Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use nwaku's native wss #50

Closed
3 of 5 tasks
D4nte opened this issue Apr 21, 2021 · 13 comments
Closed
3 of 5 tasks

Use nwaku's native wss #50

D4nte opened this issue Apr 21, 2021 · 13 comments
Assignees

Comments

@D4nte
Copy link
Contributor

D4nte commented Apr 21, 2021

Problem

Browsers (Firefox, Chrome) only support secure websocket connections within an https page.
As most traffic nowadays defaults to https, it means we need to support wss.

nim-waku now supports native secure websocket. We need to confirm that js-waku can connect to it.

Definition of Done

Results

  • Waku.dial always assumes store + relay protocols. Hence it fails if the remote node only has relay: Waku.dial accepts protocols expected from the peer. Defaults to Waku Relay only. #516
  • Using letsencrypt certificates work with nim-waku (latest master). just need to pass the privkey.pem and fullchain.pem files created by letsencrypt
  • There are challenges in testing wss locally as Chrome/Firefox does not allow an wss connection within an http page, even if the page is served on localhost and the errors are unhelpful.
    • I was able to test the wss connection using https://js-waku.wakuconnect.dev/examples/web-chat and the /connect command
    • All our examples use React and serve the page on http. It would be interesting to have at least one example setup to serve the page on https. I was not able to do so by using react-scripts. Not sure what would be the quickest way to achieve this.
    • Firefox and chrome do not mind having a wss in a http page if the http page is served by localhost.
  • The go-waku fleet does not have websocket enabled.
  • Not sure what is the recommend way to generate a node key for nim-waku so that the peer id does not change between two restarts. Doc: Document how to generate and store a nodekey nwaku#847
  • Using a self-signed cert, even when using ip4 multiaddr does not work, Chrome and Firefox reject self-signed certs.
  • Note that certificate failure for a wss connection is NOT shown to the user.
  • Using a self-signed cert with a SAN ip ([alt_names]\nIP.1) does not work either (Firefox and Chrome reject self-signed certs).
  • It is not possible to generate an IP cert with letsencrypt

Notes

  1. Test that it actually possible to connect to one of the fleet node over wss in the browser: https://www.piesocket.com/websocket-tester If the browser reject the self-signed cert than we know we need to fix the setup first (e.g. tell operators to use letsencrypt instead)
  2. Then, test in node (best browser but node should be fine) whether we can get libp2p-websocket to accept the self-signed ip certificate see Secure WebSockets libp2p/js-libp2p#931 for details
@D4nte
Copy link
Contributor Author

D4nte commented Apr 22, 2021

After review, ws works, however, most likely we want wss too (to be confirmed).
Some info about wss: ipfs/notes#252

@D4nte
Copy link
Contributor Author

D4nte commented Apr 22, 2021

Note that chrome blocks ws (not ssl) connections by default so this is needed to make it connect to remote instances

@D4nte
Copy link
Contributor Author

D4nte commented Apr 23, 2021

Ok so findings:

  • It is not possible to connect to an insecure websocket ws loaded in a secure page https in chrome. You can work around it in Firefox by messing around with about:config.

Hence this item needs to be tackle otherwise js-waku is not really useful in the browser.

@D4nte
Copy link
Contributor Author

D4nte commented Apr 27, 2021

@D4nte D4nte added this to the js-waku showcase milestone Apr 28, 2021
@D4nte
Copy link
Contributor Author

D4nte commented Apr 28, 2021

Blocked by libp2p/js-libp2p#931

D4nte added a commit that referenced this issue Apr 28, 2021
@D4nte
Copy link
Contributor Author

D4nte commented Apr 29, 2021

FYI waku-org/go-waku#21

@D4nte D4nte changed the title Support wss Add wss test Apr 29, 2021
@D4nte D4nte added the blocked This issue is blocked by some other work label Apr 29, 2021
@D4nte D4nte removed this from the js-waku showcase milestone May 6, 2021
@D4nte
Copy link
Contributor Author

D4nte commented May 6, 2021

Removed from milestone as wss is working (just not tested as part of CI).

D4nte added a commit that referenced this issue Jun 22, 2021
Thanks to the libp2p upgrade, waku actually tries to listen to a
secure websocket. Using plain websocket for now, testing secure
websocket is tracked with #50.
@D4nte D4nte removed the blocked This issue is blocked by some other work label Nov 26, 2021
@D4nte D4nte added the blocked This issue is blocked by some other work label Nov 26, 2021
@D4nte
Copy link
Contributor Author

D4nte commented Nov 26, 2021

Blocked until nim-waku 0.7 with wss support is release.
The test can then be changed to interoperability test against wakunode2.

@D4nte D4nte removed the blocked This issue is blocked by some other work label Jan 20, 2022
@D4nte
Copy link
Contributor Author

D4nte commented Jan 20, 2022

nim-waku v0.7 with native wss support is now released and used in the CI.

@D4nte D4nte changed the title Add wss test Use wss in test & examples Jan 20, 2022
@D4nte D4nte self-assigned this Feb 7, 2022
@D4nte
Copy link
Contributor Author

D4nte commented Feb 7, 2022

Sounds very improbable that self-signed certificates can work.
It seems that most modern browser fails silently on self-signed certs.
cerbot should be used.

@D4nte
Copy link
Contributor Author

D4nte commented Feb 10, 2022

What I learned so far:

  • Waku.dial always assumes store + relay protocols. Hence it fails if the remote node only has relay. (fix in progress)
  • Using letsencrypt certificates work with nim-waku (latest master). just need to pass the privkey.pem and fullchain.pem files created by letsencrypt
  • There are challenges in testing wss locally as Chrome/Firefox does not allow an wss connection within an http page, even if the page is served on localhost and the errors are unhelpful.
    • I was able to test the wss connection using https://js-waku.wakuconnect.dev/examples/web-chat and the /connect command
    • All our examples use React and serve the page on http. It would be interesting to have at least one example setup to serve the page on https. I was not able to do so by using react-scripts. Not sure what would be the quickest way to achieve this.
  • the go-waku fleet does not have websocket enabled.
  • Not sure what is the recommend way to generate a node key for nim-waku so that the peer id does not change between two restarts.

Further research: Now that I know how to make it work, I can test out self-signed certs.

@D4nte
Copy link
Contributor Author

D4nte commented Feb 11, 2022

Further research:

  • Using a self-signed cert, even when using ip4 multiaddr does not work.
  • Note that certificate failure in wss is NOT shown to the user.
  • Using a self-signed cert with a SAN ip does not work either (Firefox and Chrome reject self-signed certs)
  • It is not possible to generate an IP cert with letsencrypt

@D4nte D4nte changed the title Use wss in test & examples Use nwaku's native wss Feb 11, 2022
@D4nte
Copy link
Contributor Author

D4nte commented Feb 21, 2022

Done. Some follow-up actions are tracked in #555

@D4nte D4nte closed this as completed Feb 21, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant