Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update tokio-rustls dependency #263

Merged
merged 2 commits into from
Nov 6, 2024
Merged

Update tokio-rustls dependency #263

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1aa1d39
Update tokio-rustls dependency
kpcyrd Jul 1, 2024
62dd1f8
Make DangerousAcceptAllVerifier wrap a CryptoProvider
kpcyrd Jul 2, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,10 +66,10 @@ tokio-socks = { version = "0.5.1", optional = true }

# Feature - TLS
native-tls = { version = "0.2.11", optional = true }
tokio-rustls = { version = "0.24.0", features = ["dangerous_configuration"], optional = true }
rustls-pemfile = { version = "1.0.2", optional = true }
tokio-rustls = { version = "0.26.0", optional = true }
rustls-pemfile = { version = "2", optional = true }
tokio-native-tls = { version = "0.3.1", optional = true }
webpki-roots = { version = "0.23.0", optional = true }
webpki-roots = { version = "0.26.0", optional = true }


[dev-dependencies]
Expand Down
121 changes: 80 additions & 41 deletions src/client/conn.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ use futures_util::{sink::Sink, stream::Stream};
use pin_project::pin_project;
use std::{
fmt,
iter::FromIterator,
pin::Pin,
task::{Context, Poll},
};
Expand All @@ -25,8 +26,6 @@ use native_tls::{Certificate, Identity, TlsConnector};
#[cfg(all(feature = "tls-native", not(feature = "tls-rust")))]
use tokio_native_tls::{self, TlsStream};

#[cfg(feature = "tls-rust")]
use rustls_pemfile::certs;
#[cfg(feature = "tls-rust")]
use std::{
convert::TryFrom,
Expand All @@ -38,10 +37,11 @@ use std::{
use tokio_rustls::client::TlsStream;
#[cfg(feature = "tls-rust")]
use tokio_rustls::{
rustls::client::{ServerCertVerified, ServerCertVerifier},
rustls::{
self, Certificate, ClientConfig, OwnedTrustAnchor, PrivateKey, RootCertStore, ServerName,
rustls::client::danger::{ServerCertVerified, ServerCertVerifier},
rustls::pki_types::{
CertificateDer as Certificate, PrivateKeyDer as PrivateKey, ServerName, UnixTime,
},
rustls::{self, ClientConfig, RootCertStore},
TlsConnector,
};

Expand Down Expand Up @@ -223,6 +223,7 @@ impl Connection {
config: &Config,
tx: UnboundedSender<Message>,
) -> error::Result<Transport<TlsStream<TcpStream>>> {
#[derive(Debug)]
struct DangerousAcceptAllVerifier;
aatxe marked this conversation as resolved.
Show resolved Hide resolved

impl ServerCertVerifier for DangerousAcceptAllVerifier {
Expand All @@ -231,31 +232,71 @@ impl Connection {
_: &Certificate,
_: &[Certificate],
_: &ServerName,
_: &mut dyn Iterator<Item = &[u8]>,
_: &[u8],
_: std::time::SystemTime,
_: UnixTime,
) -> Result<ServerCertVerified, rustls::Error> {
return Ok(ServerCertVerified::assertion());
}

fn verify_tls12_signature(
&self,
_message: &[u8],
_cert: &Certificate<'_>,
_dss: &rustls::DigitallySignedStruct,
) -> Result<rustls::client::danger::HandshakeSignatureValid, rustls::Error>
{
Ok(rustls::client::danger::HandshakeSignatureValid::assertion())
}

fn verify_tls13_signature(
&self,
_message: &[u8],
_cert: &Certificate<'_>,
_dss: &rustls::DigitallySignedStruct,
) -> Result<rustls::client::danger::HandshakeSignatureValid, rustls::Error>
{
Ok(rustls::client::danger::HandshakeSignatureValid::assertion())
}

fn supported_verify_schemes(&self) -> Vec<rustls::SignatureScheme> {
vec![
rustls::SignatureScheme::RSA_PKCS1_SHA1,
rustls::SignatureScheme::ECDSA_SHA1_Legacy,
rustls::SignatureScheme::RSA_PKCS1_SHA256,
rustls::SignatureScheme::ECDSA_NISTP256_SHA256,
rustls::SignatureScheme::RSA_PKCS1_SHA384,
rustls::SignatureScheme::ECDSA_NISTP384_SHA384,
rustls::SignatureScheme::RSA_PKCS1_SHA512,
rustls::SignatureScheme::ECDSA_NISTP521_SHA512,
rustls::SignatureScheme::RSA_PSS_SHA256,
rustls::SignatureScheme::RSA_PSS_SHA384,
rustls::SignatureScheme::RSA_PSS_SHA512,
rustls::SignatureScheme::ED25519,
rustls::SignatureScheme::ED448,
]
}
aatxe marked this conversation as resolved.
Show resolved Hide resolved
}

enum ClientAuth {
SingleCert(Vec<Certificate>, PrivateKey),
SingleCert(Vec<Certificate<'static>>, PrivateKey<'static>),
NoClientAuth,
}

let client_auth = if let Some(client_cert_path) = config.client_cert_path() {
if let Ok(file) = File::open(client_cert_path) {
let client_cert_data = certs(&mut BufReader::new(file)).map_err(|_| {
error::Error::Io(Error::new(ErrorKind::InvalidInput, "invalid cert"))
})?;
let client_cert_data =
rustls_pemfile::certs(&mut BufReader::new(file)).collect::<Result<_, _>>()?;

let client_cert_data = client_cert_data
.into_iter()
.map(Certificate)
.collect::<Vec<_>>();

let client_cert_pass = PrivateKey(Vec::from(config.client_cert_pass()));
let client_cert_pass = config.client_cert_pass();
let client_cert_pass = rustls_pemfile::private_key(
&mut client_cert_pass.as_bytes(),
)?
.ok_or_else(|| error::Error::InvalidConfig {
path: config.path(),
cause: error::ConfigError::UnknownConfigFormat {
format: "Failed to parse private key".to_string(),
},
})?;

log::info!(
"Using {} for client certificate authentication.",
Expand All @@ -279,7 +320,7 @@ impl Connection {
($builder:expr) => {
match client_auth {
ClientAuth::SingleCert(data, pass) => {
$builder.with_single_cert(data, pass).map_err(|err| {
$builder.with_client_auth_cert(data, pass).map_err(|err| {
error::Error::Io(Error::new(ErrorKind::InvalidInput, err))
})?
}
Expand All @@ -288,35 +329,33 @@ impl Connection {
};
}

let builder = ClientConfig::builder()
.with_safe_default_cipher_suites()
.with_safe_default_kx_groups()
.with_safe_default_protocol_versions()?;
let builder = ClientConfig::builder();

let tls_config = if config.dangerously_accept_invalid_certs() {
let builder =
builder.with_custom_certificate_verifier(Arc::new(DangerousAcceptAllVerifier));
let builder = builder
.dangerous()
.with_custom_certificate_verifier(Arc::new(DangerousAcceptAllVerifier));
make_client_auth!(builder)
} else {
let mut root_store = RootCertStore::empty();

root_store.add_server_trust_anchors(webpki_roots::TLS_SERVER_ROOTS.0.iter().map(
|ta| {
OwnedTrustAnchor::from_subject_spki_name_constraints(
ta.subject,
ta.spki,
ta.name_constraints,
)
},
));
let mut root_store = RootCertStore::from_iter(
webpki_roots::TLS_SERVER_ROOTS
.iter()
.map(|ta| ta.to_owned()),
);

if let Some(cert_path) = config.cert_path() {
if let Ok(data) = std::fs::read(cert_path) {
root_store.add(&Certificate(data)).map_err(|_| {
error::Error::Io(Error::new(ErrorKind::InvalidInput, "invalid cert"))
})?;
if let Ok(file) = File::open(cert_path) {
let certificates = rustls_pemfile::certs(&mut BufReader::new(file))
.collect::<Result<Vec<_>, _>>()?;
let (added, ignored) = root_store.add_parsable_certificates(certificates);

if ignored > 0 {
log::warn!("Failed to parse some certificates in {}", cert_path);
}

log::info!("Added {} to trusted certificates.", cert_path);
if added > 0 {
log::info!("Added {} to trusted certificates.", cert_path);
}
} else {
return Err(error::Error::InvalidConfig {
path: config.path(),
Expand All @@ -332,7 +371,7 @@ impl Connection {
};

let connector = TlsConnector::from(Arc::new(tls_config));
let domain = ServerName::try_from(config.server()?)?;
let domain = ServerName::try_from(config.server()?)?.to_owned();
let stream = Self::new_stream(config).await?;
let stream = connector.connect(domain, stream).await?;
let framed = Framed::new(stream, IrcCodec::new(config.encoding())?);
Expand Down
2 changes: 1 addition & 1 deletion src/error.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ use std::sync::mpsc::RecvError;
use thiserror::Error;
use tokio::sync::mpsc::error::{SendError, TrySendError};
#[cfg(feature = "tls-rust")]
use tokio_rustls::rustls::client::InvalidDnsNameError;
use tokio_rustls::rustls::pki_types::InvalidDnsNameError;

use crate::proto::error::{MessageParseError, ProtocolError};

Expand Down
Loading