Support for EC certificates

[cculianu]

Support for EC certificates

[cculianu]

Ok. Here is a build from my working branch where I am probing keys and trying to accept all:

Fulcrum-linux-65ec080b.tar.gz

Untar it and use the enclosed binary on your system. Let me know if/how it works and also if you manage to connect to your SSL port, etc.

[cculianu]

I'm closing this issue now since the support for more cert types were added to master. However -- it's not very thoroughly tested and I noticed elliptic curve certs don't all work with Electron Cash. So with that caveat, I am closing this -- but it still needs testing. Hopefully when #28 is resolved we can see if your server "works as before" out of the box.

[cculianu]

What algorithm does this key use?

[cculianu]

Oh I see -- you pasted it -- Ec private key eh? I can add a CLI arg to allow you to specify which key type it is. Are you able to compile fulcrum? Or did you just download the release binary? And if so what platform? I can send you a test build tomorrow or sometime this week and you can tell me if it works.

[cculianu]

Well I was able to use EC, DSA, EH etc keys with Fulcrum no problem -- I wrote code to "probe" the file and figure out the format -- however note that Electron Cash seems to be unable to communicate with such servers. Are you intending to serve up data to Electron Cash wallets? Or for some other purpose?

Did that same key work with ElectrumX and were you able to connect to your server using Electron Cash?

[cculianu]

Ok so I got EC keys working but note that Python (and Electron Cash) don't support all possible EC keys and curves your can create. I managed to get it working with these params:

$ openssl ecparam -name secp521r1 -genkey -param_enc explicit -out key-ec3.pem
$ openssl req -new -x509 -key key-ec3.pem -out cert-ec3.pem -days 3650

I will push a commit to master soon and also do another release after I finish testing. Let me know if you would like a build to test (what platform are you on?).

[infertux]

Yes I was using this key successfully with ElectrumX for serve up data to Electron Cash wallets. The EC certificate/key pair is generated automatically by https://caddyserver.com/. My platform is Linux x86_64 (Debian 10). Happy to test a new build.

[infertux]

Alright the EC certificate works fine now but I'm running into another issue. Have you tried to point Fulcrum at bchd instead of bitcoind? It looks like bchd is more strict about checking HTTP headers and refusing the request sent by Fulcrum because it's missing the Host header:

<BitcoinD.1> 400 (header): HTTP/1.1 400 Bad Request: missing required Host header

Indeed if I MITM with netcat I cannot see any Host header:

$ nc -vlp 8334
listening on [any] 8334 ...
connect to [127.0.0.1] from localhost [127.0.0.1] 42256
POST / HTTP/1.1
Content-Type: application/json-rpc
Authorization: Basic blah==
Content-Length: 38

{"id":5,"method":"ping","params":[]}

Sending the request with curl works just fine (notice the extra headers):

$ curl http://127.0.0.1:8334/ -vi -H "Authorization: Basic blah==" --data '{"id":5,"method":"ping","params":[]}'

> POST / HTTP/1.1
> Host: 127.0.0.1:8334
> User-Agent: curl/7.64.0
> Accept: */*
> Authorization: Basic blah==
> Content-Length: 36
> Content-Type: application/x-www-form-urlencoded
[...]
< HTTP/1.1 200 OK
HTTP/1.1 200 OK
< Connection: close
Connection: close
< Content-Type: application/json
Content-Type: application/json

< 
{"jsonrpc":"1.0","result":null,"error":null,"id":5}

[cculianu]

I don't officially support bchd. Their RPC api is a bit quirky. If you like I can try adding the Host: header and seeing if it works -- but they are not maintaining their RPC api so it would involve my having to make exceptions for their quirks ... all over the code.

The devs of bchd want everybody to use gRPC. gRPC support in C++ is an atrocity against man.

I'm glad the cert is working -- I'll see how deep the rabbit hole goes with bchd after adding the host header.

[cculianu]

Ok, I created a new issue #28 where we can discuss bchd -- did you manage to get a node running against not bchd and verify the EC cert is working with Electron Cash? Or not yet?

[infertux]

I don't officially support bchd. Their RPC api is a bit quirky. If you like I can try adding the Host: header and seeing if it works -- but they are not maintaining their RPC api so it would involve my having to make exceptions for their quirks ... all over the code.

Well in this case it's not a quirk but an actual bug in Fulcrum since the Host header MUST be present with HTTP/1.1 as per the RFC: A client MUST include a Host header field in all HTTP/1.1 request messages . [...] All Internet-based HTTP/1.1 servers MUST respond with a 400 (Bad Request) status code to any HTTP/1.1 request message which lacks a Host header field.. So bchd is doing exactly what it's supposed to do.

I'm glad the cert is working -- I'll see how deep the rabbit hole goes with bchd after adding the host header.

Yes thank you for the quick fix BTW. Hopefully the Host header is the only bit missing.

did you manage to get a node running against not bchd and verify the EC cert is working with Electron Cash? Or not yet?

No I don't have the hardware to sync another fullnode with bitcoind. I already have a bchd fullnode and was hoping I could use it with Fulcrum too since it worked nicely with ElectrumX ;)

[cculianu]

It's not a bug, but a feature. None of the bitcoind's except for bchd require it. We aren't implementing the full RFC anyway -- this is just to get data to/from a very customized server. The host header is useless here -- but ok. I'll add it and can see how deep the rabbit hole goes.

Please subscribe to issue #28 if you haven't done so already so we may continue the discussion there. I'll let you know when Host: is added and you can try it.

[cculianu]

@infertux I just tried using bchd -- I remembered why I never support them -- they don't support HTTP persistent connections. See the other issue #28 comment #28 (comment).

Please consider switching to BCHN or any other node implementation that properly supports HTTP/1.1 persistent connections.