Skip to content

Commit 01807f9

Browse files
ancwrd1ancwrd1
committed
Updated to latest rustls head
1 parent f4a4f27 commit 01807f9

File tree

9 files changed

+82
-70
lines changed

9 files changed

+82
-70
lines changed

‎examples/client.rs‎

Lines changed: 7 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,9 @@ use std::{
77

88
use clap::Parser;
99
use rustls::{
10-
client::ResolvesClientCert, sign::CertifiedKey, ClientConfig, ClientConnection, RootCertStore,
11-
SignatureScheme, Stream,
10+
ClientConfig, ClientConnection, RootCertStore, SignatureScheme, Stream,
11+
client::ResolvesClientCert,
12+
sign::{CertifiedKey, CertifiedSigner},
1213
};
1314
use rustls_pki_types::{CertificateDer, ServerName};
1415

@@ -49,20 +50,15 @@ impl ResolvesClientCert for ClientCertResolver {
4950
&self,
5051
_acceptable_issuers: &[&[u8]],
5152
sigschemes: &[SignatureScheme],
52-
) -> Option<Arc<CertifiedKey>> {
53+
) -> Option<CertifiedSigner> {
5354
println!("Server sig schemes: {sigschemes:#?}");
5455
let (chain, signing_key) = get_chain(&self.store, &self.cert_name).ok()?;
5556
if let Some(ref pin) = self.pin {
5657
signing_key.key().set_pin(pin).ok()?;
5758
}
58-
for scheme in signing_key.supported_schemes() {
59-
if sigschemes.contains(scheme) {
60-
return CertifiedKey::new(chain, Arc::new(signing_key))
61-
.ok()
62-
.map(Arc::new);
63-
}
64-
}
65-
None
59+
CertifiedKey::new(chain.into(), Box::new(signing_key))
60+
.ok()?
61+
.signer(sigschemes)
6662
}
6763

6864
fn has_certs(&self) -> bool {

‎examples/server.rs‎

Lines changed: 27 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,8 @@ use clap::Parser;
99
use rustls::{
1010
RootCertStore, ServerConfig, ServerConnection, Stream,
1111
server::{ClientHello, ResolvesServerCert, WebPkiClientVerifier},
12-
sign::CertifiedKey,
12+
sign::{CertifiedKey, CertifiedSigner},
1313
};
14-
1514
use rustls_cng::{
1615
signer::CngSigningKey,
1716
store::{CertStore, CertStoreType},
@@ -54,31 +53,39 @@ pub struct ServerCertResolver {
5453
}
5554

5655
impl ResolvesServerCert for ServerCertResolver {
57-
fn resolve(&self, client_hello: &ClientHello) -> Option<Arc<CertifiedKey>> {
56+
fn resolve(&self, client_hello: &ClientHello) -> Result<CertifiedSigner, rustls::Error> {
5857
println!("Client hello server name: {:?}", client_hello.server_name());
59-
let name = client_hello.server_name()?;
60-
61-
// look up certificate by subject
62-
let contexts = self.store.find_by_subject_str(name).ok()?;
63-
64-
// attempt to acquire a private key and construct CngSigningKey
65-
let (context, key) = contexts.into_iter().find_map(|ctx| {
66-
let key = ctx.acquire_key(true).ok()?;
67-
if let Some(ref pin) = self.pin {
68-
key.set_pin(pin).ok()?;
69-
}
70-
CngSigningKey::new(key).ok().map(|key| (ctx, key))
71-
})?;
58+
let name = client_hello
59+
.server_name()
60+
.ok_or_else(|| rustls::Error::NoSuitableCertificate)?;
61+
62+
let contexts = self
63+
.store
64+
.find_by_subject_str(name)
65+
.map_err(|_| rustls::Error::NoSuitableCertificate)?;
66+
67+
let (context, key) = contexts
68+
.into_iter()
69+
.find_map(|ctx| {
70+
let key = ctx.acquire_key(true).ok()?;
71+
if let Some(ref pin) = self.pin {
72+
key.set_pin(pin).ok()?;
73+
}
74+
CngSigningKey::new(key).ok().map(|key| (ctx, key))
75+
})
76+
.ok_or_else(|| rustls::Error::NoSuitableCertificate)?;
7277

7378
println!("Key alg group: {:?}", key.key().algorithm_group());
7479
println!("Key alg: {:?}", key.key().algorithm());
7580

76-
// attempt to acquire a full certificate chain
77-
let chain = context.as_chain_der().ok()?;
81+
let chain = context
82+
.as_chain_der()
83+
.map_err(|_| rustls::Error::NoSuitableCertificate)?;
7884
let certs = chain.into_iter().map(Into::into).collect();
7985

80-
// return CertifiedKey instance
81-
CertifiedKey::new(certs, Arc::new(key)).ok().map(Arc::new)
86+
CertifiedKey::new(certs, Box::new(key))?
87+
.signer(client_hello.signature_schemes())
88+
.ok_or_else(|| rustls::Error::General("No common schemes".to_owned()))
8289
}
8390
}
8491

‎src/cert.rs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ use std::{mem, ptr, slice, sync::Arc};
44

55
use windows_sys::Win32::Security::Cryptography::*;
66

7-
use crate::{error::CngError, key::NCryptKey, Result};
7+
use crate::{Result, error::CngError, key::NCryptKey};
88

99
const HCCE_LOCAL_MACHINE: HCERTCHAINENGINE = 0x1 as HCERTCHAINENGINE;
1010

@@ -168,8 +168,8 @@ impl CertContext {
168168
#[cfg(feature = "time")]
169169
pub fn timestamp(&self) -> Result<Option<time::UtcDateTime>> {
170170
use std::time::Duration;
171+
use windows_sys::Win32::Foundation::{CRYPT_E_NOT_FOUND, FILETIME, GetLastError};
171172
use windows_sys::core::HRESULT;
172-
use windows_sys::Win32::Foundation::{GetLastError, CRYPT_E_NOT_FOUND, FILETIME};
173173

174174
// Duration between Windows epoch (1601-01-01) and Unix epoch (1970-01-01)
175175
const WINDOWS_TO_UNIX_EPOCH: Duration = Duration::from_secs(11_644_473_600);

‎src/error.rs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@
33
use std::fmt;
44

55
use windows_sys::{
6+
Win32::Foundation::{ERROR_SUCCESS, GetLastError, WIN32_ERROR},
67
core::HRESULT,
7-
Win32::Foundation::{GetLastError, ERROR_SUCCESS, WIN32_ERROR},
88
};
99

1010
/// Errors that may be returned in this crate

‎src/key.rs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,11 @@
33
use std::{os::raw::c_void, ptr, str::FromStr, sync::Arc};
44

55
use windows_sys::{
6-
core::PCWSTR,
76
Win32::Security::{Cryptography::*, OBJECT_SECURITY_INFORMATION},
7+
core::PCWSTR,
88
};
99

10-
use crate::{error::CngError, Result};
10+
use crate::{Result, error::CngError};
1111

1212
/// Algorithm group of the CNG private key
1313
#[derive(Debug, Clone, Eq, PartialEq, PartialOrd)]

‎src/signer.rs‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,12 @@
33
use std::sync::Arc;
44

55
use rustls::{
6-
sign::{Signer, SigningKey},
76
Error, OtherError, SignatureAlgorithm, SignatureScheme,
7+
sign::{Signer, SigningKey},
88
};
99
use rustls_pki_types::SubjectPublicKeyInfoDer;
1010
use windows_sys::Win32::Security::Cryptography::{
11-
BCryptHash, BCRYPT_SHA256_ALG_HANDLE, BCRYPT_SHA384_ALG_HANDLE, BCRYPT_SHA512_ALG_HANDLE,
11+
BCRYPT_SHA256_ALG_HANDLE, BCRYPT_SHA384_ALG_HANDLE, BCRYPT_SHA512_ALG_HANDLE, BCryptHash,
1212
};
1313

1414
use crate::key::{AlgorithmGroup, NCryptKey, SignaturePadding};
@@ -158,7 +158,7 @@ impl CngSigner {
158158
}
159159

160160
impl Signer for CngSigner {
161-
fn sign(&self, message: &[u8]) -> Result<Vec<u8>, Error> {
161+
fn sign(self: Box<CngSigner>, message: &[u8]) -> Result<Vec<u8>, Error> {
162162
let (hash, padding) = self.hash(message)?;
163163
let signature = self
164164
.key
@@ -222,7 +222,9 @@ mod tests {
222222
let der = super::p1363_to_der(&p1363);
223223
assert_eq!(
224224
der,
225-
[0x30, 0x0e, 0x02, 0x05, 0, 0x81, 2, 3, 4, 0x02, 0x05, 0, 0x85, 6, 7, 8]
225+
[
226+
0x30, 0x0e, 0x02, 0x05, 0, 0x81, 2, 3, 4, 0x02, 0x05, 0, 0x85, 6, 7, 8
227+
]
226228
)
227229
}
228230
}

‎src/store.rs‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -217,7 +217,8 @@ impl CertStore {
217217
unsafe {
218218
let mut cert: *mut CERT_CONTEXT = ptr::null_mut();
219219
let hash_blob = &*(find_param as *const CRYPT_INTEGER_BLOB);
220-
let sha256_hash = std::slice::from_raw_parts(hash_blob.pbData, hash_blob.cbData as usize);
220+
let sha256_hash =
221+
std::slice::from_raw_parts(hash_blob.pbData, hash_blob.cbData as usize);
221222
loop {
222223
cert = CertFindCertificateInStore(
223224
self.0,

‎tests/test_client_server.rs‎

Lines changed: 34 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,9 @@ mod client {
1111
};
1212

1313
use rustls::{
14-
client::ResolvesClientCert, sign::CertifiedKey, ClientConfig, ClientConnection,
15-
RootCertStore, SignatureScheme, Stream,
14+
ClientConfig, ClientConnection, RootCertStore, SignatureScheme, Stream,
15+
client::ResolvesClientCert,
16+
sign::{CertifiedKey, CertifiedSigner},
1617
};
1718
use rustls_pki_types::CertificateDer;
1819

@@ -44,17 +45,11 @@ mod client {
4445
&self,
4546
_acceptable_issuers: &[&[u8]],
4647
sigschemes: &[SignatureScheme],
47-
) -> Option<Arc<CertifiedKey>> {
48+
) -> Option<CertifiedSigner> {
4849
let (chain, signing_key) = get_chain(&self.0, &self.1).ok()?;
49-
for scheme in signing_key.supported_schemes() {
50-
if sigschemes.contains(scheme) {
51-
return Some(Arc::new(CertifiedKey::new_unchecked(
52-
chain,
53-
Arc::new(signing_key),
54-
)));
55-
}
56-
}
57-
None
50+
CertifiedKey::new(chain.into(), Box::new(signing_key))
51+
.ok()?
52+
.signer(sigschemes)
5853
}
5954

6055
fn has_certs(&self) -> bool {
@@ -101,35 +96,46 @@ mod server {
10196
use std::{
10297
io::{Read, Write},
10398
net::{Shutdown, TcpListener, TcpStream},
104-
sync::{mpsc::Sender, Arc},
99+
sync::{Arc, mpsc::Sender},
105100
};
106101

107102
use rustls::{
108-
server::{ClientHello, ResolvesServerCert, WebPkiClientVerifier},
109-
sign::CertifiedKey,
110103
RootCertStore, ServerConfig, ServerConnection, Stream,
104+
server::{ClientHello, ResolvesServerCert, WebPkiClientVerifier},
105+
sign::{CertifiedKey, CertifiedSigner},
111106
};
112-
113107
use rustls_cng::{signer::CngSigningKey, store::CertStore};
114108

115109
#[derive(Debug)]
116110
pub struct ServerCertResolver(CertStore);
117111

118112
impl ResolvesServerCert for ServerCertResolver {
119-
fn resolve(&self, client_hello: &ClientHello) -> Option<Arc<CertifiedKey>> {
120-
let name = client_hello.server_name()?;
121-
122-
let contexts = self.0.find_by_subject_str(name).ok()?;
123-
124-
let (context, key) = contexts.into_iter().find_map(|ctx| {
125-
let key = ctx.acquire_key(true).ok()?;
126-
CngSigningKey::new(key).ok().map(|key| (ctx, key))
127-
})?;
128-
129-
let chain = context.as_chain_der().ok()?;
113+
fn resolve(&self, client_hello: &ClientHello) -> Result<CertifiedSigner, rustls::Error> {
114+
let name = client_hello
115+
.server_name()
116+
.ok_or_else(|| rustls::Error::NoSuitableCertificate)?;
117+
118+
let contexts = self
119+
.0
120+
.find_by_subject_str(name)
121+
.map_err(|_| rustls::Error::NoSuitableCertificate)?;
122+
123+
let (context, key) = contexts
124+
.into_iter()
125+
.find_map(|ctx| {
126+
let key = ctx.acquire_key(true).ok()?;
127+
CngSigningKey::new(key).ok().map(|key| (ctx, key))
128+
})
129+
.ok_or_else(|| rustls::Error::NoSuitableCertificate)?;
130+
131+
let chain = context
132+
.as_chain_der()
133+
.map_err(|_| rustls::Error::NoSuitableCertificate)?;
130134
let certs = chain.into_iter().map(Into::into).collect();
131135

132-
Some(Arc::new(CertifiedKey::new_unchecked(certs, Arc::new(key))))
136+
CertifiedKey::new(certs, Box::new(key))?
137+
.signer(client_hello.signature_schemes())
138+
.ok_or_else(|| rustls::Error::General("No common schemes".to_owned()))
133139
}
134140
}
135141

‎tests/test_sign.rs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
use rustls::{sign::SigningKey, SignatureAlgorithm, SignatureScheme};
1+
use rustls::{SignatureAlgorithm, SignatureScheme, sign::SigningKey};
22

33
use rustls_cng::{signer::CngSigningKey, store::CertStore};
44

0 commit comments

Comments
 (0)