filip/Stalwart
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Use rustls-platform-verifier for TLS certificate verification instead of webpki + Use aws-lc for cryptographic operations instead of ring

Browse Source
This commit is contained in:
Maurus Decimus
2026-04-04 12:23:30 +02:00
parent c44d3da6dc
commit 71f54f7e84
80 changed files with 1921 additions and 2198 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
crates/utils/Cargo.toml
View File

@@ -1,28 +1,27 @@
[package]
name = "utils"
version = "0.15.5"
version = "0.16.0"
edition = "2024"
[dependencies]
trc = { path = "../trc" }
rustls = { version = "0.23.5", default-features = false, features = ["std", "ring", "tls12"] }
rustls = { version = "0.23.5", default-features = false, features = ["std", "aws_lc_rs", "tls12"] }
rustls-pemfile = "2.0"
rustls-pki-types = { version = "1" }
rustls-platform-verifier = "0.6"
tokio = { version = "1.47", features = ["net", "macros", "signal"] }
tokio-rustls = { version = "0.26", default-features = false, features = ["ring", "tls12"] }
tokio-rustls = { version = "0.26", default-features = false, features = ["aws_lc_rs", "tls12"] }
serde = { version = "1.0", features = ["derive"]}
mail-auth = { path = "/Users/me/code/mail-auth" }
smtp-proto = { version = "0.2" }
mail-send = { version = "0.5", default-features = false, features = ["cram-md5", "ring", "tls12"] }
ahash = { version = "0.8", features = ["serde"] }
chrono = "0.4"
rand = "0.9.0"
webpki-roots = { version = "1.0"}
ring = { version = "0.17" }
base64 = "0.22"
serde_json = "1.0"
rcgen = "0.14"
reqwest = { version = "0.12", default-features = false, features = ["rustls-tls-webpki-roots", "http2", "stream"]}
reqwest = { version = "0.13", default-features = false, features = ["rustls", "http2", "stream"]}
x509-parser = "0.18"
pem = "3.0"
parking_lot = "0.12"

2
crates/utils/proc-macros/Cargo.toml
View File

@@ -1,6 +1,6 @@
[package]
name = "proc_macros"
version = "0.15.5"
version = "0.16.0"
edition = "2024"
[lib]

93
crates/utils/src/lib.rs
View File

@@ -15,21 +15,16 @@ pub mod http;
pub mod map;
pub mod snowflake;
pub mod template;
pub mod tls;
pub mod topological;
pub mod url_params;
use compact_str::ToCompactString;
use futures::StreamExt;
use reqwest::Response;
use rustls::{
ClientConfig, RootCertStore, SignatureScheme,
client::danger::{HandshakeSignatureValid, ServerCertVerified, ServerCertVerifier},
};
use rustls_pki_types::TrustAnchor;
use std::sync::Arc;
pub use reqwest::Client;
use reqwest::Response;
pub use reqwest::header::HeaderMap;
use std::fmt::Write;
pub trait HttpLimitResponse: Sync + Send {
fn bytes_with_limit(
@@ -147,29 +142,6 @@ pub async fn wait_for_shutdown() {
trc::event!(Server(trc::ServerEvent::Shutdown), CausedBy = signal);
}
pub fn rustls_client_config(allow_invalid_certs: bool) -> ClientConfig {
let config = ClientConfig::builder();
if !allow_invalid_certs {
let mut root_cert_store = RootCertStore::empty();
root_cert_store.extend(webpki_roots::TLS_SERVER_ROOTS.iter().map(|ta| TrustAnchor {
subject: ta.subject.clone(),
subject_public_key_info: ta.subject_public_key_info.clone(),
name_constraints: ta.name_constraints.clone(),
}));
config
.with_root_certificates(root_cert_store)
.with_no_client_auth()
} else {
config
.dangerous()
.with_custom_certificate_verifier(Arc::new(DummyVerifier {}))
.with_no_client_auth()
}
}
pub trait DomainPart {
fn to_lowercase_domain(&self) -> String;
fn domain_part(&self) -> &str;
@@ -214,55 +186,18 @@ impl<T: AsRef<str>> DomainPart for T {
}
}
#[derive(Debug)]
struct DummyVerifier;
pub trait HexEncode {
fn hex_encode(&self) -> String;
}
impl ServerCertVerifier for DummyVerifier {
fn verify_server_cert(
&self,
_end_entity: &rustls_pki_types::CertificateDer<'_>,
_intermediates: &[rustls_pki_types::CertificateDer<'_>],
_server_name: &rustls_pki_types::ServerName<'_>,
_ocsp_response: &[u8],
_now: rustls_pki_types::UnixTime,
) -> Result<ServerCertVerified, rustls::Error> {
Ok(ServerCertVerified::assertion())
}
fn verify_tls12_signature(
&self,
_message: &[u8],
_cert: &rustls_pki_types::CertificateDer<'_>,
_dss: &rustls::DigitallySignedStruct,
) -> Result<HandshakeSignatureValid, rustls::Error> {
Ok(HandshakeSignatureValid::assertion())
}
fn verify_tls13_signature(
&self,
_message: &[u8],
_cert: &rustls_pki_types::CertificateDer<'_>,
_dss: &rustls::DigitallySignedStruct,
) -> Result<HandshakeSignatureValid, rustls::Error> {
Ok(HandshakeSignatureValid::assertion())
}
fn supported_verify_schemes(&self) -> Vec<SignatureScheme> {
vec![
SignatureScheme::RSA_PKCS1_SHA1,
SignatureScheme::ECDSA_SHA1_Legacy,
SignatureScheme::RSA_PKCS1_SHA256,
SignatureScheme::ECDSA_NISTP256_SHA256,
SignatureScheme::RSA_PKCS1_SHA384,
SignatureScheme::ECDSA_NISTP384_SHA384,
SignatureScheme::RSA_PKCS1_SHA512,
SignatureScheme::ECDSA_NISTP521_SHA512,
SignatureScheme::RSA_PSS_SHA256,
SignatureScheme::RSA_PSS_SHA384,
SignatureScheme::RSA_PSS_SHA512,
SignatureScheme::ED25519,
SignatureScheme::ED448,
]
impl<T: AsRef<[u8]>> HexEncode for T {
fn hex_encode(&self) -> String {
let bytes = self.as_ref();
let mut s = String::with_capacity(bytes.len() * 2);
for &b in bytes {
let _ = write!(&mut s, "{b:02x}");
}
s
}
}

87
crates/utils/src/tls.rs Normal file
View File

@@ -0,0 +1,87 @@
/*
* SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <hello@stalw.art>
*
* SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
*/
use rustls::{
ClientConfig, SignatureScheme,
client::danger::{HandshakeSignatureValid, ServerCertVerified, ServerCertVerifier},
};
use rustls_platform_verifier::BuilderVerifierExt;
use std::sync::Arc;
use tokio_rustls::TlsConnector;
pub fn rustls_client_config(allow_invalid_certs: bool) -> Result<ClientConfig, String> {
let config = ClientConfig::builder();
if !allow_invalid_certs {
config
.with_platform_verifier()
.map(|config| config.with_no_client_auth())
.map_err(|err| format!("Failed to build platform verifier: {err}"))
} else {
Ok(config
.dangerous()
.with_custom_certificate_verifier(Arc::new(DummyVerifier {}))
.with_no_client_auth())
}
}
pub fn build_tls_connector(allow_invalid_certs: bool) -> Result<TlsConnector, String> {
rustls_client_config(allow_invalid_certs)
.map(Arc::new)
.map(TlsConnector::from)
}
#[derive(Debug)]
struct DummyVerifier;
impl ServerCertVerifier for DummyVerifier {
fn verify_server_cert(
&self,
_end_entity: &rustls_pki_types::CertificateDer<'_>,
_intermediates: &[rustls_pki_types::CertificateDer<'_>],
_server_name: &rustls_pki_types::ServerName<'_>,
_ocsp_response: &[u8],
_now: rustls_pki_types::UnixTime,
) -> Result<ServerCertVerified, rustls::Error> {
Ok(ServerCertVerified::assertion())
}
fn verify_tls12_signature(
&self,
_message: &[u8],
_cert: &rustls_pki_types::CertificateDer<'_>,
_dss: &rustls::DigitallySignedStruct,
) -> Result<HandshakeSignatureValid, rustls::Error> {
Ok(HandshakeSignatureValid::assertion())
}
fn verify_tls13_signature(
&self,
_message: &[u8],
_cert: &rustls_pki_types::CertificateDer<'_>,
_dss: &rustls::DigitallySignedStruct,
) -> Result<HandshakeSignatureValid, rustls::Error> {
Ok(HandshakeSignatureValid::assertion())
}
fn supported_verify_schemes(&self) -> Vec<SignatureScheme> {
vec![
SignatureScheme::RSA_PKCS1_SHA1,
SignatureScheme::ECDSA_SHA1_Legacy,
SignatureScheme::RSA_PKCS1_SHA256,
SignatureScheme::ECDSA_NISTP256_SHA256,
SignatureScheme::RSA_PKCS1_SHA384,
SignatureScheme::ECDSA_NISTP384_SHA384,
SignatureScheme::RSA_PKCS1_SHA512,
SignatureScheme::ECDSA_NISTP521_SHA512,
SignatureScheme::RSA_PSS_SHA256,
SignatureScheme::RSA_PSS_SHA384,
SignatureScheme::RSA_PSS_SHA512,
SignatureScheme::ED25519,
SignatureScheme::ED448,
]
}
}