective TLS version handling and rapid iteration on new TLS versions without impacting the broader stack. The implementation details for Go and Rust are provided, showcasing the use of UNIX domain sockets and the successful completion of an audit by NCC Group. The codebase is developed in the open and aims to be upstreamed to the Go project.
11/29/2018
Introduced the use of SCM_RIGHTS (Send/Receive Control Message Rights) via UNIX domain sockets to enable inter-process communication for sharing established TCP connections. This allows a C process (nginx-ssl) to handle older TLS versions and pass TLS 1.3 connections to a Go process (go-ssl) for specialized handling. Provided code examples in Go and Rust for implementing this mechanism.
2/15/2017
This post details the development of a custom Go implementation of TLS 1.3 (tls-tris) built upon the standard library. It highlights the use of SCM_RIGHTS for inter-process communication to pass established TCP connections from an nginx SSL termination layer to the Go process, enabling selective TLS version handling and rapid iteration. The post also announces the completion of an audit by NCC Group, which found a small number of issues that were promptly fixed, and mentions the goal of upstreaming the patches to the Go project.