#![cfg(any(feature = "ring", feature = "aws_lc_rs"))]
mod common;
use crate::common::{
do_handshake, do_handshake_until_both_error, make_client_config_with_versions,
make_pair_for_arc_configs, make_server_config, ErrorFromPeer, ALL_KEY_TYPES,
};
use rustls::client::danger::{HandshakeSignatureValid, ServerCertVerified, ServerCertVerifier};
use rustls::DigitallySignedStruct;
use rustls::{AlertDescription, Error, InvalidMessage, SignatureScheme};
use pki_types::{CertificateDer, ServerName, UnixTime};
use std::sync::Arc;
#[test]
fn client_can_override_certificate_verification() {
for kt in ALL_KEY_TYPES.iter() {
let verifier = Arc::new(MockServerVerifier::accepts_anything());
let server_config = Arc::new(make_server_config(*kt));
for version in rustls::ALL_VERSIONS {
let mut client_config = make_client_config_with_versions(*kt, &[version]);
client_config
.dangerous()
.set_certificate_verifier(verifier.clone());
let (mut client, mut server) =
make_pair_for_arc_configs(&Arc::new(client_config), &server_config);
do_handshake(&mut client, &mut server);
}
}
}
#[test]
fn client_can_override_certificate_verification_and_reject_certificate() {
for kt in ALL_KEY_TYPES.iter() {
let verifier = Arc::new(MockServerVerifier::rejects_certificate(
Error::InvalidMessage(InvalidMessage::HandshakePayloadTooLarge),
));
let server_config = Arc::new(make_server_config(*kt));
for version in rustls::ALL_VERSIONS {
let mut client_config = make_client_config_with_versions(*kt, &[version]);
client_config
.dangerous()
.set_certificate_verifier(verifier.clone());
let (mut client, mut server) =
make_pair_for_arc_configs(&Arc::new(client_config), &server_config);
let errs = do_handshake_until_both_error(&mut client, &mut server);
assert_eq!(
errs,
Err(vec![
ErrorFromPeer::Client(Error::InvalidMessage(
InvalidMessage::HandshakePayloadTooLarge,
)),
ErrorFromPeer::Server(Error::AlertReceived(AlertDescription::HandshakeFailure)),
]),
);
}
}
}
#[cfg(feature = "tls12")]
#[test]
fn client_can_override_certificate_verification_and_reject_tls12_signatures() {
for kt in ALL_KEY_TYPES.iter() {
let mut client_config = make_client_config_with_versions(*kt, &[&rustls::version::TLS12]);
let verifier = Arc::new(MockServerVerifier::rejects_tls12_signatures(
Error::InvalidMessage(InvalidMessage::HandshakePayloadTooLarge),
));
client_config
.dangerous()
.set_certificate_verifier(verifier);
let server_config = Arc::new(make_server_config(*kt));
let (mut client, mut server) =
make_pair_for_arc_configs(&Arc::new(client_config), &server_config);
let errs = do_handshake_until_both_error(&mut client, &mut server);
assert_eq!(
errs,
Err(vec![
ErrorFromPeer::Client(Error::InvalidMessage(
InvalidMessage::HandshakePayloadTooLarge,
)),
ErrorFromPeer::Server(Error::AlertReceived(AlertDescription::HandshakeFailure)),
]),
);
}
}
#[test]
fn client_can_override_certificate_verification_and_reject_tls13_signatures() {
for kt in ALL_KEY_TYPES.iter() {
let mut client_config = make_client_config_with_versions(*kt, &[&rustls::version::TLS13]);
let verifier = Arc::new(MockServerVerifier::rejects_tls13_signatures(
Error::InvalidMessage(InvalidMessage::HandshakePayloadTooLarge),
));
client_config
.dangerous()
.set_certificate_verifier(verifier);
let server_config = Arc::new(make_server_config(*kt));
let (mut client, mut server) =
make_pair_for_arc_configs(&Arc::new(client_config), &server_config);
let errs = do_handshake_until_both_error(&mut client, &mut server);
assert_eq!(
errs,
Err(vec![
ErrorFromPeer::Client(Error::InvalidMessage(
InvalidMessage::HandshakePayloadTooLarge,
)),
ErrorFromPeer::Server(Error::AlertReceived(AlertDescription::HandshakeFailure)),
]),
);
}
}
#[ignore = "craftls: require special configuration"]
#[test]
fn client_can_override_certificate_verification_and_offer_no_signature_schemes() {
for kt in ALL_KEY_TYPES.iter() {
let verifier = Arc::new(MockServerVerifier::offers_no_signature_schemes());
let server_config = Arc::new(make_server_config(*kt));
for version in rustls::ALL_VERSIONS {
let mut client_config = make_client_config_with_versions(*kt, &[version]);
client_config
.dangerous()
.set_certificate_verifier(verifier.clone());
let (mut client, mut server) =
make_pair_for_arc_configs(&Arc::new(client_config), &server_config);
let errs = do_handshake_until_both_error(&mut client, &mut server);
assert_eq!(
errs,
Err(vec![
ErrorFromPeer::Server(Error::PeerIncompatible(
rustls::PeerIncompatible::NoSignatureSchemesInCommon
)),
ErrorFromPeer::Client(Error::AlertReceived(AlertDescription::HandshakeFailure)),
])
);
}
}
}
#[derive(Debug)]
pub struct MockServerVerifier {
cert_rejection_error: Option<Error>,
tls12_signature_error: Option<Error>,
tls13_signature_error: Option<Error>,
signature_schemes: Vec<SignatureScheme>,
}
impl ServerCertVerifier for MockServerVerifier {
fn verify_server_cert(
&self,
end_entity: &CertificateDer<'_>,
intermediates: &[CertificateDer<'_>],
server_name: &ServerName<'_>,
oscp_response: &[u8],
now: UnixTime,
) -> Result<ServerCertVerified, Error> {
println!(
"verify_server_cert({:?}, {:?}, {:?}, {:?}, {:?})",
end_entity, intermediates, server_name, oscp_response, now
);
if let Some(error) = &self.cert_rejection_error {
Err(error.clone())
} else {
Ok(ServerCertVerified::assertion())
}
}
fn verify_tls12_signature(
&self,
message: &[u8],
cert: &CertificateDer<'_>,
dss: &DigitallySignedStruct,
) -> Result<HandshakeSignatureValid, Error> {
println!(
"verify_tls12_signature({:?}, {:?}, {:?})",
message, cert, dss
);
if let Some(error) = &self.tls12_signature_error {
Err(error.clone())
} else {
Ok(HandshakeSignatureValid::assertion())
}
}
fn verify_tls13_signature(
&self,
message: &[u8],
cert: &CertificateDer<'_>,
dss: &DigitallySignedStruct,
) -> Result<HandshakeSignatureValid, Error> {
println!(
"verify_tls13_signature({:?}, {:?}, {:?})",
message, cert, dss
);
if let Some(error) = &self.tls13_signature_error {
Err(error.clone())
} else {
Ok(HandshakeSignatureValid::assertion())
}
}
fn supported_verify_schemes(&self) -> Vec<SignatureScheme> {
self.signature_schemes.clone()
}
}
impl MockServerVerifier {
pub fn accepts_anything() -> Self {
MockServerVerifier {
cert_rejection_error: None,
..Default::default()
}
}
pub fn rejects_certificate(err: Error) -> Self {
MockServerVerifier {
cert_rejection_error: Some(err),
..Default::default()
}
}
pub fn rejects_tls12_signatures(err: Error) -> Self {
MockServerVerifier {
tls12_signature_error: Some(err),
..Default::default()
}
}
pub fn rejects_tls13_signatures(err: Error) -> Self {
MockServerVerifier {
tls13_signature_error: Some(err),
..Default::default()
}
}
pub fn offers_no_signature_schemes() -> Self {
MockServerVerifier {
signature_schemes: vec![],
..Default::default()
}
}
}
impl Default for MockServerVerifier {
fn default() -> Self {
MockServerVerifier {
cert_rejection_error: None,
tls12_signature_error: None,
tls13_signature_error: None,
signature_schemes: vec![
SignatureScheme::RSA_PSS_SHA256,
SignatureScheme::RSA_PKCS1_SHA256,
SignatureScheme::ED25519,
SignatureScheme::ECDSA_NISTP256_SHA256,
SignatureScheme::ECDSA_NISTP384_SHA384,
],
}
}
}