search

jromwu / masquerade

An implementation of MASQUE in Rust
50 stars 7 forks source link

Trying to get mutual TLS working #5

Open tashian opened 9 months ago

tashian commented 9 months ago

I'm trying to have masquerade handle (and require) mutual TLS authentication. I've added the following when setting up the server configuration:

--- a/src/server.rs
+++ b/src/server.rs
@@ -104,18 +104,22 @@ impl Server {

         // Create the configuration for the QUIC connections.
         let mut config = quiche::Config::new(quiche::PROTOCOL_VERSION).unwrap();
+
+        config.verify_peer(true);
+        config.load_verify_locations_from_file("root_ca.pem").unwrap();

To see if I could get this working quickly, I also patched quiche to require mutual TLS, by forcing it to set mode SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT when calling SSL_CTX_set_verify.

(it would be nice if this were easier to do via quiche::Config, but that's a different issue.)

When I start up the server and attempt a connection, I see:

[2024-01-30T23:50:07.796Z DEBUG masquerade_proxy::server] New connection: dcid=fae2a394169cebb1e30b4aee933850d87ca1b225 scid=fae2a394169cebb1e30b4aee933850d87ca1b225
[2024-01-30T23:50:07.801Z DEBUG masquerade_proxy::server] fae2a394169cebb1e30b4aee933850d87ca1b225 processed 1350 bytes
[2024-01-30T23:50:07.801Z DEBUG masquerade_proxy::server] fae2a394169cebb1e30b4aee933850d87ca1b225 written 1200 bytes out of 1200
[2024-01-30T23:50:07.801Z DEBUG masquerade_proxy::server] fae2a394169cebb1e30b4aee933850d87ca1b225 written 258 bytes out of 258
[2024-01-30T23:50:07.801Z DEBUG masquerade_proxy::server] QUIC connection fae2a394169cebb1e30b4aee933850d87ca1b225 done writing
[2024-01-30T23:50:07.808Z DEBUG masquerade_proxy::server] got 1350 bytes
[2024-01-30T23:50:07.808Z DEBUG masquerade_proxy::server] got packet Initial version=1 dcid=fae2a394169cebb1e30b4aee933850d87ca1b225 scid=5aef6f88df25c0ce token=7175696368650a141e19ae3b51aa654064dd
[2024-01-30T23:50:07.808Z DEBUG masquerade_proxy::server] got 59 bytes
[2024-01-30T23:50:07.808Z DEBUG masquerade_proxy::server] got packet Handshake version=1 dcid=fae2a394169cebb1e30b4aee933850d87ca1b225 scid=5aef6f88df25c0ce
[2024-01-30T23:50:07.809Z DEBUG masquerade_proxy::server] fae2a394169cebb1e30b4aee933850d87ca1b225 processed 1350 bytes
[2024-01-30T23:50:07.809Z DEBUG masquerade_proxy::server] QUIC connection fae2a394169cebb1e30b4aee933850d87ca1b225 done writing
[2024-01-30T23:50:07.809Z DEBUG masquerade_proxy::server] fae2a394169cebb1e30b4aee933850d87ca1b225 processed 59 bytes
[2024-01-30T23:50:07.809Z DEBUG masquerade_proxy::server] QUIC connection fae2a394169cebb1e30b4aee933850d87ca1b225 done writing
[2024-01-30T23:50:07.841Z DEBUG masquerade_proxy::server] got 1140 bytes
[2024-01-30T23:50:07.841Z DEBUG masquerade_proxy::server] got packet Handshake version=1 dcid=fae2a394169cebb1e30b4aee933850d87ca1b225 scid=5aef6f88df25c0ce
[2024-01-30T23:50:07.842Z ERROR masquerade_proxy::server] Error when quic recv(): TlsFail

It feels like I may be missing something in how I'm doing this, but I'm not sure what? Right now I don't have client logs but I'll try to get some and add them to this. I wonder if you have any insights about what might be happening here?