shadowsocks / shadowsocks/qtun

qtun doesn't work when using ECC certificate

Open
#2 5 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Rust
Stars
139
Forks
23
PR merge metrics
No merged PRs in 30d

Description

For example use the following command:

# This is a ECC certificate
shell> head -n 1 /etc/ssl/certs/343.re/privkey.pem
-----BEGIN EC PRIVATE KEY-----
shell> ss-libev-server -s 0.0.0.0 -p 12345 -k dnomd343 -m aes-256-ctr --plugin qtun-server --plugin-opts "cert=/etc/ssl/certs/343.re/fullchain.pem;key=/etc/ssl/certs/343.re/privkey.pem"
 2022-01-28 14:46:17 INFO: plugin "qtun-server" enabled
 2022-01-28 14:46:17 INFO: initializing ciphers... aes-256-ctr
 2022-01-28 14:46:17 INFO: Stream ciphers are insecure, therefore deprecated, and should be almost always avoided.
 2022-01-28 14:46:17 INFO: tcp server listening at 127.0.0.1:35937
 2022-01-28 14:46:17 INFO: running from root user
[2022-01-28T14:46:17Z INFO  qtun_server] loading cert: "/etc/ssl/certs/343.re/fullchain.pem"
[2022-01-28T14:46:17Z INFO  qtun_server] loading key: "/etc/ssl/certs/343.re/privkey.pem"
Error: no private keys found
 2022-01-28 14:46:17 ERROR: plugin service exit unexpectedly
 2022-01-28 14:46:17 INFO: error on terminating the plugin.

It work fine when using RSA certificates:

# This is a RSA certificate
shell> head -n 1 /etc/ssl/certs/dns.343.re/private.key
-----BEGIN RSA PRIVATE KEY-----
shell> ss-libev-server -s 0.0.0.0 -p 12345 -k dnomd343 -m aes-256-ctr --plugin qtun-server --plugin-opts "cert=/etc/ssl/certs/dns.343.re
/certificate.crt;key=/etc/ssl/certs/dns.343.re/private.key"
 2022-01-28 14:48:00 INFO: plugin "qtun-server" enabled
 2022-01-28 14:48:00 INFO: initializing ciphers... aes-256-ctr
 2022-01-28 14:48:00 INFO: Stream ciphers are insecure, therefore deprecated, and should be almost always avoided.
 2022-01-28 14:48:00 INFO: tcp server listening at 127.0.0.1:60863
 2022-01-28 14:48:00 INFO: running from root user
[2022-01-28T14:48:00Z INFO  qtun_server] loading cert: "/etc/ssl/certs/dns.343.re/certificate.crt"
[2022-01-28T14:48:00Z INFO  qtun_server] loading key: "/etc/ssl/certs/dns.343.re/private.key"
listening on 0.0.0.0:12345

Is it wrong with my configuration? Or qtun itself does not support ECC certificates?

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the qtun-server command with the shown ECC certificate and compare its output with the working RSA command. Trace the certificate and private-key loading path responsible for “Error: no private keys found”; done means the ECC configuration starts successfully without regressing RSA certificate support.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
networking, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.