j7s_ros_common/notes/encrypting-zenoh.md

Encrypting Zenoh Traffic

Make the CA and Certs

Use the tools we have for that!

git.jpace121.net:2222/public/j7s-ca

7s_mk_ca --org-name test -o ca
j7s_mk_cert --common-name test-node --identity-type domain --identity node.test.internal.jpace121.net --auth-mode server --ca ./ca/ -o cert

Change the configs

diff --git a/config/ROUTER_CONFIG.json5 b/config/ROUTER_CONFIG.json5
index d425fa6..2cb06a0 100644
--- a/config/ROUTER_CONFIG.json5
+++ b/config/ROUTER_CONFIG.json5
@@ -12,7 +12,7 @@
   /// Which endpoints to listen on. E.g. tcp/0.0.0.0:7447.
   listen: {
     endpoints: [
-      "tcp/0.0.0.0:7447",
+      "tls/0.0.0.0:7447",
     ],
   },
   /// Configure the scouting mechanisms and their behaviours
@@ -44,6 +44,12 @@
       },
     },
     link: {
+      tls: {
+         root_ca_certificate: "/home/jimmy/Develop/am_i_up/src/j7s_ros_common/ca/ca/cert.pem",
+         listen_private_key: "/home/jimmy/Develop/am_i_up/src/j7s_ros_common/ca/cert/key.pem",
+         listen_certificate: "/home/jimmy/Develop/am_i_up/src/j7s_ros_common/ca/cert/cert.pem",
+         verify_name_on_connect: false,
+      },
       tx: {
         queue: {
           congestion_control: {
diff --git a/config/SESSION_CONFIG.json5 b/config/SESSION_CONFIG.json5
index 17fd660..785cbf5 100644
--- a/config/SESSION_CONFIG.json5
+++ b/config/SESSION_CONFIG.json5
@@ -7,7 +7,7 @@
   /// We only connect our local router at first.
   connect: {
     endpoints: [
-      "tcp/localhost:7447",
+      "tls/0.0.0.0:7447",
     ],
     retry: {
        period_init_ms: 100,
@@ -21,7 +21,7 @@
   /// "tcp/[::]:0", "udp/0.0.0.0:0?rel=1;mixed_rel=1"
   listen: {
     endpoints: [
-      "tcp/0.0.0.0:0", "udp/0.0.0.0:0?rel=1;mixed_rel=1"
+      "quic/0.0.0.0:0"
     ],
   },
 
@@ -52,6 +52,12 @@
       },
     },
     link: {
+      tls: {
+         root_ca_certificate: "/home/jimmy/Develop/am_i_up/src/j7s_ros_common/ca/ca/cert.pem",
+         listen_private_key: "/home/jimmy/Develop/am_i_up/src/j7s_ros_common/ca/cert/key.pem",
+         listen_certificate: "/home/jimmy/Develop/am_i_up/src/j7s_ros_common/ca/cert/cert.pem",
+         verify_name_on_connect: false,
+      },
       tx: {
         queue: {
           congestion_control: {

Note: Can also TLS instead of quic. I tried both, and just saved the last one.

Inspect the traffic in wireshark!