This repository has been archived by the owner on May 26, 2022. It is now read-only.
use the handshake logic from go-libp2p-tls #67
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This was referenced Jul 29, 2019
marten-seemann
force-pushed
the
tls-handshake
branch
from
4644692 to
c01848a
Compare
Stebalien
suggested changes
Aug 1, 2019
marten-seemann
force-pushed
the
tls-handshake
branch
from
50db8cf to
971415b
Compare
|
I just released a new quic-go version, which bumps the QUIC version number. See PR #68. |
Stebalien
approved these changes
Aug 5, 2019
|
(lgtm once the tests pass) |
marten-seemann
force-pushed
the
tls-handshake
branch
from
971415b to
d52b77a
Compare
marten-seemann
force-pushed
the
tls-handshake
branch
from
d52b77a to
8067d71
Compare
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #3. Fixes #18. Fixes #60.
CI is failing because quic-go dependency is not updated yet.
Furthermore, this depends on a new quic-go release, which includes quic-go/quic-go#2024. We will also need to increase the QUIC version number, since the old and the new handshake are incompatible. This makes sense anyway, since a new QUIC draft version was released recently. By using a new QUIC version number, peers using the old and the new handshake won't be able to connect to each other (using QUIC), so we won't get any handshake failures from that.
This PR implements the easiest possible way to reuse the handshake logic from go-libp2p-tls, which is slightly more computationally expensive for the server: Since QUIC multiplexes connections, we don't have the clear order that we have in TCP: 1. accept TCP connection, 2. run TLS handshake on that connection.
In QUIC, the first time we learn about a new connection attempt is when the
tls.Config.GetConfigForClientcallback is called. We use this callback to return atls.Configthat verifies the peer's certificate chain. At some point later, quic-go will return a fully establish QUIC connection (if the handshake succeeded). However, we have no way of associating this connection with thetls.Configwe returned earlier (keep in mind that the server could be running multiple handshakes concurrently), so we need to parse the certificate chain a second time to determine the peer's identity.