aboutsummaryrefslogtreecommitdiff
path: root/plugins/omemo/src/protocol
diff options
context:
space:
mode:
authorMatthew Fennell <matthew@fennell.dev>2024-06-17 22:27:17 +0100
committerfiaxh <fiaxh@users.noreply.github.com>2024-06-29 11:54:08 +0200
commitf55b27716a50e80c4eb0661ea3ec284ec559fc5b (patch)
tree3d02dc635ef43d87548396993b9d7b09dd6a90dc /plugins/omemo/src/protocol
parentda4ded964f122ffef194d3f7d7cf7fd0fd71d8cf (diff)
downloaddino-f55b27716a50e80c4eb0661ea3ec284ec559fc5b.tar.gz
dino-f55b27716a50e80c4eb0661ea3ec284ec559fc5b.zip
Allow self-signed .onion file transfer certs (#1149)
Most Certificate Authorities don't support issuing X.509 certificates for onion sites. However, it can still be useful to provide a certificate over Tor in some circumstances, for instance to tie your alphanumeric Tor address to your site's main identity. Therefore, many Tor services provide self-signed certificates. This is OK, since the onion service itself guarantees that you are connecting to the entity you think you are. Dino already allows self-signed certs when communicating over Tor (see 81a5505). However, the same exception does not exist yet for HTTP uploads and downloads - causing these to fail over Tor. Therefore, in this commit, we add the same exception for uploads/downloads, by passing the host of the upload/download urls to the already existing invalid certificate connection handler. Note that this handler only allows certificates with type TlsCertificateFlags.UNKNOWN_CA. This means the certificate of your server must also include the onion http upload and download URLs in its certificate - otherwise, the file transfer will fail with TlsCertificateFlags.BAD_IDENTITY.
Diffstat (limited to 'plugins/omemo/src/protocol')
0 files changed, 0 insertions, 0 deletions