88 lines
2.8 KiB
Rust
88 lines
2.8 KiB
Rust
/*
|
|
* SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <hello@stalw.art>
|
|
*
|
|
* SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
|
|
*/
|
|
|
|
use rustls::{
|
|
ClientConfig, SignatureScheme,
|
|
client::danger::{HandshakeSignatureValid, ServerCertVerified, ServerCertVerifier},
|
|
};
|
|
use rustls_platform_verifier::BuilderVerifierExt;
|
|
use std::sync::Arc;
|
|
use tokio_rustls::TlsConnector;
|
|
|
|
pub fn rustls_client_config(allow_invalid_certs: bool) -> Result<ClientConfig, String> {
|
|
let config = ClientConfig::builder();
|
|
|
|
if !allow_invalid_certs {
|
|
config
|
|
.with_platform_verifier()
|
|
.map(|config| config.with_no_client_auth())
|
|
.map_err(|err| format!("Failed to build platform verifier: {err}"))
|
|
} else {
|
|
Ok(config
|
|
.dangerous()
|
|
.with_custom_certificate_verifier(Arc::new(DummyVerifier {}))
|
|
.with_no_client_auth())
|
|
}
|
|
}
|
|
|
|
pub fn build_tls_connector(allow_invalid_certs: bool) -> Result<TlsConnector, String> {
|
|
rustls_client_config(allow_invalid_certs)
|
|
.map(Arc::new)
|
|
.map(TlsConnector::from)
|
|
}
|
|
|
|
#[derive(Debug)]
|
|
struct DummyVerifier;
|
|
|
|
impl ServerCertVerifier for DummyVerifier {
|
|
fn verify_server_cert(
|
|
&self,
|
|
_end_entity: &rustls_pki_types::CertificateDer<'_>,
|
|
_intermediates: &[rustls_pki_types::CertificateDer<'_>],
|
|
_server_name: &rustls_pki_types::ServerName<'_>,
|
|
_ocsp_response: &[u8],
|
|
_now: rustls_pki_types::UnixTime,
|
|
) -> Result<ServerCertVerified, rustls::Error> {
|
|
Ok(ServerCertVerified::assertion())
|
|
}
|
|
|
|
fn verify_tls12_signature(
|
|
&self,
|
|
_message: &[u8],
|
|
_cert: &rustls_pki_types::CertificateDer<'_>,
|
|
_dss: &rustls::DigitallySignedStruct,
|
|
) -> Result<HandshakeSignatureValid, rustls::Error> {
|
|
Ok(HandshakeSignatureValid::assertion())
|
|
}
|
|
|
|
fn verify_tls13_signature(
|
|
&self,
|
|
_message: &[u8],
|
|
_cert: &rustls_pki_types::CertificateDer<'_>,
|
|
_dss: &rustls::DigitallySignedStruct,
|
|
) -> Result<HandshakeSignatureValid, rustls::Error> {
|
|
Ok(HandshakeSignatureValid::assertion())
|
|
}
|
|
|
|
fn supported_verify_schemes(&self) -> Vec<SignatureScheme> {
|
|
vec![
|
|
SignatureScheme::RSA_PKCS1_SHA1,
|
|
SignatureScheme::ECDSA_SHA1_Legacy,
|
|
SignatureScheme::RSA_PKCS1_SHA256,
|
|
SignatureScheme::ECDSA_NISTP256_SHA256,
|
|
SignatureScheme::RSA_PKCS1_SHA384,
|
|
SignatureScheme::ECDSA_NISTP384_SHA384,
|
|
SignatureScheme::RSA_PKCS1_SHA512,
|
|
SignatureScheme::ECDSA_NISTP521_SHA512,
|
|
SignatureScheme::RSA_PSS_SHA256,
|
|
SignatureScheme::RSA_PSS_SHA384,
|
|
SignatureScheme::RSA_PSS_SHA512,
|
|
SignatureScheme::ED25519,
|
|
SignatureScheme::ED448,
|
|
]
|
|
}
|
|
}
|