feat(iroh)!: implement support for raw public keys in TLS

[dignifiedquire]

Description

This is step one of #2798. This introduces the configuration of the TLS authentication method, allowing to enable the usage of raw public keys, which will lead to us being able to remove the hack of using self signed certificates.

TODOs

• add configuration in iroh
• tests
• cleanup

Breaking Changes

By default iroh endpoints will now use the new RawPublicKey TLS configuration. This means they will not be able to talk to older iroh nodes. If needed, the old mechanism can still be used by configuring the endpoint like this

let endpoint = Endpoint::builder()
   .tls_x509() // <--- this enables the old style TLS authentication
   // ...
   .bind();

Notes & open questions

Change checklist

• Self-review.
• Documentation updates following the style guide, if relevant.
• Tests if relevant.
• All breaking changes documented.

[github-actions]

Documentation for this PR has been generated and is available at: https://n0-computer.github.io/iroh/pr/2937/docs/iroh/

Last updated: 2025-02-12T19:09:31Z

[github-actions]

Netsim report & logs for this PR have been generated and is available at: LOGS
This report will remain available for 3 days.

Last updated for commit: df4e537

[matheus23]

For a hot minute I was imagining a feature on rustls to disable all non-RPK paths, imagining that we could get rid of ASN.1/DER parsing code.
Then I remembered that we still use HTTPS 🙃

[matheus23]

Kind of annoying that rustls has all the implementations for ResolvesClientCert and ResolvesServerCert that we need, but they're not all exposed.

There's

• AlwaysResolvesClientCert
• AlwaysResolvesServerCert
• AlwaysResolvesClientRawPublicKeyCert
• AlwaysResolvesServerRawPublicKeyCert

I'd rather not have to implement a trait outside the crate where it's defined, but eh.
Also it's super annoying that they split it up into client/server like that.

[dignifiedquire]

Going to wait with pushing this forward until we know if rustls/rustls#2258 might happen

[dignifiedquire]

Going to wait with pushing this forward until we know if rustls/rustls#2258 might happen

looks like this is not happening, or at least not soon, so moving forward with this