fkm_proxy/utils/
certs.rs

1use anyhow::Result;
2use rustls::{
3    client::danger::{ServerCertVerified, ServerCertVerifier},
4    pki_types::{CertificateDer, PrivateKeyDer, ServerName, UnixTime},
5};
6use std::{fs::File, io::BufReader, path::Path, sync::Arc};
7
8pub fn load_certs(path: &Path) -> Result<Vec<CertificateDer<'static>>> {
9    if !path.exists() {
10        return Err(anyhow::anyhow!("Cert not found in path: {path:?}"));
11    }
12
13    rustls_pemfile::certs(&mut BufReader::new(File::open(path)?))
14        .collect::<std::io::Result<_>>()
15        .map_err(anyhow::Error::from)
16}
17
18pub fn load_keys(path: &Path) -> Result<PrivateKeyDer<'static>> {
19    if !path.exists() {
20        return Err(anyhow::anyhow!("Private key not found in path: {path:?}"));
21    }
22
23    rustls_pemfile::private_key(&mut BufReader::new(File::open(path)?))?
24        .ok_or_else(|| anyhow::anyhow!("Private key returned None"))
25}
26
27pub fn cert_from_str(cert: &str) -> Result<Vec<CertificateDer<'static>>> {
28    rustls_pemfile::certs(&mut cert.as_bytes())
29        .collect::<std::io::Result<_>>()
30        .map_err(anyhow::Error::from)
31}
32
33pub fn key_from_str(key: &str) -> Result<PrivateKeyDer<'static>> {
34    rustls_pemfile::private_key(&mut key.as_bytes())?
35        .ok_or_else(|| anyhow::anyhow!("Private ket returned None"))
36}
37
38#[derive(Debug)]
39pub struct NoCertVerification;
40impl ServerCertVerifier for NoCertVerification {
41    fn verify_server_cert(
42        &self,
43        _end_entity: &tokio_rustls::rustls::pki_types::CertificateDer<'_>,
44        _intermediates: &[tokio_rustls::rustls::pki_types::CertificateDer<'_>],
45        _server_name: &tokio_rustls::rustls::pki_types::ServerName<'_>,
46        _ocsp_response: &[u8],
47        _now: tokio_rustls::rustls::pki_types::UnixTime,
48    ) -> Result<tokio_rustls::rustls::client::danger::ServerCertVerified, tokio_rustls::rustls::Error>
49    {
50        Ok(ServerCertVerified::assertion())
51    }
52
53    fn verify_tls12_signature(
54        &self,
55        _message: &[u8],
56        _cert: &tokio_rustls::rustls::pki_types::CertificateDer<'_>,
57        _dss: &tokio_rustls::rustls::DigitallySignedStruct,
58    ) -> Result<
59        tokio_rustls::rustls::client::danger::HandshakeSignatureValid,
60        tokio_rustls::rustls::Error,
61    > {
62        Ok(tokio_rustls::rustls::client::danger::HandshakeSignatureValid::assertion())
63    }
64
65    fn verify_tls13_signature(
66        &self,
67        _message: &[u8],
68        _cert: &tokio_rustls::rustls::pki_types::CertificateDer<'_>,
69        _dss: &tokio_rustls::rustls::DigitallySignedStruct,
70    ) -> Result<
71        tokio_rustls::rustls::client::danger::HandshakeSignatureValid,
72        tokio_rustls::rustls::Error,
73    > {
74        Ok(tokio_rustls::rustls::client::danger::HandshakeSignatureValid::assertion())
75    }
76
77    fn supported_verify_schemes(&self) -> Vec<tokio_rustls::rustls::SignatureScheme> {
78        // All
79        vec![
80            tokio_rustls::rustls::SignatureScheme::RSA_PKCS1_SHA1,
81            tokio_rustls::rustls::SignatureScheme::RSA_PKCS1_SHA256,
82            tokio_rustls::rustls::SignatureScheme::ECDSA_NISTP256_SHA256,
83            tokio_rustls::rustls::SignatureScheme::RSA_PKCS1_SHA384,
84            tokio_rustls::rustls::SignatureScheme::ECDSA_NISTP384_SHA384,
85            tokio_rustls::rustls::SignatureScheme::RSA_PKCS1_SHA512,
86            tokio_rustls::rustls::SignatureScheme::ECDSA_NISTP521_SHA512,
87            tokio_rustls::rustls::SignatureScheme::RSA_PSS_SHA256,
88            tokio_rustls::rustls::SignatureScheme::RSA_PSS_SHA384,
89            tokio_rustls::rustls::SignatureScheme::RSA_PSS_SHA512,
90            tokio_rustls::rustls::SignatureScheme::ED25519,
91            tokio_rustls::rustls::SignatureScheme::ED448,
92        ]
93    }
94}
95
96#[derive(Debug)]
97pub struct SkipQuicServerVerification(Arc<rustls::crypto::CryptoProvider>);
98impl SkipQuicServerVerification {
99    pub fn new() -> Arc<Self> {
100        Arc::new(Self(Arc::new(rustls::crypto::ring::default_provider())))
101    }
102}
103
104impl rustls::client::danger::ServerCertVerifier for SkipQuicServerVerification {
105    fn verify_server_cert(
106        &self,
107        _end_entity: &CertificateDer<'_>,
108        _intermediates: &[CertificateDer<'_>],
109        _server_name: &ServerName<'_>,
110        _ocsp: &[u8],
111        _now: UnixTime,
112    ) -> Result<rustls::client::danger::ServerCertVerified, rustls::Error> {
113        Ok(rustls::client::danger::ServerCertVerified::assertion())
114    }
115
116    fn verify_tls12_signature(
117        &self,
118        message: &[u8],
119        cert: &CertificateDer<'_>,
120        dss: &rustls::DigitallySignedStruct,
121    ) -> Result<rustls::client::danger::HandshakeSignatureValid, rustls::Error> {
122        rustls::crypto::verify_tls12_signature(
123            message,
124            cert,
125            dss,
126            &self.0.signature_verification_algorithms,
127        )
128    }
129
130    fn verify_tls13_signature(
131        &self,
132        message: &[u8],
133        cert: &CertificateDer<'_>,
134        dss: &rustls::DigitallySignedStruct,
135    ) -> Result<rustls::client::danger::HandshakeSignatureValid, rustls::Error> {
136        rustls::crypto::verify_tls13_signature(
137            message,
138            cert,
139            dss,
140            &self.0.signature_verification_algorithms,
141        )
142    }
143
144    fn supported_verify_schemes(&self) -> Vec<rustls::SignatureScheme> {
145        self.0.signature_verification_algorithms.supported_schemes()
146    }
147}
fkm_proxy/utils/certs.rs

fkm_proxy/utils/
certs.rs
