Sign in Join

Live chat for Free Pascal, Lazarus, Delphi and every Pascal programmer.

Catalog · How the catalog works

Random project

fafafa.ssl

Pascal SSL 包装

View on GitHub

Anyone may press Interesting, signed in or not. It helps others find this project.

Member rating

No ratings yet.

Sign in to rate this project.

README

fafafa.ssl - Multi-backend SSL/TLS Library for FreePascal

统一 SSL/TLS 加密库，为 FreePascal 提供多后端抽象实现。

后端支持

后端 平台 状态 优先级
OpenSSL Linux/macOS/Windows 生产就绪 100
MbedTLS 跨平台 生产就绪 175
WolfSSL 跨平台 生产就绪 150
WinSSL (Schannel) Windows 生产就绪 200
FreePascal (纯 Pascal) 跨平台 实验性 (TLS 1.3) 50

快速开始

pascal
program HelloTLS;
uses
  SysUtils, fafafa.ssl, fafafa.ssl.context.builder;
var
  Ctx: ISSLContext;
  Stream: TSSLStream;
begin
  Ctx := TSSLContextBuilder.Create
    .WithTLS12And13
    .WithVerifyPeer
    .WithSystemRoots
    .BuildClient;

  Stream := TSSLConnector.FromContext(Ctx)
    .ConnectSocket(YourSocket, 'example.com');
  try
    Stream.Write(Request[1], Length(Request));
  finally
    Stream.Free;
  end;
end.

编译

bash
fpc -Fu./src your_app.pas

核心 API

TSSLContextBuilder (推荐入口)

pascal
Ctx := TSSLContextBuilder.Create
  .WithTLS13                    // 协议版本
  .WithVerifyPeer               // 验证对端证书
  .WithSystemRoots              // 加载系统 CA
  .WithCertificate('cert.pem')  // 客户端/服务端证书
  .WithPrivateKey('key.pem')    // 私钥
  .WithSessionCache(True)       // 会话复用
  .BuildClient;                 // 或 .BuildServer

TSSLConnector / TSSLAcceptor (Rust 风格门面)

pascal
// 客户端
Stream := TSSLConnector.FromContext(Ctx)
  .WithTimeout(5000)
  .WithSessionReuse(True)
  .ConnectSocket(Socket, 'host.com');

// 服务端
Stream := TSSLAcceptor.FromContext(Ctx)
  .AcceptSocket(ClientSocket);

证书生成

pascal
uses fafafa.ssl.quick;

KeyPair := TSSLQuick.GenerateSelfSigned('localhost', 365);

PKCS#11 硬件安全模块

pascal
Ctx := TSSLContextBuilder.Create
  .UsePKCS11('pkcs11:token=MyToken;object=MyKey')
  .WithPKCS11PIN('1234')
  .BuildClient;

Context-safe factory 示例：

用 context-safe config/factory 时，可选这两个字段：

  • TSSLContextConfig.ServerEarlyDataReplayStoreFile
  • TSSLContextConfig.ServerEarlyDataReplayStoreDirectory

Legacy TSSLConfig 字段仍保留给 v1.x 兼容调用方，新代码推荐 TSSLContextConfig。

pascal
var
  LConfig: TSSLContextConfig;
begin
  LConfig := CreateDefaultContextConfig(sslCtxServer);
  LConfig.ServerEarlyDataReplayStoreFile := '/var/lib/myapp/replay.store';
  Ctx := TSSLFactory.CreateContext(LConfig);
end;

架构

pascal
src/                          198 ????????????, 136K ???
????????? fafafa.ssl.pas               ????????? (re-export ??????????????????)
????????? fafafa.ssl.base.pas          ???????????????????????????
????????? fafafa.ssl.context.builder   Fluent context builder
????????? fafafa.ssl.tls.pas           Connector/Acceptor/Stream ??????
????????? fafafa.ssl.factory.pas       ???????????????
????????? fafafa.ssl.openssl.*         OpenSSL ??????
????????? fafafa.ssl.mbedtls.*         MbedTLS ??????
????????? fafafa.ssl.wolfssl.*         WolfSSL ??????
????????? fafafa.ssl.winssl.*          WinSSL ??????
????????? fafafa.ssl.freepascal.*      ??? Pascal TLS 1.3 ??????
????????? fafafa.ssl.tls13.*           TLS 1.3 ????????????
????????? fafafa.ssl.pkcs11.*          PKCS#11 ??????
????????? fafafa.ssl.cert.*            ????????????
????????? fafafa.ssl.crypto.*          ????????????

构建与测试

bash
# 编译所有模块
python3 scripts/compile_all_modules.py

# 本地最小门禁
bash scripts/run_minimal_ci_gate.sh --fast-local

# P2 模块回归测试
bash scripts/run_all_module_tests.sh --fast-local --modules PKCS7,PKCS12,CMS,Store,OCSP,TS,CT

# 代码风格检查
python3 scripts/check_code_style.py src

# FreePascal TLS 1.3 完整性门禁
bash scripts/run_freepascal_tls13_completeness_gate.sh --fast-local

安全特性

  • TLS 1.2/1.3 协议支持，安全默认值
  • AES-256-GCM, ChaCha20-Poly1305, SHA-256/384/512
  • 恒定时间比较 (防时序攻击)
  • 安全内存擦除 (SecureZeroMemory)
  • 证书钉扎、OCSP Stapling、Certificate Transparency
  • DANE/DNSSEC 支持
  • 零拷贝 I/O (Lock-free ring buffer, Buffer pool)

性能优化

  • Lock-free SPSC ring buffer (cache-line padding, memory barriers)
  • 16-shard session cache (降低锁竞争)
  • 三级 buffer pool (4KB/16KB/64KB 预分配)
  • AES-GCM context pool (避免重复初始化)
  • 自动后端选择 (40+ 维度评分)

许可证

MIT License - 详见 LICENSE

文档

  • 默认导航：先看 docs/ROADMAP.md、docs/plans/2026-05-12-release-v1.5.0-formalization.md、docs/test_reports/RELEASE_READINESS_V1.5.0.md。
  • Wave C closeout / 审批参考：docs/test_reports/WAVE_C_CLOSEOUT_STATUS_2026-03-18.md、docs/test_reports/WAVE_C_LOCAL_FIRST_AND_PRE_CI_CHAIN_STATUS_2026-03-16.md。
  • 历史手册仅作参考：docs/test_reports/WAVE_C_B121_ONE_PAGE_RUNBOOK_2026-02-08.md、docs/test_reports/WAVE_C_B127_LOCAL_GUARD_TROUBLESHOOTING_2026-02-09.md。
  • 当前路线图
  • Release Plan
  • Release Readiness
  • 架构文档
  • 后端选择指南
  • 平台支持
  • 依赖说明