search

flackr / circ

An IRC packaged chrome app
BSD 3-Clause "New" or "Revised" License
388 stars 79 forks source link

Use native chrome ssl sockets #433

Open alexgartrell opened 4 years ago

alexgartrell commented 4 years ago

This looks pretty similar to a change by @flackr, but submitting anyway in case there's something I'm missing.

Previously, we relied on a pure javscript ssl implementation called forge for secure sockets. This had a couple of significant downsides:

  1. Certificate Authentication via your trusted CA (or any CA) didn't work
  2. Name verification wasn't enabled

As a result, secure sockets were not secure.

This solves the problem by using the (present since Chrome 38) secure socket support. This gives you all of the TLS certificate authentication goodness of chrome for free. As a plus, it's also a relatively simple change, so I was able to delete most of the logic for ssl and just add a separate callback for pre secure connect.

flackr commented 4 years ago

As you pointed out I have a similar change https://github.com/flackr/circ/tree/chrome-sockets-tcp-secure. The issue I found when trying this is that chrome.socket requires additional attestation which fails on many SSL irc servers. For example, when connecting to freenode:

/server chat.freenode.net +6697
Socket Error: failed to secure socket: net::ERR_SSL_CLIENT_AUTH_CERT_NEEDED (error 110)