diff options
| -rw-r--r-- | mullvad-api/src/tls_stream.rs | 58 |
1 files changed, 57 insertions, 1 deletions
diff --git a/mullvad-api/src/tls_stream.rs b/mullvad-api/src/tls_stream.rs index b36de484e8..38aa518f38 100644 --- a/mullvad-api/src/tls_stream.rs +++ b/mullvad-api/src/tls_stream.rs @@ -7,6 +7,9 @@ use std::{ }; use hyper_util::client::legacy::connect::{Connected, Connection}; +use rustls::client::danger::{HandshakeSignatureValid, ServerCertVerified, ServerCertVerifier}; +use rustls::pki_types::{CertificateDer, UnixTime}; +use rustls::{DigitallySignedStruct, Error, SignatureScheme}; use std::sync::LazyLock; use tokio::io::{AsyncRead, AsyncWrite, ReadBuf}; use tokio_rustls::{ @@ -31,7 +34,8 @@ where )) .with_protocol_versions(&[&rustls::version::TLS13]) .expect("ring crypt-prover should support TLS 1.3") - .with_root_certificates(read_cert_store()) + .dangerous() + .with_custom_certificate_verifier(Arc::new(NoCertificateVerification {})) .with_no_client_auth(); Arc::new(config) }); @@ -54,6 +58,58 @@ where } } +#[derive(Debug)] +pub struct NoCertificateVerification {} + +impl ServerCertVerifier for NoCertificateVerification { + fn verify_server_cert( + &self, + end_entity: &CertificateDer<'_>, + intermediates: &[CertificateDer<'_>], + server_name: &ServerName<'_>, + ocsp_response: &[u8], + now: UnixTime, + ) -> Result<ServerCertVerified, Error> { + Ok(ServerCertVerified::assertion()) + } + + fn verify_tls12_signature( + &self, + message: &[u8], + cert: &CertificateDer<'_>, + dss: &DigitallySignedStruct, + ) -> Result<HandshakeSignatureValid, Error> { + Ok(HandshakeSignatureValid::assertion()) + } + + fn verify_tls13_signature( + &self, + message: &[u8], + cert: &CertificateDer<'_>, + dss: &DigitallySignedStruct, + ) -> Result<HandshakeSignatureValid, Error> { + Ok(HandshakeSignatureValid::assertion()) + } + + fn supported_verify_schemes(&self) -> Vec<SignatureScheme> { + vec![ + SignatureScheme::RSA_PKCS1_SHA1, + SignatureScheme::ECDSA_SHA1_Legacy, + SignatureScheme::RSA_PKCS1_SHA256, + SignatureScheme::ECDSA_NISTP256_SHA256, + SignatureScheme::RSA_PKCS1_SHA384, + SignatureScheme::ECDSA_NISTP384_SHA384, + SignatureScheme::RSA_PKCS1_SHA512, + SignatureScheme::ECDSA_NISTP521_SHA512, + SignatureScheme::RSA_PSS_SHA256, + SignatureScheme::RSA_PSS_SHA384, + SignatureScheme::RSA_PSS_SHA512, + SignatureScheme::ED25519, + SignatureScheme::ED448, + ] + } +} + fn read_cert_store() -> rustls::RootCertStore { let mut cert_store = rustls::RootCertStore::empty(); |