dhtproxy: add server two-ways tls

include/opendht/dht_proxy_server.h

@@ -74,7 +74,7 @@ class OPENDHT_PUBLIC DhtProxyServer
     DhtProxyServer(
        dht::crypto::Identity identity,
        std::shared_ptr<DhtRunner> dht, in_port_t port = 8000, const std::string& pushServer = "",
-       std::shared_ptr<dht::Logger> logger = {});
+       std::shared_ptr<dht::crypto::Certificate> client_certificate = {}, std::shared_ptr<dht::Logger> logger = {});
 
     virtual ~DhtProxyServer();
 

src/dht_proxy_server.cpp

@@ -197,7 +197,7 @@ struct DhtProxyServer::RestRouterTraits : public restinio::default_traits_t
 DhtProxyServer::DhtProxyServer(
     dht::crypto::Identity identity,
     std::shared_ptr<DhtRunner> dht, in_port_t port, const std::string& pushServer,
-    std::shared_ptr<dht::Logger> logger
+    std::shared_ptr<dht::crypto::Certificate> client_certificate, std::shared_ptr<dht::Logger> logger
 )
     :   dht_(dht), logger_(logger), lockListener_(std::make_shared<std::mutex>()),
         listeners_(std::make_shared<std::map<restinio::connection_id_t, http::ListenerSession>>()),
@@ -241,6 +241,18 @@ DhtProxyServer::DhtProxyServer(
                                 | asio::ssl::context::single_dh_use, ec);
         if (ec)
             throw std::runtime_error("Error setting tls context options: " + ec.message());
+        // verify client auth
+        if (client_certificate){
+            tls_context.set_verify_mode(asio::ssl::context::verify_fail_if_no_peer_cert
+                                        | asio::ssl::context::verify_peer, ec);
+            auto ca = client_certificate->toString(false/*chain*/);
+            //tls_context.load_verify_file(client_certificate);
+            tls_context.add_certificate_authority(asio::const_buffer{ca.data(), ca.size()}, ec);
+            if (ec)
+                throw std::runtime_error("Error adding client certificate: " + ec.message());
+        }
+        if (ec)
+            throw std::runtime_error("Error setting tls verify peer options: " + ec.message());
         // add more security options
 #ifdef SSL_OP_NO_RENEGOTIATION
         SSL_CTX_set_options(tls_context.native_handle(), SSL_OP_NO_RENEGOTIATION); // CVE-2009-3555

tests/dhtproxytester.cpp

@@ -48,7 +48,7 @@ DhtProxyTester::setUp() {
         new dht::DhtProxyServer(
             ///*http*/dht::crypto::Identity{},
             /*https*/serverIdentity,
-            nodeProxy, 8080, /*pushServer*/"127.0.0.1:8090", logger));
+            nodeProxy, 8080, /*pushServer*/"127.0.0.1:8090", {}, logger));
 
     clientConfig.client_cert = serverIdentity.second;
     clientConfig.dht_config.node_config.maintain_storage = false;

tests/httptester.cpp

@@ -42,7 +42,7 @@ HttpTester::setUp() {
 
     serverProxy = std::unique_ptr<dht::DhtProxyServer>(
         new dht::DhtProxyServer(
-            /*http*/dht::crypto::Identity{}, nodeProxy, 8080, /*pushServer*/"127.0.0.1:8090", logger));
+            /*http*/dht::crypto::Identity{}, nodeProxy, 8080, /*pushServer*/"127.0.0.1:8090", {}, logger));
 
 }
 

tools/dhtnode.cpp

@@ -40,7 +40,7 @@ void print_version() {
 }
 
 void print_usage() {
-    std::cout << "Usage: dhtnode [-v [-l logfile]] [-i] [-d] [-n network_id] [-p local_port] [-b bootstrap_host[:port]] [--proxyserver local_port] [--proxyserverssl local_port]" << std::endl << std::endl;
+    std::cout << "Usage: dhtnode [-v [-l logfile]] [-i] [-d] [-n network_id] [-p local_port] [-b bootstrap_host[:port]] [--proxyserver local_port] [--proxyserverssl local_port] [--proxy--certificate proxy_ca] [--proxy-privkey privkey] [--proxy-privkey-password privkey_password] [--proxy-client-certificate client_certicates]" << std::endl << std::endl;
     print_info();
 }
 
@@ -249,6 +249,7 @@ void cmd_loop(std::shared_ptr<DhtRunner>& node, dht_params& params
 #ifdef OPENDHT_PUSH_NOTIFICATIONS
                                            ,pushServer
 #endif
+                                           ,params.proxy_client_certificate
                     )));
                 }
                 else {
@@ -582,14 +583,15 @@ main(int argc, char **argv)
         if (params.proxyserverssl and params.proxy_id.first and params.proxy_id.second){
 #ifdef OPENDHT_PROXY_SERVER
             proxies.emplace(params.proxyserverssl, std::unique_ptr<DhtProxyServer>(
-                new DhtProxyServer(params.proxy_id,
-                                   node, params.proxyserverssl, params.pushserver, context.logger)));
+                new DhtProxyServer(
+                    params.proxy_id, node, params.proxyserverssl, params.pushserver,
+                    params.proxy_client_certificate, context.logger)));
         }
         if (params.proxyserver) {
             proxies.emplace(params.proxyserver, std::unique_ptr<DhtProxyServer>(
                 new DhtProxyServer(
-                    dht::crypto::Identity{},
-                    node, params.proxyserver, params.pushserver, context.logger)));
+                    dht::crypto::Identity{}, node, params.proxyserver, params.pushserver,
+                    {}, context.logger)));
 #else
             std::cerr << "DHT proxy server requested but OpenDHT built without proxy server support." << std::endl;
             exit(EXIT_FAILURE);

tools/tools_common.h

@@ -127,10 +127,11 @@ struct dht_params {
     std::string devicekey {};
     std::string persist_path {};
     dht::crypto::Identity id {};
-    dht::crypto::Identity proxy_id {};
     std::string privkey_pwd {};
-    std::string proxy_privkey_pwd {};
     std::string save_identity {};
+    dht::crypto::Identity proxy_id {};
+    std::string proxy_privkey_pwd {};
+    std::shared_ptr<dht::crypto::Certificate> proxy_client_certificate {};
 };
 
 static const constexpr struct option long_options[] = {
@@ -155,6 +156,7 @@ static const constexpr struct option long_options[] = {
     {"proxy-certificate",       required_argument, nullptr, 'w'},
     {"proxy-privkey",           required_argument, nullptr, 'K'},
     {"proxy-privkey-password",  required_argument, nullptr, 'M'},
+    {"proxy-client-certificate",required_argument, nullptr, 'P'},
     {"proxyclient",             required_argument, nullptr, 'C'},
     {"pushserver",              required_argument, nullptr, 'y'},
     {"devicekey",               required_argument, nullptr, 'z'},
@@ -274,6 +276,14 @@ parseArgs(int argc, char **argv) {
         case 'I':
             params.save_identity = optarg;
             break;
+        case 'P': {
+            try {
+                params.proxy_client_certificate = std::make_shared<dht::crypto::Certificate>(loadFile(optarg));
+            } catch (const std::exception& e) {
+                throw std::runtime_error(std::string("Error loading proxy certificate: ") + e.what());
+            }
+            break;
+        }
         default:
             break;
         }