openconnect-core 0.1.5

A library for interacting with OpenConnect VPN
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66

use crate::VpnClient;
use openconnect_sys::*;
use std::{ffi::CString, sync::Mutex};

#[derive(Debug, PartialEq, Eq)]
pub(crate) struct AcceptedCert {
    pub fingerprint: String,
    pub host: Option<String>,
    pub port: i32,
}

#[derive(Debug, Default)]
pub(crate) struct PeerCerts {
    pub accepted_certs: Mutex<Vec<AcceptedCert>>,
}

impl PeerCerts {
    pub(crate) extern "C" fn validate_peer_cert(
        privdata: *mut ::std::os::raw::c_void,
        _reason: *const ::std::os::raw::c_char,
    ) -> ::std::os::raw::c_int {
        let client = unsafe { VpnClient::ref_from_raw(privdata) };
        let vpninfo = client.vpninfo;
        let host = client.get_hostname();
        let port = client.get_port();

        let openssl_cert_guard = client.peer_certs.accepted_certs.lock();
        if let Ok(openssl_cert) = openssl_cert_guard {
            for cert in openssl_cert.iter().rev() {
                if (host.is_none() || cert.host == host) && (port == 0 || cert.port == port) {
                    let fingerprint_in_cstr =
                        CString::new(cert.fingerprint.as_str()).expect("Invalid fingerprint");
                    let err = unsafe {
                        openconnect_check_peer_cert_hash(vpninfo, fingerprint_in_cstr.as_ptr())
                    };
                    if err == 0 {
                        return 0;
                    }
                    if err < 0 {
                        // TODO: log error
                        println!("Could not check peer cert hash: {}", cert.fingerprint);
                    }
                }
            }
        }

        let fingerprint = client.get_peer_cert_hash();

        if client.handle_accept_insecure_cert(&fingerprint) {
            let newcert = AcceptedCert {
                fingerprint,
                host,
                port,
            };
            let openssl_cert_guard = client.peer_certs.accepted_certs.lock();
            if let Ok(mut openssl_cert) = openssl_cert_guard {
                openssl_cert.push(newcert);
            }
            tracing::debug!("User accepted insecure certificate");
            0
        } else {
            tracing::debug!("User rejected insecure certificate");
            1
        }
    }
}