feat: report the negotiated TLS version and cipher under --debug - #127
Open
BKPepe wants to merge 1 commit into
Open
feat: report the negotiated TLS version and cipher under --debug#127BKPepe wants to merge 1 commit into
BKPepe wants to merge 1 commit into
Conversation
On hardware without AES acceleration the cipher, not the link, is what bounds an HTTPS result, and the server chooses it. Two runs can differ several-fold for a reason the numbers alone do not show. Measured on a CZ.NIC Turris 1.x, whose e500v2 core has no crypto instructions: AES-256-GCM tops out around 150 Mbps while ChaCha20-Poly1305 reaches about 390 Mbps on the same core. A server that picks the first will look like a slow link next to one that picks the second. Print it once, from the backend check that already runs before every test.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On hardware without AES acceleration the cipher, not the link, bounds an
HTTPS result — and under TLS 1.3 the server picks it. The client offers a
set and has no say in the choice, and Go does not allow that set to be
configured at all (
CipherSuitescovers TLS 1.0–1.2 only). Two runs canthen differ several-fold for a reason the numbers do not show.
Measured on a CZ.NIC Turris 1.x, whose e500v2 core has no crypto
instructions:
Same core, same link. A server that picks the first looks like a slow link
next to one that picks the second, and nothing in the report says which
happened.
Printed once, from the backend check that already runs before every test.
Nothing changes without
--debug, and the JSON and CSV schemas areuntouched.