TLS #63

leto · 2017-10-31T08:32:20Z

Describe the issue

Hush only supports HTTP and therefore connecting to an RPC backend is only "safe" over localhost, otherwise it would leak lots of metadata and rpc user/pass. Hush should support TLS like Bitcoin and other coins like Zen. Encrypted p2p connections will additionally greatly reduce network metadata available to snoopy people.

Bounty

TBD

Can you reliably reproduce the issue?

Yup

If so, please list the steps to reproduce below:

Observe
No
TLS

Expected behaviour

Support TLS connections,

Actual behaviour + errors

No TLS

The version of Hush you were using:

All

Prior Art

See ZEN's TLS_integration branch: https://github.com/zencashio/zen/compare/master...ZencashOfficial:TLS_integration?expand=1
and the corresponding issue: HorizenOfficial/zen#26

radix42 · 2017-10-31T23:33:06Z

if anyone is going to work this bounty, please contact me first to discuss issues with it

kentsommer · 2017-11-04T01:48:24Z

Is anyone currently working on this?

oDinZu · 2017-11-05T10:17:00Z

@kentsommer I have spent a lot of time on this, but I am still learning. If I am in the right direction, you can build on or checkout what I did so far here: https://github.com/csharpee/hush/tree/hush-tls

At the moment, the build is not successful and has header.h files needing to be added or updated --I am still not sure. I read through 124 commits and added only tls & openssl related things into the hush codebase from ZcashOfficial TLS_Integration help shared here by @leto

This is the error I am getting after building:

In file included from main.h:18:0,
from sendalert.cpp:42:
net.h:156:8: error: ‘SSL_CTX’ does not name a type
extern SSL_CTX *tls_ctx_server;
^
net.h:157:8: error: ‘SSL_CTX’ does not name a type
extern SSL_CTX *tls_ctx_client;
^
net.h:331:114: error: ‘SSL’ has not been declared
CNode(SOCKET hSocketIn, const CAddress &addrIn, const std::string &addrNameIn = "", bool fInboundIn = false, SSL *sslIn = NULL);

kentsommer · 2017-11-07T05:29:20Z

@radix42 @csharpee @leto

I have a secure (TLS enabled node) up and running on hush. Guide for setup and various other documentation is needed but... progress. You were on the right track @csharpee!

oDinZu · 2017-11-07T06:59:45Z

Nice, good work @kentsommer -- you make this look easy =).

I didn't want to just copy everything over so I setup a C++ IDE and started reading through the code to make sense of it. I went through each commit and possibly missed something. I started to think maybe zcash disabled this for its earlier version and begun looking through the depends/packages/openssl.mk file to make sure we weren't using old SSL and also made sure we can use Diffie-Hellman key exchanges for our nodes. Everything looked good to my knowledge.

I need to go back through the code and see what I did wrong. I do know, I did not setup the CA or TLS for my node to work for I was unable to build. I think its a simple fix, just clueless at the moment. I will dive into more tomorrow after class if I can.

Some concerns at the moment are if we want to allow nodes to connect to other nodes without TLS. The setup as is now is setup to allow both non-TLS and TLS nodes. I did not disable public nodes for not sure what Hush wanted.

-Should TLS only be allowed or at least (recommended)?
-If hush wants to connect to TLS only nodes, we need an option to do so.
-Should we allow TLS 1.1 for aid in old browsers?

Some testing I want to do:
-Does OCSP Stapling cause any concerns with hush node?
-Does HPKP Protection cause any issues with the hush node?
-Will we be able to use TLS Encrypt CA for our ACME certbot protection with he hush node?
-Tor Integration + TLS have any issues?

kentsommer · 2017-11-07T07:16:14Z

@csharpee

Hopefully I haven't stepped on any toes, just trying to get hush pushed forward 👍

Yes, I agree, allowing the choice to connect to TLS only would be a good thing to add.

Notes for you (@csharpee):

SSL ca certs are not required until the actual "runtime" of the node so building is not at all tied with them (re-reading your post I think you already knew this so ignore ).
Looks like you are just missing a few auto-tools settings and includes:
- Some features need to be enabled in: depends/packages/openssl.mk
- Missing tlskeypath and tlscertpath code blocks in: src/init.cpp
- Missing #include <openssl/bio.h> and #include <openssl/ssl.h> in: src/net.h
- Missing SSL *ssl; var definition in: src/net.h

oDinZu · 2017-11-07T07:19:04Z

No not at all man, I am still learning and am happy to help. You are being more than respectful, I am with you - getting hush pushed forward 👍

kentsommer · 2017-11-07T07:23:16Z

The secure node system in hush might also require something similar to the secure node tracking in zencash (outline is on page 10 and 11 of their whitepaper).

Not sure what it would look like, but making that system decentralized seems like a good move.

@radix42 Any thoughts on system architecture / do we require this?

oDinZu · 2017-11-08T00:24:40Z

@kentsommer thanks for the tips man. I got the build working. I don't have a CA setup yet though on testing user account.
@radix42 I am leaving this alone until more direction.

Thank you for running a HUSH node!
You're helping to secure everyone's privacy


In order to ensure you are adequately protecting your privacy when using Hush,
please see <https://github.com/MyHush/hush/blob/master/doc/security.md>.

           Block height | 16865
            Connections | 3
            Secure connections | 3 (TLS: 0)
  Network solution rate | 1 Sol/s
    Local solution rate | 0.4907 Sol/s

You are mining with the tromp solver on 1 threads.

Since starting this node 3 minutes, 40 seconds ago:
- You have validated no transactions.
- You have completed 56 Equihash solver runs.

[Press Ctrl+C to exit] [Set 'showmetrics=0' to hide]

$ ./src/hush-cli getmininginfo
{
  "blocks": 16861,
  "currentblocksize": 1000,
  "currentblocktx": 0,
  "difficulty": 7.297981625835189,
  "errors": "",
  "genproclimit": 1,
  "localsolps": 0.3636363636363636,
  "networksolps": 1,
  "networkhashps": 1,
  "pooledtx": 0,
  "testnet": true,
  "chain": "test",
  "generate": true
}

$ ./src/hush-cli getnetworkinfo
{
  "version": 1001250,
  "subversion": "/BalefulStatic:1.0.12/",
  "protocolversion": 170002,
  "localservices": "0000000000000001",
  "timeoffset": 0,
  "connections": 3,
  "tls_cert_verified": false,
  "networks": [
    {
      "name": "ipv4",
      "limited": false,
      "reachable": true,
      "proxy": "",
      "proxy_randomize_credentials": false
    },
    {
      "name": "ipv6",
      "limited": false,
      "reachable": true,
      "proxy": "",
      "proxy_randomize_credentials": false
    },
    {
      "name": "onion",
      "limited": true,
      "reachable": false,
      "proxy": "",
      "proxy_randomize_credentials": false
    }
  ],
  "relayfee": 0.00000100,
  "localaddresses": [
  ],
  "warnings": ""
}

matthewjamesr · 2017-11-08T01:55:39Z

@kentsommer could you join us in our Discord sometime? @radix42 and I would like to group chat you one night.

kentsommer · 2017-11-08T02:05:47Z

@matthewjamesr

I'm in the KST (Korean Standard) time zone, but if you had a time in mind (evening or morning my time would be best - busy during the day) I am happy to chat for a bit.

matthewjamesr · 2017-11-08T02:15:42Z

Heads up I will be in Korea around mid Feb, for three years. Sounds like a plan I will chat with @radix42 about a time.

WaveringAna · 2017-11-08T07:04:24Z

Not sure what it would look like, but making that system decentralized seems like a good move. that's the plan actually once we set up the dao with zen. It can be setup as a layer 2 thing, nodes verify other nodes and check they follow a strict protocol, append it to a list for other nodes to verify and check, the only tricky part is how do we do payments while keeping it anonymous and decentralized

kentsommer · 2017-11-08T07:05:31Z

@aayanl Payments as in rewards to those running the secure nodes?

WaveringAna · 2017-11-08T07:06:13Z

Yes

…

On Nov 8, 2017 2:05 AM, "Kent Sommer" ***@***.***> wrote: @aayanl <https://github.com/aayanl> Payments as in rewards to those running the secure nodes? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#63 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AJmmkdZcH0ycvdpDRN9uoaZ2p4v_zI3xks5s0VK8gaJpZM4QMYMV> .

kentsommer · 2017-11-08T08:48:21Z

I've confirmed the ability to make TLS connections on the hush testnet:

I will work on documentation for setup over the next few days in my free time.

kiloutyg · 2017-11-08T09:08:39Z

I can't wait for those doc to contribute to the testing !

matthewjamesr · 2017-11-11T01:06:43Z

Re: managing TLS nodes

I think we can simply manage this by inserting a new config glad secureonly=0, or another sensible flag name.

0: False
1: True

We can maintain a second DNS seed for TLS nodes. Thoughts @radix42 @kentsommer @madbuda ?

kentsommer · 2017-11-11T01:20:44Z

@matthewjamesr

That sounds reasonable to me if we stick with TLS as the peer-to-peer encryption scheme. However, I'm not super set that TLS is the way to go for this security enhancement. I've been looking at the solution proposed in BIP 151 as well.

I floated the idea by @radix42 recently but I think we should get everyone's opinion.

matthewjamesr · 2017-11-11T01:21:46Z

I'll give it a read. I am ok with whatever the group reaches consenses with.

lludlow · 2017-11-11T01:57:23Z

👍 on BIP 151

matthewjamesr · 2017-11-11T02:44:23Z

@kentsommer I concur and am ok with BIP 151.

matthewjamesr · 2017-11-15T02:05:09Z

After discussion between myself, @radix42, and @kentsommer, we have decided to PR the TLS branch. BIP 151 might be implemented on a future date/time.

WaveringAna · 2017-11-15T02:16:07Z

👍 the ca stuff is only unique to zen securenodes, glad to see more coins implementing encrypted network stacks 😃

kentsommer · 2017-11-29T12:16:56Z

This is closed out by #68

kentsommer closed this as completed Nov 29, 2017

tarrenj mentioned this issue Jun 21, 2018

OpenSSL integration HorizenOfficial/zen#85

Closed

4 tasks

oDinZu mentioned this issue Mar 16, 2020

TLS Support MyHush/hush3#1

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

TLS #63

TLS #63

leto commented Oct 31, 2017 •

edited

Loading

radix42 commented Oct 31, 2017

kentsommer commented Nov 4, 2017

oDinZu commented Nov 5, 2017 •

edited

Loading

kentsommer commented Nov 7, 2017 •

edited

Loading

oDinZu commented Nov 7, 2017 •

edited

Loading

kentsommer commented Nov 7, 2017 •

edited

Loading

oDinZu commented Nov 7, 2017

kentsommer commented Nov 7, 2017 •

edited

Loading

oDinZu commented Nov 8, 2017 •

edited

Loading

matthewjamesr commented Nov 8, 2017

kentsommer commented Nov 8, 2017

matthewjamesr commented Nov 8, 2017

WaveringAna commented Nov 8, 2017

kentsommer commented Nov 8, 2017

WaveringAna commented Nov 8, 2017 via email

kentsommer commented Nov 8, 2017

kiloutyg commented Nov 8, 2017

matthewjamesr commented Nov 11, 2017

kentsommer commented Nov 11, 2017 •

edited

Loading

matthewjamesr commented Nov 11, 2017

lludlow commented Nov 11, 2017

matthewjamesr commented Nov 11, 2017

matthewjamesr commented Nov 15, 2017 •

edited

Loading

WaveringAna commented Nov 15, 2017 •

edited

Loading

kentsommer commented Nov 29, 2017

TLS #63

TLS #63

Comments

leto commented Oct 31, 2017 • edited Loading

Describe the issue

Bounty

Can you reliably reproduce the issue?

If so, please list the steps to reproduce below:

Expected behaviour

Actual behaviour + errors

The version of Hush you were using:

Prior Art

radix42 commented Oct 31, 2017

kentsommer commented Nov 4, 2017

oDinZu commented Nov 5, 2017 • edited Loading

kentsommer commented Nov 7, 2017 • edited Loading

oDinZu commented Nov 7, 2017 • edited Loading

kentsommer commented Nov 7, 2017 • edited Loading

oDinZu commented Nov 7, 2017

kentsommer commented Nov 7, 2017 • edited Loading

oDinZu commented Nov 8, 2017 • edited Loading

matthewjamesr commented Nov 8, 2017

kentsommer commented Nov 8, 2017

matthewjamesr commented Nov 8, 2017

WaveringAna commented Nov 8, 2017

kentsommer commented Nov 8, 2017

WaveringAna commented Nov 8, 2017 via email

kentsommer commented Nov 8, 2017

kiloutyg commented Nov 8, 2017

matthewjamesr commented Nov 11, 2017

kentsommer commented Nov 11, 2017 • edited Loading

matthewjamesr commented Nov 11, 2017

lludlow commented Nov 11, 2017

matthewjamesr commented Nov 11, 2017

matthewjamesr commented Nov 15, 2017 • edited Loading

WaveringAna commented Nov 15, 2017 • edited Loading

kentsommer commented Nov 29, 2017

leto commented Oct 31, 2017 •

edited

Loading

oDinZu commented Nov 5, 2017 •

edited

Loading

kentsommer commented Nov 7, 2017 •

edited

Loading

oDinZu commented Nov 7, 2017 •

edited

Loading

kentsommer commented Nov 7, 2017 •

edited

Loading

kentsommer commented Nov 7, 2017 •

edited

Loading

oDinZu commented Nov 8, 2017 •

edited

Loading

kentsommer commented Nov 11, 2017 •

edited

Loading

matthewjamesr commented Nov 15, 2017 •

edited

Loading

WaveringAna commented Nov 15, 2017 •

edited

Loading