Implement Telnet STARTTLS Option

[myonara]

Description:
Implement support for the Telnet STARTTLS option to enable encrypted communication between the client and server using TLS (Transport Layer Security). STARTTLS initiates a secure TLS handshake over an existing Telnet connection, ensuring data confidentiality and integrity. This option is essential for protecting sensitive information and providing secure authentication in Telnet sessions.

Details:

1. Option Code: 46

2. Functionality:

   • The client requests encryption by sending IAC DO STARTTLS to the server.
   • If the server supports encryption, it responds with IAC WILL STARTTLS, confirming the STARTTLS request.
   • Following the negotiation, both sides initiate a TLS handshake to establish an encrypted session.
   • Once the handshake is complete, all further communication is encrypted.

3. Expected Workflow:

   • The client sends IAC DO STARTTLS to request TLS encryption.
   • Upon receiving IAC WILL STARTTLS from the server, the client initiates a TLS handshake.
   • Both client and server transition to encrypted communication upon successful completion of the handshake.

4. Acceptance Criteria:

   • The client successfully negotiates STARTTLS with the server.
   • TLS handshake completes without errors, establishing a secure channel.
   • All data following the handshake is encrypted.

References:

• Telnet STARTTLS Documentation (STARTTLS for Telnet is often based on general TLS handshake protocols)

[mystiker]

Regarding the STARTTLS option: This option is intended to negotiate an SSL/TLS connection after an unencrypted session has already been established. However, we have decided not to support this option. Instead, we require that the client initiates a TLS connection directly from the start, without negotiating encryption mid-session. This approach provides a more secure and straightforward connection setup, and it aligns better with our architecture.

To configure a direct TLS connection, we are using environment variables to control this setup, ensuring that all client connections are secured from the beginning.

[mystiker]

I tested it and it works out of the box with the current code base - no changes needed.

Issue can be closed as is.