Skip to content

Migrate to pki-types PEM decoder #476

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Oct 17, 2024
Merged

Migrate to pki-types PEM decoder #476

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
dd5452e
Migrate to pki-types PEM decoder
cpu Oct 17, 2024
1810c44
crypto_provider: tidy imports
cpu Oct 17, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 2 additions & 3 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 1 addition & 2 deletions Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,10 +28,9 @@ cert_compression = ["rustls/brotli", "rustls/zlib"]
[dependencies]
# Keep in sync with RUSTLS_CRATE_VERSION in build.rs
rustls = { version = "0.23.13", default-features = false, features = ["std", "tls12"] }
pki-types = { package = "rustls-pki-types", version = "1", features = ["std"] }
pki-types = { package = "rustls-pki-types", version = "1.10", features = ["std"] }
webpki = { package = "rustls-webpki", version = "0.102.0", default-features = false, features = ["std"] }
libc = "0.2"
rustls-pemfile = "2"
log = "0.4.22"
rustls-platform-verifier = "0.3"

Expand Down
78 changes: 40 additions & 38 deletions src/cipher.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,21 +1,19 @@
use libc::{c_char, size_t};
use std::ffi::{CStr, OsStr};
use std::fs::File;
use std::io::{BufReader, Cursor};
use std::ffi::CStr;
use std::marker::PhantomData;
use std::ptr::null;
use std::slice;
use std::sync::Arc;

use pki_types::{CertificateDer, CertificateRevocationListDer};
use pki_types::pem::PemObject;
use pki_types::{CertificateDer, CertificateRevocationListDer, PrivateKeyDer};
use rustls::client::danger::ServerCertVerifier;
use rustls::client::WebPkiServerVerifier;
use rustls::crypto::CryptoProvider;
use rustls::server::danger::ClientCertVerifier;
use rustls::server::WebPkiClientVerifier;
use rustls::sign::CertifiedKey;
use rustls::{DistinguishedName, RootCertStore, SupportedCipherSuite};
use rustls_pemfile::{certs, crls};
use webpki::{ExpirationPolicy, RevocationCheckDepth, UnknownStatusPolicy};

use crate::crypto_provider::{rustls_crypto_provider, rustls_signing_key};
Expand Down Expand Up @@ -167,12 +165,11 @@ impl rustls_certified_key {
Some(default_provider) => default_provider,
None => return rustls_result::NoDefaultCryptoProvider,
};
let private_key_pem = try_slice!(private_key, private_key_len);

let private_key_der =
match rustls_pemfile::private_key(&mut Cursor::new(private_key_pem)) {
Ok(Some(p)) => p,
_ => return rustls_result::PrivateKeyParseError,
match PrivateKeyDer::from_pem_slice(try_slice!(private_key, private_key_len)) {
Ok(der) => der,
Err(_) => return rustls_result::PrivateKeyParseError,
};

let private_key = match default_provider
Expand Down Expand Up @@ -228,14 +225,15 @@ impl rustls_certified_key {
certified_key_out: *mut *const rustls_certified_key,
) -> rustls_result {
ffi_panic_boundary! {
let mut cert_chain = try_slice!(cert_chain, cert_chain_len);
let cert_chain = try_slice!(cert_chain, cert_chain_len);
let signing_key = try_box_from_ptr!(signing_key);
let certified_key_out = try_ref_from_ptr_ptr!(certified_key_out);

let parsed_chain = match certs(&mut cert_chain).collect::<Result<Vec<_>, _>>() {
Ok(v) => v,
Err(_) => return rustls_result::CertificateParseError,
};
let parsed_chain =
match CertificateDer::pem_slice_iter(cert_chain).collect::<Result<Vec<_>, _>>() {
Ok(parsed_chain) => parsed_chain,
Err(_) => return rustls_result::CertificateParseError,
};

set_arc_mut_ptr(
certified_key_out,
Expand Down Expand Up @@ -389,17 +387,17 @@ impl rustls_root_cert_store_builder {
Some(b) => b,
};

let certs_der: Result<Vec<CertificateDer>, _> =
rustls_pemfile::certs(&mut Cursor::new(certs_pem)).collect();
let certs_der = match certs_der {
Ok(vv) => vv,
Err(_) => return rustls_result::CertificateParseError,
};
let certs =
match CertificateDer::pem_slice_iter(certs_pem).collect::<Result<Vec<_>, _>>() {
Ok(certs) => certs,
Err(_) => return rustls_result::CertificateParseError,
};

// We first copy into a temporary root store so we can uphold our
// API guideline that there are no partial failures or partial
// successes.
let mut new_store = RootCertStore::empty();
let (parsed, rejected) = new_store.add_parsable_certificates(certs_der);
let (parsed, rejected) = new_store.add_parsable_certificates(certs);
if strict && (rejected > 0 || parsed == 0) {
return rustls_result::CertificateParseError;
}
Expand Down Expand Up @@ -444,17 +442,15 @@ impl rustls_root_cert_store_builder {
Ok(s) => s,
Err(_) => return rustls_result::Io,
};
let filename = OsStr::new(filename);
let mut cafile = match File::open(filename) {
Ok(f) => f,

let certs = match CertificateDer::pem_file_iter(filename) {
Ok(certs) => certs,
Err(_) => return rustls_result::Io,
};

let mut bufreader = BufReader::new(&mut cafile);
let certs: Result<Vec<CertificateDer>, _> = certs(&mut bufreader).collect();
let certs = match certs {
let certs = match certs.collect::<Result<Vec<_>, _>>() {
Ok(certs) => certs,
Err(_) => return rustls_result::Io,
Err(_) => return rustls_result::CertificateParseError,
};

// We first copy into a temporary root store so we can uphold our
Expand Down Expand Up @@ -682,13 +678,16 @@ impl rustls_web_pki_client_cert_verifier_builder {
Some(v) => v,
};

let crl_pem = try_slice!(crl_pem, crl_pem_len);
let crls_der: Result<Vec<CertificateRevocationListDer>, _> =
crls(&mut Cursor::new(crl_pem)).collect();
let crls_der = match crls_der {
Ok(vv) => vv,
let crls_der = match CertificateRevocationListDer::pem_slice_iter(try_slice!(
crl_pem,
crl_pem_len
))
.collect::<Result<Vec<_>, _>>()
{
Ok(crls_der) => crls_der,
Err(_) => return rustls_result::CertificateRevocationListParseError,
};

if crls_der.is_empty() {
return rustls_result::CertificateRevocationListParseError;
}
Expand Down Expand Up @@ -993,13 +992,16 @@ impl ServerCertVerifierBuilder {
Some(v) => v,
};

let crl_pem = try_slice!(crl_pem, crl_pem_len);
let crls_der: Result<Vec<CertificateRevocationListDer>, _> =
crls(&mut Cursor::new(crl_pem)).collect();
let crls_der = match crls_der {
Ok(vv) => vv,
let crls_der = match CertificateRevocationListDer::pem_slice_iter(try_slice!(
crl_pem,
crl_pem_len
))
.collect::<Result<Vec<_>, _>>()
{
Ok(crls_der) => crls_der,
Err(_) => return rustls_result::CertificateRevocationListParseError,
};

if crls_der.is_empty() {
return rustls_result::CertificateRevocationListParseError;
}
Expand Down
12 changes: 7 additions & 5 deletions src/crypto_provider.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,10 @@
use libc::size_t;
use std::io::Cursor;
use std::slice;
use std::sync::Arc;

use libc::size_t;
use pki_types::pem::PemObject;
use pki_types::PrivateKeyDer;

#[cfg(feature = "aws-lc-rs")]
use rustls::crypto::aws_lc_rs;
#[cfg(feature = "ring")]
Expand Down Expand Up @@ -324,9 +326,9 @@ pub extern "C" fn rustls_crypto_provider_load_key(
let private_key_pem = try_slice!(private_key, private_key_len);
let signing_key_out = try_mut_from_ptr_ptr!(signing_key_out);

let private_key_der = match rustls_pemfile::private_key(&mut Cursor::new(private_key_pem)) {
Ok(Some(p)) => p,
_ => return rustls_result::PrivateKeyParseError,
let private_key_der = match PrivateKeyDer::from_pem_slice(private_key_pem) {
Ok(der) => der,
Err(_) => return rustls_result::PrivateKeyParseError,
};

let private_key = match provider.key_provider.load_private_key(private_key_der) {
Expand Down