feat: allow to customize TLS trust roots#3973
Conversation
|
Documentation for this PR has been generated and is available at: https://n0-computer.github.io/iroh/pr/3973/docs/iroh/ Last updated: 2026-02-27T10:47:49Z |
|
Interesting: I switched the default to use the operating system's defaults, and tests fail on windows and android. Will have a closer look soon. But maybe we should stay with embedded WebPKI as default then. Edit: Windows fails the integration test with |
|
I switched the default back to the embedded roots. |
| /// | ||
| /// If *keylog* is `true` then setting the `SSLKEYLOGFILE` environment variable to a | ||
| /// filename will result in this file being used to log the TLS pre-master keys. | ||
| pub fn keylog(mut self, keylog: bool) -> Self { |
There was a problem hiding this comment.
should this be an option on the webtlsconfig?
There was a problem hiding this comment.
No, this setting is about TLS config for iroh connections, not WebTls
There was a problem hiding this comment.
We could add this to WebTlsConfig as well. Currently WebTls doesn't ever have resumption configured. Do we? Don't think there's any 0RTT though for our web uses
There was a problem hiding this comment.
I think this is out-of-scope for CaRootsConfig (now that we've renamed it that's maybe clearer).
Making keylog effect TLS connections other than the iroh ones is perhaps another issue/PR.
| /// number of clients. | ||
| /// | ||
| /// The default is 256, taking about 150 KiB in memory. | ||
| pub fn max_tls_tickets(mut self, n: usize) -> Self { |
There was a problem hiding this comment.
what about these other tls options?
There was a problem hiding this comment.
IMO they're out-of-scope for the current CaRootsConfig.
Maybe in the future we group CaRootsConfig and friends into a TlsConfig down the line, but IMO that's another PR.
(Also TLS tickets are probably only relevant to iroh connections)
matheus23
left a comment
There was a problem hiding this comment.
Happy to see this land. Not sure if this should be 0.97 or 0.98.
| #[derive(Debug, Clone)] | ||
| enum Mode { |
There was a problem hiding this comment.
Generally not sure we need to duplicate the docs on this struct now.
Description
This adds customization to how certificates for non-iroh TLS connections are verified. It adds a new
CaRootsConfigstruct which provides these options:test-utilsfeature, like now)This struct can be built into a
rustls::ClientConfig, which is then used for:I think that's all places where we use TLS connections in iroh. Will have another look if we missed any.
Breaking Changes
Removed:
iroh::endpoint::Builder::insecure_skip_cert_verify, useBuilder::ca_roots_config(CaRootsConfig::insecure_skip_verify())insteadiroh_relay::client::ClientBuilder::insecure_skip_cert_verify, removeClientBuilder::tls_client_configinsteadiroh::address_lookup::pkarr::PkarrResolverBuilder::buildandiroh::address_lookup::pkarr::PkarrPublisherBuilder::buildnow take atls_config: rustls::ClientConfigarg. If building viaEndpoint::add_discoveryorendpoint::Builder::discoveryno change is needed since the TLS config is passed from the endpoint builder. If constructing manually for some reason, either passEndpoint::tls_configor construct a TLS config yourself, e.g. viairoh::tls::CaRootsConfig::client_config.Change checklist