Implement client and server connectors (4c7a5a41) · Commits · Public Repositories / Rust Openssl

openssl/src/ssl/connector.rs

0 → 100644

+329 −0

Original line number	Diff line number	Diff line
		use std::io::{Read, Write};

		use dh::Dh;
		use error::ErrorStack;
		use ssl::{self, SslMethod, SslContextBuilder, SslContext, Ssl, SSL_VERIFY_PEER, SslStream,
		HandshakeError};
		use pkey::PKey;
		use x509::X509Ref;

		// apps/dh2048.pem
		const DHPARAM_PEM: &'static str = r#"
		-----BEGIN DH PARAMETERS-----
		MIIBCAKCAQEA///////////JD9qiIWjCNMTGYouA3BzRKQJOCIpnzHQCC76mOxOb
		IlFKCHmONATd75UZs806QxswKwpt8l8UN0/hNW1tUcJF5IW1dmJefsb0TELppjft
		awv/XLb0Brft7jhr+1qJn6WunyQRfEsf5kkoZlHs5Fs9wgB8uKFjvwWY2kg2HFXT
		mmkWP6j9JM9fg2VdI9yjrZYcYvNWIIVSu57VKQdwlpZtZww1Tkq8mATxdGwIyhgh
		fDKQXkYuNs474553LBgOhgObJ4Oi7Aeij7XFXfBvTFLJ3ivL9pVYFxg5lUl86pVq
		5RXSJhiY+gUQFXKOWoqsqmj//////////wIBAg==
		-----END DH PARAMETERS-----

		These are the 2048-bit DH parameters from "More Modular Exponential
		(MODP) Diffie-Hellman groups for Internet Key Exchange (IKE)":
		https://tools.ietf.org/html/rfc3526

		See https://tools.ietf.org/html/rfc2412 for how they were generated."#;

		fn ctx(method: SslMethod) -> Result<SslContextBuilder, ErrorStack> {
		let mut ctx = try!(SslContextBuilder::new(method));

		// options to enable and cipher list lifted from libcurl
		let mut opts = ssl::SSL_OP_ALL;
		opts \|= ssl::SSL_OP_NO_TICKET;
		opts \|= ssl::SSL_OP_NO_COMPRESSION;
		opts &= !ssl::SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG;
		opts &= !ssl::SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;
		opts \|= ssl::SSL_OP_NO_SSLV2;
		opts \|= ssl::SSL_OP_NO_SSLV3;
		ctx.set_options(opts);

		Ok(ctx)
		}

		pub struct ClientConnectorBuilder(SslContextBuilder);

		impl ClientConnectorBuilder {
		pub fn tls() -> Result<ClientConnectorBuilder, ErrorStack> {
		ClientConnectorBuilder::new(SslMethod::tls())
		}

		fn new(method: SslMethod) -> Result<ClientConnectorBuilder, ErrorStack> {
		let mut ctx = try!(ctx(method));
		try!(ctx.set_default_verify_paths());
		try!(ctx.set_cipher_list("ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH"));

		Ok(ClientConnectorBuilder(ctx))
		}

		pub fn context(&self) -> &SslContextBuilder {
		&self.0
		}

		pub fn context_mut(&mut self) -> &mut SslContextBuilder {
		&mut self.0
		}

		pub fn build(self) -> ClientConnector {
		ClientConnector(self.0.build())
		}
		}

		pub struct ClientConnector(SslContext);

		impl ClientConnector {
		pub fn connect<S>(&self, domain: &str, stream: S) -> Result<SslStream<S>, HandshakeError<S>>
		where S: Read + Write
		{
		let mut ssl = try!(Ssl::new(&self.0));
		try!(ssl.set_hostname(domain));
		try!(setup_verify(&mut ssl, domain));

		ssl.connect(stream)
		}
		}

		pub struct ServerConnectorBuilder(SslContextBuilder);

		impl ServerConnectorBuilder {
		pub fn tls<I, T>(private_key: &PKey,
		certificate: &X509Ref,
		chain: I)
		-> Result<ServerConnectorBuilder, ErrorStack>
		where I: IntoIterator<Item = T>,
		T: AsRef<X509Ref>
		{
		ServerConnectorBuilder::new(SslMethod::tls(), private_key, certificate, chain)
		}

		fn new<I, T>(method: SslMethod,
		private_key: &PKey,
		certificate: &X509Ref,
		chain: I)
		-> Result<ServerConnectorBuilder, ErrorStack>
		where I: IntoIterator<Item = T>,
		T: AsRef<X509Ref>
		{
		let mut ctx = try!(ctx(method));
		ctx.set_options(ssl::SSL_OP_SINGLE_DH_USE \| ssl::SSL_OP_CIPHER_SERVER_PREFERENCE);
		let dh = try!(Dh::from_pem(DHPARAM_PEM.as_bytes()));
		try!(ctx.set_tmp_dh(&dh));
		try!(ctx.set_cipher_list(
		"ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:\
		ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:\
		ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:\
		DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:\
		ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:\
		ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:\
		ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:\
		DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:\
		EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:\
		AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS"));
		try!(ctx.set_private_key(private_key));
		try!(ctx.set_certificate(certificate));
		try!(ctx.check_private_key());
		for cert in chain {
		try!(ctx.add_extra_chain_cert(cert.as_ref().to_owned()));
		}
		Ok(ServerConnectorBuilder(ctx))
		}

		pub fn context(&self) -> &SslContextBuilder {
		&self.0
		}

		pub fn context_mut(&mut self) -> &mut SslContextBuilder {
		&mut self.0
		}

		pub fn build(self) -> ServerConnector {
		ServerConnector(self.0.build())
		}
		}

		pub struct ServerConnector(SslContext);

		impl ServerConnector {
		pub fn connect<S>(&self, stream: S) -> Result<SslStream<S>, HandshakeError<S>>
		where S: Read + Write
		{
		let ssl = try!(Ssl::new(&self.0));
		ssl.accept(stream)
		}
		}

		#[cfg(any(ossl102, ossl110))]
		fn setup_verify(ssl: &mut Ssl, domain: &str) -> Result<(), ErrorStack> {
		ssl.set_verify(SSL_VERIFY_PEER);
		let param = ssl._param_mut();
		param.set_hostflags(::verify::X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
		param.set_host(domain)
		}

		#[cfg(not(any(ossl102, ossl110)))]
		fn setup_verify(ssl: &mut Ssl, domain: &str) -> Result<(), ErrorStack> {
		let domain = domain.to_owned();
		ssl.set_verify_callback(SSL_VERIFY_PEER, move \|p, x\| verify::verify_callback(&domain, p, x));
		Ok(())
		}

		#[cfg(not(any(ossl102, ossl110)))]
		mod verify {
		use std::net::IpAddr;

		use nid;
		use x509::{X509StoreContextRef, X509Ref, GeneralNames, X509NameRef};

		pub fn verify_callback(domain: &str,
		preverify_ok: bool,
		x509_ctx: &X509StoreContextRef)
		-> bool {
		if !preverify_ok \|\| x509_ctx.error_depth() != 0 {
		return preverify_ok;
		}

		match x509_ctx.current_cert() {
		Some(x509) => verify_hostname(domain, &x509),
		None => true,
		}
		}

		fn verify_hostname(domain: &str, cert: &X509Ref) -> bool {
		match cert.subject_alt_names() {
		Some(names) => verify_subject_alt_names(domain, &names),
		None => verify_subject_name(domain, &cert.subject_name()),
		}
		}

		fn verify_subject_alt_names(domain: &str, names: &GeneralNames) -> bool {
		let ip = domain.parse();

		for name in names {
		match ip {
		Ok(ip) => {
		if let Some(actual) = name.ipaddress() {
		if matches_ip(&ip, actual) {
		return true;
		}
		}
		}
		Err(_) => {
		if let Some(pattern) = name.dnsname() {
		if matches_dns(pattern, domain, false) {
		return true;
		}
		}
		}
		}
		}

		false
		}

		fn verify_subject_name(domain: &str, subject_name: &X509NameRef) -> bool {
		if let Some(pattern) = subject_name.text_by_nid(nid::COMMONNAME) {
		// Unlike with SANs, IP addresses in the subject name don't have a
		// different encoding. We need to pass this down to matches_dns to
		// disallow wildcard matches with bogus patterns like *.0.0.1
		let is_ip = domain.parse::<IpAddr>().is_ok();

		if matches_dns(&pattern, domain, is_ip) {
		return true;
		}
		}

		false
		}

		fn matches_dns(mut pattern: &str, mut hostname: &str, is_ip: bool) -> bool {
		// first strip trailing . off of pattern and hostname to normalize
		if pattern.ends_with('.') {
		pattern = &pattern[..pattern.len() - 1];
		}
		if hostname.ends_with('.') {
		hostname = &hostname[..hostname.len() - 1];
		}

		matches_wildcard(pattern, hostname, is_ip).unwrap_or_else(\|\| pattern == hostname)
		}

		fn matches_wildcard(pattern: &str, hostname: &str, is_ip: bool) -> Option<bool> {
		// IP addresses and internationalized domains can't involved in wildcards
		if is_ip \|\| pattern.starts_with("xn--") {
		return None;
		}

		let wildcard_location = match pattern.find('*') {
		Some(l) => l,
		None => return None,
		};

		let mut dot_idxs = pattern.match_indices('.').map(\|(l, _)\| l);
		let wildcard_end = match dot_idxs.next() {
		Some(l) => l,
		None => return None,
		};

		// Never match wildcards if the pattern has less than 2 '.'s (no *.com)
		//
		// This is a bit dubious, as it doesn't disallow other TLDs like *.co.uk.
		// Chrome has a black- and white-list for this, but Firefox (via NSS) does
		// the same thing we do here.
		//
		// The Public Suffix (https://www.publicsuffix.org/) list could
		// potentically be used here, but it's both huge and updated frequently
		// enough that management would be a PITA.
		if dot_idxs.next().is_none() {
		return None;
		}

		// Wildcards can only be in the first component
		if wildcard_location > wildcard_end {
		return None;
		}

		let hostname_label_end = match hostname.find('.') {
		Some(l) => l,
		None => return None,
		};

		// check that the non-wildcard parts are identical
		if pattern[wildcard_end..] != hostname[hostname_label_end..] {
		return Some(false);
		}

		let wildcard_prefix = &pattern[..wildcard_location];
		let wildcard_suffix = &pattern[wildcard_location + 1..wildcard_end];

		let hostname_label = &hostname[..hostname_label_end];

		// check the prefix of the first label
		if !hostname_label.starts_with(wildcard_prefix) {
		return Some(false);
		}

		// and the suffix
		if !hostname_label[wildcard_prefix.len()..].ends_with(wildcard_suffix) {
		return Some(false);
		}

		Some(true)
		}

		fn matches_ip(expected: &IpAddr, actual: &[u8]) -> bool {
		match (expected, actual.len()) {
		(&IpAddr::V4(ref addr), 4) => actual == addr.octets(),
		(&IpAddr::V6(ref addr), 16) => {
		let segments = [((actual[0] as u16) << 8) \| actual[1] as u16,
		((actual[2] as u16) << 8) \| actual[3] as u16,
		((actual[4] as u16) << 8) \| actual[5] as u16,
		((actual[6] as u16) << 8) \| actual[7] as u16,
		((actual[8] as u16) << 8) \| actual[9] as u16,
		((actual[10] as u16) << 8) \| actual[11] as u16,
		((actual[12] as u16) << 8) \| actual[13] as u16,
		((actual[14] as u16) << 8) \| actual[15] as u16];
		segments == addr.segments()
		}
		_ => false,
		}
		}
		}

openssl/src/ssl/mod.rs

+21 −2

Original line number	Diff line number	Diff line
		@@ -22,19 +22,22 @@ use ffi;
		use {init, cvt, cvt_p};
		use dh::Dh;
		use x509::{X509StoreContextRef, X509FileType, X509, X509Ref, X509VerifyError};
		#[cfg(any(all(feature = "v102", ossl102), all(feature = "v110", ossl110)))]
		use x509::verify::X509VerifyParamRef;
		#[cfg(any(ossl102, ossl110))]
		use verify::X509VerifyParamRef;
		use pkey::PKey;
		use error::ErrorStack;
		use opaque::Opaque;

		pub mod error;
		mod connector;
		mod bio;
		#[cfg(test)]
		mod tests;

		use self::bio::BioMethod;

		pub use ssl::connector::{ClientConnectorBuilder, ClientConnector, ServerConnectorBuilder,
		ServerConnector};
		#[doc(inline)]
		pub use ssl::error::Error;

		@@ -1030,6 +1033,11 @@ impl SslRef {
		/// Requires the `v102` or `v110` features and OpenSSL 1.0.2 or 1.1.0.
		#[cfg(any(all(feature = "v102", ossl102), all(feature = "v110", ossl110)))]
		pub fn param_mut(&mut self) -> &mut X509VerifyParamRef {
		self._param_mut()
		}

		#[cfg(any(ossl102, ossl110))]
		fn _param_mut(&mut self) -> &mut X509VerifyParamRef {
		unsafe {
		X509VerifyParamRef::from_ptr_mut(ffi::SSL_get0_param(self.as_ptr()))
		}
		@@ -1153,6 +1161,8 @@ impl Ssl {
		/// An error or intermediate state after a TLS handshake attempt.
		#[derive(Debug)]
		pub enum HandshakeError<S> {
		/// Setup failed.
		SetupFailure(ErrorStack),
		/// The handshake failed.
		Failure(MidHandshakeSslStream<S>),
		/// The handshake was interrupted midway through.
		@@ -1162,6 +1172,7 @@ pub enum HandshakeError<S> {
		impl<S: Any + fmt::Debug> stderror::Error for HandshakeError<S> {
		fn description(&self) -> &str {
		match *self {
		HandshakeError::SetupFailure(_) => "stream setup failed",
		HandshakeError::Failure(_) => "the handshake failed",
		HandshakeError::Interrupted(_) => "the handshake was interrupted",
		}
		@@ -1169,6 +1180,7 @@ impl<S: Any + fmt::Debug> stderror::Error for HandshakeError<S> {

		fn cause(&self) -> Option<&stderror::Error> {
		match *self {
		HandshakeError::SetupFailure(ref e) => Some(e),
		HandshakeError::Failure(ref s) \| HandshakeError::Interrupted(ref s) => Some(s.error()),
		}
		}
		@@ -1178,6 +1190,7 @@ impl<S: Any + fmt::Debug> fmt::Display for HandshakeError<S> {
		fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
		try!(f.write_str(stderror::Error::description(self)));
		match *self {
		HandshakeError::SetupFailure(ref e) => try!(write!(f, ": {}", e)),
		HandshakeError::Failure(ref s) \| HandshakeError::Interrupted(ref s) => {
		try!(write!(f, ": {}", s.error()));
		if let Some(err) = s.ssl().verify_result() {
		@@ -1189,6 +1202,12 @@ impl<S: Any + fmt::Debug> fmt::Display for HandshakeError<S> {
		}
		}

		impl<S> From<ErrorStack> for HandshakeError<S> {
		fn from(e: ErrorStack) -> HandshakeError<S> {
		HandshakeError::SetupFailure(e)
		}
		}

		/// An SSL stream midway through the handshake process.
		#[derive(Debug)]
		pub struct MidHandshakeSslStream<S> {

openssl/src/ssl/tests/mod.rs

+62 −8

Original line number	Diff line number	Diff line
		@@ -18,8 +18,8 @@ use hash::MessageDigest;
		use ssl;
		use ssl::SSL_VERIFY_PEER;
		use ssl::{SslMethod, HandshakeError};
		use ssl::error::Error;
		use ssl::{SslContext, SslStream, Ssl, ShutdownResult};
		use ssl::{SslContext, SslStream, Ssl, ShutdownResult, ClientConnectorBuilder,
		ServerConnectorBuilder, Error};
		use x509::X509StoreContextRef;
		use x509::X509FileType;
		use x509::X509;
		@@ -31,6 +31,9 @@ use std::net::UdpSocket;

		mod select;

		static CERT: &'static [u8] = include_bytes!("../../../test/cert.pem");
		static KEY: &'static [u8] = include_bytes!("../../../test/key.pem");

		fn next_addr() -> SocketAddr {
		use std::sync::atomic::{AtomicUsize, ATOMIC_USIZE_INIT, Ordering};
		static PORT: AtomicUsize = ATOMIC_USIZE_INIT;
		@@ -46,10 +49,6 @@ struct Server {

		impl Server {
		fn spawn(args: &[&str], input: Option<Box<FnMut(ChildStdin) + Send>>) -> (Server, SocketAddr) {
		static CERT: &'static [u8] = include_bytes!("../../../test/cert.pem");
		static KEY: &'static [u8] = include_bytes!("../../../test/key.pem");


		let td = TempDir::new("openssl").unwrap();
		let cert = td.path().join("cert.pem");
		let key = td.path().join("key.pem");
		@@ -1047,7 +1046,7 @@ fn add_extra_chain_cert() {
		#[test]
		#[cfg_attr(windows, ignore)] // don't have a trusted CA list easily available :(
		#[cfg(any(all(feature = "v102", ossl102), all(feature = "v110", ossl110)))]
		fn valid_hostname() {
		fn verify_valid_hostname() {
		let mut ctx = SslContext::builder(SslMethod::tls()).unwrap();
		ctx.set_default_verify_paths().unwrap();
		ctx.set_verify(SSL_VERIFY_PEER);
		@@ -1071,7 +1070,7 @@ fn valid_hostname() {
		#[test]
		#[cfg_attr(windows, ignore)] // don't have a trusted CA list easily available :(
		#[cfg(any(all(feature = "v102", ossl102), all(feature = "v110", ossl110)))]
		fn invalid_hostname() {
		fn verify_invalid_hostname() {
		let mut ctx = SslContext::builder(SslMethod::tls()).unwrap();
		ctx.set_default_verify_paths().unwrap();
		ctx.set_verify(SSL_VERIFY_PEER);
		@@ -1084,6 +1083,61 @@ fn invalid_hostname() {
		assert!(ssl.connect(s).is_err());
		}

		#[test]
		#[cfg_attr(windows, ignore)] // don't have a trusted CA list easily available :(
		fn connector_valid_hostname() {
		let connector = ClientConnectorBuilder::tls().unwrap().build();

		let s = TcpStream::connect("google.com:443").unwrap();
		let mut socket = connector.connect("google.com", s).unwrap();

		socket.write_all(b"GET / HTTP/1.0\r\n\r\n").unwrap();
		let mut result = vec![];
		socket.read_to_end(&mut result).unwrap();

		println!("{}", String::from_utf8_lossy(&result));
		assert!(result.starts_with(b"HTTP/1.0"));
		assert!(result.ends_with(b"</HTML>\r\n") \|\| result.ends_with(b"</html>"));
		}

		#[test]
		#[cfg_attr(windows, ignore)] // don't have a trusted CA list easily available :(
		fn connector_invalid_hostname() {
		let connector = ClientConnectorBuilder::tls().unwrap().build();

		let s = TcpStream::connect("google.com:443").unwrap();
		assert!(connector.connect("foobar.com", s).is_err());
		}

		#[test]
		fn connector_client_server() {
		let listener = TcpListener::bind("127.0.0.1:0").unwrap();
		let port = listener.local_addr().unwrap().port();

		let t = thread::spawn(move \|\| {
		let key = PKey::private_key_from_pem(KEY).unwrap();
		let cert = X509::from_pem(CERT).unwrap();
		let connector = ServerConnectorBuilder::tls(&key, &cert, None::<X509>).unwrap().build();
		let stream = listener.accept().unwrap().0;
		let mut stream = connector.connect(stream).unwrap();

		stream.write_all(b"hello").unwrap();
		});

		let mut connector = ClientConnectorBuilder::tls().unwrap();
		connector.context_mut().set_CA_file("test/root-ca.pem").unwrap();
		let connector = connector.build();

		let stream = TcpStream::connect(("127.0.0.1", port)).unwrap();
		let mut stream = connector.connect("foobar.com", stream).unwrap();

		let mut buf = [0; 5];
		stream.read_exact(&mut buf).unwrap();
		assert_eq!(b"hello", &buf);

		t.join().unwrap();
		}

		#[test]
		fn shutdown() {
		let listener = TcpListener::bind("127.0.0.1:0").unwrap();

openssl/src/x509/mod.rs

+25 −4

Original line number	Diff line number	Diff line
		use libc::{c_char, c_int, c_long, c_ulong, c_void};
		use std::borrow::Borrow;
		use std::cmp;
		use std::collections::HashMap;
		use std::error::Error;
		@@ -447,6 +448,17 @@ impl X509Ref {
		}
		}

		impl ToOwned for X509Ref {
		type Owned = X509;

		fn to_owned(&self) -> X509 {
		unsafe {
		compat::X509_up_ref(self.as_ptr());
		X509::from_ptr(self.as_ptr())
		}
		}
		}

		/// An owned public key certificate.
		pub struct X509(*mut ffi::X509);

		@@ -491,10 +503,7 @@ impl Deref for X509 {

		impl Clone for X509 {
		fn clone(&self) -> X509 {
		unsafe {
		compat::X509_up_ref(self.as_ptr());
		X509::from_ptr(self.as_ptr())
		}
		self.to_owned()
		}
		}

		@@ -504,6 +513,18 @@ impl Drop for X509 {
		}
		}

		impl AsRef<X509Ref> for X509 {
		fn as_ref(&self) -> &X509Ref {
		&*self
		}
		}

		impl Borrow<X509Ref> for X509 {
		fn borrow(&self) -> &X509Ref {
		&*self
		}
		}

		pub struct X509NameRef(Opaque);

		impl X509NameRef {