Closed 8573 closed 4 years ago
I can run irc
's test suite (I assume) and check that my irc-bot
still works with this patched version of irc
, but I'm not sure I, being unlearned in cryptography, should try to plug sundry components together to be the one to get a working CertFP implementation.
Note that native-tls
is able to avoid building any C dependencies on Windows whereas rustls
would pull in ring
which has to build a C library.
As of 0.13
ring is pretty safe to be build on windows.
Though making feature to choose between native-tls
and rustls
could be convenient
Just a note to clarify the "reasonable amount of annoyance" comment, it was directed mainly at OpenSSL which seems to break builds frequently, rather than native-tls
in general.
@DoumanAsh Unless you're using pc-windows-gnu
, in which case you'd have to setup a whole MinGW toolchain instead of using the stuff bundled with Rust.
Any news on this topic ?
If needed, I will be happy to fill a PR for the RustTls support.
I guess I will have to:
native-tls
and tokio-tls
on a feature (it will allow us to compile the project without them - and will make it much easier to compile for android)tokio-rustls
and webpki-roots
(and choose which one should be enabled by default)ssl.rs
for readabilityconn.rs
since we may have some code duplicationI can send all in one PR or split each task into a their own PR.
@tirz: If you're familiar with the relevant cryptography, that sounds good to me. I certainly am unlikely to finish this work myself.
@tirz: If you're familiar with the relevant cryptography, that sounds good to me. I certainly am unlikely to finish this work myself.
I successfully implemented it on my fork: https://github.com/tirz/irc/tree/feature-ssl_backends I will fill a PR soon.
Edit: I am just waiting for the proxy feature to be reviewed and then I will still have to implement a custom certificate selection for rustls.
gonna close this PR since we're hopefully accepting #203 (as soon as Travis goes through)
thank you for the initial work on this though, @8573
This is an unfinished patch to switch
irc
from depending ontokio-tls
andnative-tls
, which @aatxe says "has caused a reasonable amount of annoyance", totokio-rustls
and (through it)rustls
.This patch uses the 0.8.0-alpha version of
tokio-rustls
, which has atokio-tls
-esque API. Even if this patch were finished, it should not be applied until thattokio-rustls
API fully is released.While
irc
compiles with this patch applied, the following work remains to be done:Implement CertFP —
rustls
provides a less convenient API for client certificate authentication than doesnative-tls
, and I (@8573) don't understand cryptographic APIs well enough to implement CertFP with it. This WIP version of my patch provides only a stub implementation of the necessaryrustls
trait,ResolvesClientCert
, which implementation will not actually provide any client certificate torustls
, even if one is specified in theirc
-level clientConfig
.Run
irc
's test suite with this patch applied.Confirm that
irc
's dependents still work with this patch applied.