Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Feature]: Secure socket connections to the server with SSL #5164

Open
fishface60 opened this issue Feb 2, 2025 · 0 comments
Open

[Feature]: Secure socket connections to the server with SSL #5164

fishface60 opened this issue Feb 2, 2025 · 0 comments
Labels
feature Adding functionality that adds value

Comments

@fishface60
Copy link
Contributor

Describe the Problem

When using the Registry without WebRTC, LAN or direct TCP connections to MapTool servers the connection is not encrypted and the authenticity of the MapTool server is not verified.

This feature can be considered related to #5063 in that they are both required to ensure

This can be considered a precondition of features like #5163 where it's not the integrity of the game's data model that's being protected, but the user's system, and direct file access is significantly more exploitable so needs to be protected against MITM attacks.

The Solution you'd like

  1. MapTool supports connecting over SSL for servers that sysadmins have very carefully configured SSL tunnels to.

  2. MapTool generates self-signed certificates from the existing RSA key.
    The RSA key and self-signed certificate are provided through a KeyManager
    passed to SSLContext.init.
    At this point users have to install the server's self-signed certificate into their OS cert store themselves.

  3. MapTool provides an interface for clients to copy pre-shared self-signed certificates that were sent by secure back-channels into a MapTool-specific certificate store. That is used by a custom TrustManager passed to SSLContext.init.

  4. Servers send their certificate to the MapTool registry and clients add the certificate to their certificate store automatically so all that groups need to do to use SSL is for the host to tick a box in the UI.

  5. Extend the LAN announcement packets to include SSL certificate so it's just Direct TCP connections that need to have the certificates pre-shared.

Alternatives that you've considered.

Concentrate on #5063 but that abandons users who don't use WebRTC to less secure connections and inability to offer certain features.

Additional Context

No response

@fishface60 fishface60 added the feature Adding functionality that adds value label Feb 2, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
feature Adding functionality that adds value
Projects
None yet
Development

No branches or pull requests

1 participant