Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow dialing wss peers using DNS multiaddrs #1593

Closed
aschmahmann opened this issue Jun 9, 2022 · 1 comment · Fixed by #1592
Closed

Allow dialing wss peers using DNS multiaddrs #1593

aschmahmann opened this issue Jun 9, 2022 · 1 comment · Fixed by #1592
Labels
kind/bug A bug in existing code (including security flaws) need/triage Needs initial labeling and prioritization

Comments

@aschmahmann
Copy link
Collaborator

aschmahmann commented Jun 9, 2022

Problem

From what I can tell while we technically have WSS dialing from go-libp2p due to libp2p/go-ws-transport#115 it's basically unusable.

Currently trying to dial some peer like /dns4/node3.preload.ipfs.io/tcp/443/wss/p2p/QmY7JB6MQXhxHvq7dBDh4HpbH29v4yE9JRadAVpndvzySN will result in an error like:

failed to dial QmY7JB6MQXhxHvq7dBDh4HpbH29v4yE9JRadAVpndvzySN:
  * [/ip4/145.40.97.77/tcp/443/wss] x509: cannot validate certificate for 145.40.97.77 because it doesn't contain any IP SANs

i.e. we do not make use of the DNS information in the dialing and so we run into a certificates problem because the certificate is tied to the domain name.


Small tool if you want to play with this and see the issue is https://github.com/aschmahmann/vole. You can run something like:

vole.exe bitswap check bafybeibml5uieyxa5tufngvg7fgwbkwvlsuntwbxgtskoqynbt7wlchmfm /dns4/node3.preload.ipfs.io/tcp/443/wss/p2p/QmY7JB6MQXhxHvq7dBDh4HpbH29v4yE9JRadAVpndvzySN
@aschmahmann aschmahmann added kind/bug A bug in existing code (including security flaws) need/triage Needs initial labeling and prioritization labels Jun 9, 2022
@marten-seemann
Copy link
Contributor

Copying from the discussion on the PR.

To make this work properly, we should:

  • stop resolving wss addresses in the host
  • pass the resolver to the WebSocket transport
  • not dial wss addresses if we have a TCP address from the same peer

This would also make for an excellent Testground test case.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/bug A bug in existing code (including security flaws) need/triage Needs initial labeling and prioritization
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants