Disabling Server Name Verification in Rustls (Version 0.23.19)

sni.rs

use rustls::{
    client::{
        danger::{HandshakeSignatureValid, ServerCertVerified, ServerCertVerifier},
        WebPkiServerVerifier,
    },
    pki_types::{CertificateDer, ServerName, UnixTime},
    DigitallySignedStruct,
};
use std::sync::Arc;

#[derive(Debug)]
pub struct NoServerNameVerification {
    inner: Arc<WebPkiServerVerifier>,
}

impl NoServerNameVerification {
    pub fn new(inner: Arc<WebPkiServerVerifier>) -> Self {
        Self { inner }
    }
}

impl ServerCertVerifier for NoServerNameVerification {
    fn verify_server_cert(
        &self,
        _end_entity: &CertificateDer<'_>,
        _intermediates: &[CertificateDer<'_>],
        _server_name: &ServerName<'_>,
        _ocsp: &[u8],
        _now: UnixTime,
    ) -> Result<ServerCertVerified, rustls::Error> {
        match self
            .inner
            .verify_server_cert(_end_entity, _intermediates, _server_name, _ocsp, _now)
        {
            Ok(scv) => Ok(scv),
            Err(rustls::Error::InvalidCertificate(cert_error)) => {
                if let rustls::CertificateError::NotValidForName = cert_error {
                    Ok(ServerCertVerified::assertion())
                } else {
                    Err(rustls::Error::InvalidCertificate(cert_error))
                }
            }
            Err(e) => Err(e),
        }
    }

    fn verify_tls12_signature(
        &self,
        message: &[u8],
        cert: &CertificateDer<'_>,
        dss: &DigitallySignedStruct,
    ) -> Result<HandshakeSignatureValid, rustls::Error> {
        self.inner.verify_tls12_signature(message, cert, dss)
    }

    fn verify_tls13_signature(
        &self,
        message: &[u8],
        cert: &CertificateDer<'_>,
        dss: &DigitallySignedStruct,
    ) -> Result<HandshakeSignatureValid, rustls::Error> {
        self.inner.verify_tls13_signature(message, cert, dss)
    }

    fn supported_verify_schemes(&self) -> Vec<rustls::SignatureScheme> {
        self.inner.supported_verify_schemes()
    }
}

fn create_client_config() -> Result<ClientConfig, Box<dyn std::error::Error>> {
    let root_ca = {
        CertificateDer::from_pem_slice(include_bytes!("../../assets/certs/rootCA.pem"))
            .expect("cannot open CA file")
    };

    let client = {
        CertificateDer::pem_slice_iter(include_bytes!("../../assets/certs/client.pem"))
            .map(|cert| cert.map_err(|e| io::Error::new(io::ErrorKind::Other, e)))
            .collect::<Result<Vec<CertificateDer<'static>>, _>>()
            .expect("cannot open certificate file")
    };

    let client_key = {
        PrivateKeyDer::from_pem_slice(include_bytes!("../../assets/certs/client-key.pem"))
            .expect("cannot open private key file")
    };

    let mut root_store = rustls::RootCertStore::empty();
    root_store.add(root_ca)?;

    let mut config = ClientConfig::builder()
        .with_root_certificates(root_store.clone())
        .with_client_auth_cert(client, client_key)
        .unwrap();

    let inner = rustls::client::WebPkiServerVerifier::builder(Arc::new(root_store)).build()?;
    let verifier = Arc::new(sni::NoServerNameVerification::new(inner));
    config.dangerous().set_certificate_verifier(verifier);

    Ok(config)
}

// How to use
let config = create_client_config()?;
let tls = tokio_rustls::TlsConnector::from(Arc::new(config));