From dbba1d3f832c5bb0af8f3b87fa47f1590855c0f3 Mon Sep 17 00:00:00 2001 From: Josef Schlehofer Date: Sun, 9 Aug 2026 23:27:01 +0200 Subject: [PATCH] feat: report the negotiated TLS version and cipher under --debug On hardware without AES acceleration the cipher, not the link, is what bounds an HTTPS result, and the server chooses it. Two runs can differ several-fold for a reason the numbers alone do not show. Measured on a CZ.NIC Turris 1.x, whose e500v2 core has no crypto instructions: AES-256-GCM tops out around 150 Mbps while ChaCha20-Poly1305 reaches about 390 Mbps on the same core. A server that picks the first will look like a slow link next to one that picks the second. Print it once, from the backend check that already runs before every test. --- defs/server.go | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/defs/server.go b/defs/server.go index b5d195f..158d4c5 100644 --- a/defs/server.go +++ b/defs/server.go @@ -4,6 +4,7 @@ import ( "bytes" "context" "crypto/rand" + "crypto/tls" "encoding/json" "errors" "fmt" @@ -59,6 +60,21 @@ func (s *Server) IsUp() bool { return false } defer resp.Body.Close() + + // Report what the connection actually negotiated. On hardware without AES + // acceleration the cipher, not the link, is what bounds the result, and + // under TLS 1.3 the server picks it: the client offers a set and has no say + // in the choice, and Go does not allow that set to be configured at all. + // Two runs can therefore differ several-fold for a reason the numbers alone + // do not show, which is what this line is for. + if resp.TLS != nil { + output.WriteDebug("Negotiated %s with %s\n", + tls.VersionName(resp.TLS.Version), + tls.CipherSuiteName(resp.TLS.CipherSuite)) + } else { + output.WriteDebug("Connection is not encrypted\n") + } + b, err := io.ReadAll(resp.Body) if err != nil || len(b) > 0 { output.WriteDebug("Failed when parsing get IP result: %s\n", b)