search

tokio-rs / tokio-tls

An implementation of TLS/SSL streams for Tokio
MIT License
95 stars 37 forks source link

Programmatic control over certificate validation #42

Closed izolyomi closed 6 years ago

izolyomi commented 6 years ago

I'm trying to use tokio-tls in a non-HTTP scenario with self-signed certificates building a peer to peer connection. All I want is essentially a Diffie-Hellman key exchange and an encrypted channel. During the handshake I'd like to avoid the usual PKI trust chain and let peers decide programatically if they trust the certificate of the other party.

To achieve this, the usual way is to provide a hook for a callback function where certificate of the peer can be validated. In Java you can set a custom TrustManager while initializing your SslContext. Also, crate rustls nicely supports this like here https://github.com/ctz/rustls/blob/master/examples/tlsclient.rs#L424 , but I'd like the same thing in Tokio without blocking.

I've found no way to achieve this with tokio-tls. Is this possible somehow out of the box? If not, is it hard to add to the library?

aep commented 6 years ago

@izolyomi did you find a way to do that?

izolyomi commented 6 years ago

@aep Not yet, and my recent stackoverflow post with the same question was also downvoted and closed because it didn't contain enough code for the moderator's taste. Fortunately I had more urgent things on my plate. Please let me know if you've found a way already.

I really admire the amazing work of @alexcrichton and others who created Future/TokIO. It takes some learning curve to grab its essence first but it was very usable even as 0.1. I feel it lacking only at these rough edges where the only choice is usually to understand the whole thing up to the last screw and do it yourself.

Silur commented 6 years ago

On non-windows platforms, this library use OpenSSL which has SSL_CTX_set_verify that provides the certificate and uses a callback function for manual verification. An example for this is libcurl's ssluse.c Would be nice to utilize this method in tokio-tls.

carllerche commented 6 years ago

This repository is deprecated. If this is still an issue, I would recommend re-opening it on https://github.com/tokio-rs/tokio.