ntp_proto/
tls_utils.rs

1mod rustls23_shim {
2    /// The intent of this ClientCertVerifier is that it accepts any connections that are either
3    /// a.) not presenting a client certificate
4    /// b.) are presenting a well-formed, but otherwise not checked (against a trust root) client certificate
5    ///
6    /// This is because RusTLS apparently doesn't accept every kind of self-signed certificate.
7    ///
8    /// The only goal of this ClientCertVerifier is to achieve that, if a client presents a TLS certificate,
9    /// this certificate shows up in the .peer_certificates() for that connection.
10    #[cfg(feature = "nts-pool")]
11    #[derive(Debug)]
12    pub struct AllowAnyAnonymousOrCertificateBearingClient {
13        supported_algs: WebPkiSupportedAlgorithms,
14    }
15
16    #[cfg(feature = "nts-pool")]
17    use rustls23::{
18        crypto::{CryptoProvider, WebPkiSupportedAlgorithms},
19        pki_types::CertificateDer,
20        server::danger::ClientCertVerified,
21    };
22
23    #[cfg(feature = "nts-pool")]
24    impl AllowAnyAnonymousOrCertificateBearingClient {
25        pub fn new(provider: &CryptoProvider) -> Self {
26            AllowAnyAnonymousOrCertificateBearingClient {
27                supported_algs: provider.signature_verification_algorithms,
28            }
29        }
30    }
31
32    #[cfg(feature = "nts-pool")]
33    impl rustls23::server::danger::ClientCertVerifier for AllowAnyAnonymousOrCertificateBearingClient {
34        fn verify_client_cert(
35            &self,
36            _end_entity: &CertificateDer,
37            _intermediates: &[CertificateDer],
38            _now: rustls23::pki_types::UnixTime,
39        ) -> Result<ClientCertVerified, rustls23::Error> {
40            Ok(ClientCertVerified::assertion())
41        }
42
43        fn client_auth_mandatory(&self) -> bool {
44            false
45        }
46
47        fn root_hint_subjects(&self) -> &[rustls23::DistinguishedName] {
48            &[]
49        }
50
51        fn verify_tls12_signature(
52            &self,
53            message: &[u8],
54            cert: &rustls23::pki_types::CertificateDer<'_>,
55            dss: &rustls23::DigitallySignedStruct,
56        ) -> Result<rustls23::client::danger::HandshakeSignatureValid, rustls23::Error> {
57            rustls23::crypto::verify_tls12_signature(message, cert, dss, &self.supported_algs)
58        }
59
60        fn verify_tls13_signature(
61            &self,
62            message: &[u8],
63            cert: &rustls23::pki_types::CertificateDer<'_>,
64            dss: &rustls23::DigitallySignedStruct,
65        ) -> Result<rustls23::client::danger::HandshakeSignatureValid, rustls23::Error> {
66            rustls23::crypto::verify_tls13_signature(message, cert, dss, &self.supported_algs)
67        }
68
69        fn supported_verify_schemes(&self) -> Vec<rustls23::SignatureScheme> {
70            self.supported_algs.supported_schemes()
71        }
72    }
73
74    pub use rustls23::pki_types::InvalidDnsNameError;
75    pub use rustls23::pki_types::ServerName;
76    pub use rustls23::server::NoClientAuth;
77    pub use rustls23::version::TLS13;
78    pub use rustls23::ClientConfig;
79    pub use rustls23::ClientConnection;
80    pub use rustls23::ConnectionCommon;
81    pub use rustls23::Error;
82    pub use rustls23::RootCertStore;
83    pub use rustls23::ServerConfig;
84    pub use rustls23::ServerConnection;
85
86    pub type Certificate = rustls23::pki_types::CertificateDer<'static>;
87    pub type PrivateKey = rustls23::pki_types::PrivateKeyDer<'static>;
88
89    pub use rustls_platform_verifier::Verifier as PlatformVerifier;
90
91    pub mod pemfile {
92        use rustls23::pki_types::{
93            pem::PemObject, CertificateDer, PrivateKeyDer, PrivatePkcs8KeyDer,
94        };
95
96        pub fn certs(
97            rd: &mut dyn std::io::BufRead,
98        ) -> impl Iterator<Item = Result<CertificateDer<'static>, std::io::Error>> + '_ {
99            CertificateDer::pem_reader_iter(rd).map(|item| {
100                item.map_err(|err| match err {
101                    rustls23::pki_types::pem::Error::Io(error) => error,
102                    _ => std::io::Error::new(std::io::ErrorKind::InvalidInput, err.to_string()),
103                })
104            })
105        }
106
107        pub fn private_key(
108            rd: &mut dyn std::io::BufRead,
109        ) -> Result<PrivateKeyDer<'static>, std::io::Error> {
110            PrivateKeyDer::from_pem_reader(rd).map_err(|err| match err {
111                rustls23::pki_types::pem::Error::Io(error) => error,
112                _ => std::io::Error::new(std::io::ErrorKind::InvalidInput, err.to_string()),
113            })
114        }
115
116        pub fn pkcs8_private_keys(
117            rd: &mut dyn std::io::BufRead,
118        ) -> impl Iterator<Item = Result<PrivatePkcs8KeyDer<'static>, std::io::Error>> + '_
119        {
120            PrivatePkcs8KeyDer::pem_reader_iter(rd).map(|item| {
121                item.map_err(|err| match err {
122                    rustls23::pki_types::pem::Error::Io(error) => error,
123                    _ => std::io::Error::new(std::io::ErrorKind::InvalidInput, err.to_string()),
124                })
125            })
126        }
127    }
128
129    pub trait CloneKeyShim {}
130
131    pub fn client_config_builder(
132    ) -> rustls23::ConfigBuilder<rustls23::ClientConfig, rustls23::WantsVerifier> {
133        ClientConfig::builder()
134    }
135
136    pub fn client_config_builder_with_protocol_versions(
137        versions: &[&'static rustls23::SupportedProtocolVersion],
138    ) -> rustls23::ConfigBuilder<rustls23::ClientConfig, rustls23::WantsVerifier> {
139        ClientConfig::builder_with_protocol_versions(versions)
140    }
141
142    pub fn server_config_builder(
143    ) -> rustls23::ConfigBuilder<rustls23::ServerConfig, rustls23::WantsVerifier> {
144        ServerConfig::builder()
145    }
146
147    pub fn server_config_builder_with_protocol_versions(
148        versions: &[&'static rustls23::SupportedProtocolVersion],
149    ) -> rustls23::ConfigBuilder<rustls23::ServerConfig, rustls23::WantsVerifier> {
150        ServerConfig::builder_with_protocol_versions(versions)
151    }
152}
153
154pub use rustls23_shim::*;
ntp_proto/tls_utils.rs

ntp_proto/
tls_utils.rs
