Added code for certificate pinning for hardcoded peers. #164
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
I'm curious as to anybody's thoughts on the idea of using TLS certificate hashes to verify peer identity.
This is some code I wrote to add to the 'real_name' format so that cert hashes can be provided, and check them. So, a peer name in coins.py can now look like the below and the peer will be marked bad if its TLS certificate doesn't match the hashes:
'electrumx.bitcoinsv.io s xsha256=08aa855b19599d84871cc4ce2218dee0f585eefae8fd8fa1899cad27ebe05d7f xblake2b=36b2e8aae9547d38d18de1f2e0f90153efb60f577acfb078ed330ec414e18d24de6c4c03aba0946bd4c3118707dede3443e6e9e68ce91b5cf18d0cac84703339'
I haven't looked at how features and peers are exchanged between servers at this time. I'm pretty new to the electrum protocol, and can often struggle to write code.