Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

dhtproxy: add server two-ways tls #432

Open
wants to merge 3 commits into
base: master
Choose a base branch
from

Conversation

binarytrails
Copy link
Contributor

@binarytrails binarytrails commented Sep 5, 2019

  • run:
    tools/dhtnode --proxyserverssl 8080 --proxy-certificate ca.pem --proxy-privkey key.priv --proxy-privkey-password x --proxy-client-certificate client-certificates.pem -v

  • in memory:
    image
    It is possible to add in memory client certificates to the certificate authority store however, the fuction allowing it add_certificate_authority only takes one at time thus, if this is the way taken instead of using an external file containing many added with load_verify_file done at 92766f7, one should perhaps change the design to load other client certs dynamically or load many of them at run time with multiple args following --proxy-client-certificates.

@binarytrails binarytrails changed the title WIP dhtproxy: add two-ways tls & expose verify cb in api WIP dhtproxy: add two-ways tls & expose verify cb Sep 5, 2019
@binarytrails binarytrails force-pushed the proxy_two-ways-tls branch 4 times, most recently from 942dfe4 to 846ebf1 Compare September 22, 2019 18:28
@binarytrails binarytrails changed the title WIP dhtproxy: add two-ways tls & expose verify cb dhtproxy: add two-ways tls in server Sep 22, 2019
@binarytrails binarytrails changed the title dhtproxy: add two-ways tls in server dhtproxy: add server two-ways tls Sep 22, 2019
@@ -74,7 +74,7 @@ class OPENDHT_PUBLIC DhtProxyServer
DhtProxyServer(
dht::crypto::Identity identity,
std::shared_ptr<DhtRunner> dht, in_port_t port = 8000, const std::string& pushServer = "",
std::shared_ptr<dht::Logger> logger = {});
const std::string& client_certificate = "", std::shared_ptr<dht::Logger> logger = {});
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should be able to provide in-memory certificate (from shared_ptrcrypto::Certificate)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@aberaud we could use the in-memory feature to add a client certificate to the ssl strore [1] however, this would require design changes to update them dynamically on the server instance. An interesting thread explaining the underlying issue is here [2] and the solution to update them dynamically would be at [1]. To recall this feature is to be able to validate multiple clients with their certificates at the store.
[1] http://think-async.com/Asio/asio-1.12.2/doc/asio/reference/ssl__context/add_certificate_authority/overload2.html
[2] http://boost.2283326.n4.nabble.com/ASIO-ssl-load-verify-file-td2577261.html

@aberaud aberaud force-pushed the master branch 12 times, most recently from 966e620 to fe6676f Compare April 4, 2022 00:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants