feat(iroh)!: implement support for raw public keys in TLS

[dignifiedquire]

Description

This is step one of #2798. This introduces the configuration of the TLS authentication method, allowing to enable the usage of raw public keys, which will lead to us being able to remove the hack of using self signed certificates.

TODOs

• add configuration in iroh
• tests
• cleanup

Breaking Changes

By default iroh endpoints will now use the new RawPublicKey TLS configuration. This means they will not be able to talk to older iroh nodes. If needed, the old mechanism can still be used by configuring the endpoint like this

let endpoint = Endpoint::builder()
   .tls_x509() // <--- this enables the old style TLS authentication
   // ...
   .bind();

Notes & open questions

Change checklist

• Self-review.
• Documentation updates following the style guide, if relevant.
• Tests if relevant.
• All breaking changes documented.

[github-actions]

Documentation for this PR has been generated and is available at: https://n0-computer.github.io/iroh/pr/2937/docs/iroh/

Last updated: 2025-02-14T11:48:11Z

[github-actions]

Netsim report & logs for this PR have been generated and is available at: LOGS
This report will remain available for 3 days.

Last updated for commit: 08ea993

[matheus23]

For a hot minute I was imagining a feature on rustls to disable all non-RPK paths, imagining that we could get rid of ASN.1/DER parsing code.
Then I remembered that we still use HTTPS 🙃

[matheus23]

Kind of annoying that rustls has all the implementations for ResolvesClientCert and ResolvesServerCert that we need, but they're not all exposed.

There's

• AlwaysResolvesClientCert
• AlwaysResolvesServerCert
• AlwaysResolvesClientRawPublicKeyCert
• AlwaysResolvesServerRawPublicKeyCert

I'd rather not have to implement a trait outside the crate where it's defined, but eh.
Also it's super annoying that they split it up into client/server like that.

[dignifiedquire]

Going to wait with pushing this forward until we know if rustls/rustls#2258 might happen

[dignifiedquire]

Going to wait with pushing this forward until we know if rustls/rustls#2258 might happen

looks like this is not happening, or at least not soon, so moving forward with this

[matheus23]

Perhaps add a link to the libp2p handshake spec: https://github.com/libp2p/specs/blob/master/tls/tls.md
Also explain that you can only connect to other nodes that have this setting set, and finally explain that iroh versions < 0.33 will have that set as default, and the default switched to raw public keys with version 0.33. (thus the default configuration of 0.33 cannot connect to default-configured 0.32 and earlier endpoints.)

[matheus23]

Hm. Are we sure we want to delete these tests?
I see it's weird to see a test that tests "quinn", but I think what this is actually doing is testing UdpConn (without depending on iroh being correct).
Instead of deleting these, perhaps they should be renamed & moved to udp_conn.rs?

[matheus23]

Is there a way of doing this that doesn't require going bytes -> String -> bytes?
There's an impl From<Vec<u8>> for SubjectPublicKeyInfoDer at least.