84 lines
2.3 KiB
Markdown
84 lines
2.3 KiB
Markdown
# Encrypting Zenoh Traffic
|
|
|
|
## Make the CA and Certs
|
|
|
|
Use the tools we have for that!
|
|
|
|
git.jpace121.net:2222/public/j7s-ca
|
|
|
|
```
|
|
7s_mk_ca --org-name test -o ca
|
|
j7s_mk_cert --common-name test-node --identity-type domain --identity node.test.internal.jpace121.net --auth-mode server --ca ./ca/ -o cert
|
|
```
|
|
|
|
## Change the configs
|
|
|
|
```
|
|
diff --git a/config/ROUTER_CONFIG.json5 b/config/ROUTER_CONFIG.json5
|
|
index d425fa6..2cb06a0 100644
|
|
--- a/config/ROUTER_CONFIG.json5
|
|
+++ b/config/ROUTER_CONFIG.json5
|
|
@@ -12,7 +12,7 @@
|
|
/// Which endpoints to listen on. E.g. tcp/0.0.0.0:7447.
|
|
listen: {
|
|
endpoints: [
|
|
- "tcp/0.0.0.0:7447",
|
|
+ "tls/0.0.0.0:7447",
|
|
],
|
|
},
|
|
/// Configure the scouting mechanisms and their behaviours
|
|
@@ -44,6 +44,12 @@
|
|
},
|
|
},
|
|
link: {
|
|
+ tls: {
|
|
+ root_ca_certificate: "/home/jimmy/Develop/am_i_up/src/j7s_ros_common/ca/ca/cert.pem",
|
|
+ listen_private_key: "/home/jimmy/Develop/am_i_up/src/j7s_ros_common/ca/cert/key.pem",
|
|
+ listen_certificate: "/home/jimmy/Develop/am_i_up/src/j7s_ros_common/ca/cert/cert.pem",
|
|
+ verify_name_on_connect: false,
|
|
+ },
|
|
tx: {
|
|
queue: {
|
|
congestion_control: {
|
|
diff --git a/config/SESSION_CONFIG.json5 b/config/SESSION_CONFIG.json5
|
|
index 17fd660..785cbf5 100644
|
|
--- a/config/SESSION_CONFIG.json5
|
|
+++ b/config/SESSION_CONFIG.json5
|
|
@@ -7,7 +7,7 @@
|
|
/// We only connect our local router at first.
|
|
connect: {
|
|
endpoints: [
|
|
- "tcp/localhost:7447",
|
|
+ "tls/0.0.0.0:7447",
|
|
],
|
|
retry: {
|
|
period_init_ms: 100,
|
|
@@ -21,7 +21,7 @@
|
|
/// "tcp/[::]:0", "udp/0.0.0.0:0?rel=1;mixed_rel=1"
|
|
listen: {
|
|
endpoints: [
|
|
- "tcp/0.0.0.0:0", "udp/0.0.0.0:0?rel=1;mixed_rel=1"
|
|
+ "quic/0.0.0.0:0"
|
|
],
|
|
},
|
|
|
|
@@ -52,6 +52,12 @@
|
|
},
|
|
},
|
|
link: {
|
|
+ tls: {
|
|
+ root_ca_certificate: "/home/jimmy/Develop/am_i_up/src/j7s_ros_common/ca/ca/cert.pem",
|
|
+ listen_private_key: "/home/jimmy/Develop/am_i_up/src/j7s_ros_common/ca/cert/key.pem",
|
|
+ listen_certificate: "/home/jimmy/Develop/am_i_up/src/j7s_ros_common/ca/cert/cert.pem",
|
|
+ verify_name_on_connect: false,
|
|
+ },
|
|
tx: {
|
|
queue: {
|
|
congestion_control: {
|
|
|
|
```
|
|
|
|
Note: Can also TLS instead of quic. I tried both, and just saved the last one.
|
|
|
|
Inspect the traffic in wireshark!
|