implement attested channels#24
implement attested channels#240x416e746f6e wants to merge 3 commits intofix/lagging-resetter-channelfrom
Conversation
ameba23
left a comment
ameba23
left a comment
There was a problem hiding this comment.
🥇 Looks great! 💯
As you already put in the todos, it would be great to have a test to be sure this works.
And as already mentioned i have concerns about nesting TLS, but i think most of my worries could be mitigated by good configuration, eg: setting max_fragment_size on the inner session to avoid overflowing TLS records on the outer session. With benchmarking we should be able to figure out a config that works well.
| ocsp_response: &[u8], | ||
| now: UnixTime, | ||
| ) -> Result<ServerCertVerified, rustls::Error> { | ||
| match self.inner.verify_server_cert( |
There was a problem hiding this comment.
Ah this is cool that it handles CA signed-certs as usual as well as self-signed
| tls.tls_key(), | ||
| tls.tls_certificate(), | ||
| tls.atls_key(), | ||
| atls::server::AttestationGenerator::with_no_attestation(), // TODO: use real stuff |
There was a problem hiding this comment.
Maybe we can instantiate AttestationGenerator and AttestationVerifier as part of config processing, and grab them here with getter methods as with the other TLS related stuff.
| awc = { version = "3.7.0", features = ["rustls-0_23"] } | ||
| http = "1.3.1" | ||
| rcgen = { version = "0.14.7", features = ["x509-parser"] } | ||
| rustls = { version = "0.23.32", features = ["aws_lc_rs"] } |
There was a problem hiding this comment.
Not too critical, but since tokio-rustls re-exports rustls, using the re-exported version could guarantee that there is no version drift when you update. But since it anyway uses 0.23 this is fine.
| ) | ||
| .unwrap(); // TODO: verify on start | ||
|
|
||
| client.connector(connector.connector(atls)).finish() |
There was a problem hiding this comment.
Not sure whether it was intentional, but it looks like we no longer do .limit(connections_limit). Theres no compiler warning that the value is unused because it is logged.
2 participants
subj.
todo:
also: