update main example: proper ss cert check, changes in lib API

.gitignore

@@ -1 +1,2 @@
 /target
+known_hosts

Cargo.lock

@@ -17,6 +17,12 @@ version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
 
+[[package]]
+name = "autocfg"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c4b4d0bd25bd0b74681c0ad21497610ce1b7c91b1022cd21c80c6fbdd9476b0"
+
 [[package]]
 name = "backtrace"
 version = "0.3.73"
@@ -38,6 +44,12 @@ version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8c3c1a368f70d6cf7302d78f8f7093da241fb8e8807c05cc9e51a125895a6d5b"
 
+[[package]]
+name = "bitflags"
+version = "2.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b048fb63fd8b5923fc5aa7b340d8e156aec7ec02f0c78fa8a6ddc2613f6f71de"
+
 [[package]]
 name = "block-buffer"
 version = "0.10.4"
@@ -74,6 +86,12 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22ec99545bb0ed0ea7bb9b8e1e9122ea386ff8a48c0922e43f36d45ab09e0e80"
+
 [[package]]
 name = "crypto-common"
 version = "0.1.6"
@@ -84,6 +102,20 @@ dependencies = [
  "typenum",
 ]
 
+[[package]]
+name = "dashmap"
+version = "6.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "804c8821570c3f8b70230c2ba75ffa5c0f9a4189b9a432b6656c536712acae28"
+dependencies = [
+ "cfg-if",
+ "crossbeam-utils",
+ "hashbrown",
+ "lock_api",
+ "once_cell",
+ "parking_lot_core",
+]
+
 [[package]]
 name = "digest"
 version = "0.10.7"
@@ -174,6 +206,16 @@ version = "0.2.155"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "97b3888a4aecf77e811145cadf6eef5901f4782c53886191b2f693f24761847c"
 
+[[package]]
+name = "lock_api"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07af8b9cdd281b7915f413fa73f29ebd5d55d0d3f0155584dade1ff18cea1b17"
+dependencies = [
+ "autocfg",
+ "scopeguard",
+]
+
 [[package]]
 name = "memchr"
 version = "2.7.4"
@@ -243,6 +285,19 @@ version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
 
+[[package]]
+name = "parking_lot_core"
+version = "0.9.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e401f977ab385c9e4e3ab30627d6f26d00e2c73eef317493c4ec6d468726cf8"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "windows-targets",
+]
+
 [[package]]
 name = "percent-encoding"
 version = "2.3.1"
@@ -282,6 +337,15 @@ dependencies = [
  "proc-macro2",
 ]
 
+[[package]]
+name = "redox_syscall"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a908a6e00f1fdd0dfd9c0eb08ce85126f6d8bbda50017e74bc4a4b7d4a926a4"
+dependencies = [
+ "bitflags",
+]
+
 [[package]]
 name = "ring"
 version = "0.17.8"
@@ -334,6 +398,12 @@ dependencies = [
  "untrusted",
 ]
 
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
 [[package]]
 name = "sha2"
 version = "0.10.8"
@@ -345,6 +415,12 @@ dependencies = [
  "digest",
 ]
 
+[[package]]
+name = "smallvec"
+version = "1.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
+
 [[package]]
 name = "socket2"
 version = "0.5.7"
@@ -415,6 +491,7 @@ version = "0.2.0"
 dependencies = [
  "base64ct",
  "bytes",
+ "dashmap",
  "mime",
  "num_enum",
  "sha2",

Cargo.toml

@@ -25,4 +25,5 @@ name = "main"
 path = "examples/main.rs"
 
 [dev-dependencies]
+dashmap = "6.0.1"
 tokio = { version = "1.39.2", features = ["macros", "rt-multi-thread", "io-util", "fs"] }

examples/main.rs

@@ -1,7 +1,11 @@
-use tokio::io::{AsyncReadExt, AsyncWriteExt};
+use std::{io::Write, os::fd::AsFd, sync::Mutex};
-use tokio_rustls::rustls::{
+
-    client::danger::{HandshakeSignatureValid, ServerCertVerified, ServerCertVerifier},
+use dashmap::DashMap;
-    ClientConfig, SignatureScheme,
+use tokio::io::AsyncBufReadExt;
+use tokio_gemini::certs::{
+    fingerprint::{self, generate_fingerprint},
+    insecure::AllowAllCertVerifier,
+    verifier::{SelfsignedCert, SelfsignedCertVerifier},
 };
 
 #[tokio::main]
@@ -22,91 +26,175 @@ async fn main() -> Result<(), tokio_gemini::LibError> {
     }
 
     let client = if insecure {
-        tokio_gemini::Client::from(get_insecure_config())
+        tokio_gemini::Client::builder()
+            .with_custom_verifier(AllowAllCertVerifier::yes_i_know_what_i_am_doing())
+            .build()
     } else {
-        tokio_gemini::Client::default()
+        tokio_gemini::Client::builder()
+            .with_webpki_roots() // TODO: do we really need them?
+            .with_selfsigned_cert_verifier(CertVerifier::init().await?)
+            .build()
     };
+
     let mut resp = client.request(&url).await?;
+
     {
         let status_code = resp.status().status_code();
         let status_num: u8 = status_code.into();
         eprintln!("{} {:?}", status_num, status_code);
     }
+
     if resp.status().reply_type() == tokio_gemini::ReplyType::Success {
         let mime = resp.mime()?;
         eprintln!("Mime: {}", mime);
-        let mut buf = [0u8, 128];
+
-        let body = resp.body();
         if mime.type_() == mime::TEXT {
-            loop {
+            println!("{}", resp.text().await?);
-                let n = body.read(&mut buf).await?;
-                if n == 0 {
-                    break;
-                }
-                print!("{}", std::str::from_utf8(&buf[..n])?);
-            }
         } else {
             eprintln!("Downloading into content.bin");
             let mut f = tokio::fs::File::create("content.bin").await?;
-            loop {
+            tokio::io::copy(&mut resp.stream(), &mut f).await?;
-                let n = body.read(&mut buf).await?;
-                if n == 0 {
-                    break;
-                }
-                f.write_all(&buf[..n]).await?;
-            }
         }
     } else {
         eprintln!("Message: {}", resp.message());
     }
+
     Ok(())
 }
 
-fn get_insecure_config() -> ClientConfig {
+struct CertVerifier {
-    ClientConfig::builder()
+    f: Mutex<std::fs::File>,
-        .dangerous()
+    map: DashMap<String, SelfsignedCert>,
-        .with_custom_certificate_verifier(std::sync::Arc::new(NoCertVerification {}))
-        .with_no_client_auth()
 }
 
-#[derive(Debug)]
+impl CertVerifier {
-struct NoCertVerification;
+    async fn init() -> Result<Self, tokio_gemini::LibError> {
+        let map = DashMap::new();
 
-impl ServerCertVerifier for NoCertVerification {
+        if tokio::fs::try_exists("known_hosts").await? {
-    fn verify_server_cert(
+            let mut f = tokio::fs::OpenOptions::new()
+                .read(true)
+                .open("known_hosts")
+                .await?;
+
+            let mut reader = tokio::io::BufReader::new(&mut f);
+
+            let mut buf = String::new();
+            loop {
+                buf.clear();
+                let n = reader.read_line(&mut buf).await?;
+                if n == 0 {
+                    break;
+                }
+
+                // Format:
+                // host <space> expires <space> hash-algo <space> fingerprint
+                // Example:
+                // dc09.ru 1722930541 sha512 dGVzdHRlc3R0ZXN0Cg
+                if let [host, expires, algo, fp] = buf
+                    .split_whitespace()
+                    .take(4)
+                    .collect::<Vec<&str>>()
+                    .as_slice()
+                {
+                    let expires = if let Ok(num) = expires.parse::<u64>() {
+                        num
+                    } else {
+                        eprintln!("Cannot parse expires = {:?} as u64", expires);
+                        continue;
+                    };
+
+                    let algo = match algo {
+                        &"sha256" => fingerprint::Algorithm::Sha256,
+                        &"sha512" => fingerprint::Algorithm::Sha512,
+                        &_ => {
+                            eprintln!("Unknown hash algorithm {:?}, skipping", algo);
+                            continue;
+                        }
+                    };
+
+                    map.insert(
+                        (*host).to_owned(),
+                        SelfsignedCert {
+                            algo,
+                            fingerprint: (*fp).to_owned(),
+                            expires,
+                        },
+                    );
+                } else {
+                    eprintln!("Cannot parse line: {:?}", buf);
+                    continue;
+                }
+            }
+        }
+
+        let f = Mutex::new(
+            std::fs::OpenOptions::new()
+                .append(true)
+                .create(true)
+                .open("known_hosts")?,
+        );
+
+        Ok(CertVerifier { f, map })
+    }
+}
+
+impl SelfsignedCertVerifier for CertVerifier {
+    fn verify(
         &self,
-        end_entity: &tokio_rustls::rustls::pki_types::CertificateDer<'_>,
+        cert: &tokio_gemini::certs::verifier::CertificateDer,
-        intermediates: &[tokio_rustls::rustls::pki_types::CertificateDer<'_>],
+        host: &str,
-        server_name: &tokio_rustls::rustls::pki_types::ServerName<'_>,
+        _now: tokio_gemini::certs::verifier::UnixTime,
-        ocsp_response: &[u8],
+    ) -> Result<bool, tokio_rustls::rustls::Error> {
-        now: tokio_rustls::rustls::pki_types::UnixTime,
+        if let Some(known_cert) = self.map.get(host) {
-    ) -> Result<ServerCertVerified, tokio_rustls::rustls::Error> {
+            // if host is found in known_hosts, compare certs
-        Ok(ServerCertVerified::assertion())
+            let this_fp = generate_fingerprint(cert, known_cert.algo);
+            if this_fp == known_cert.fingerprint {
+                // current cert hash matches known cert hash
+                eprintln!("Cert for {} matched: {}", &host, &this_fp);
+                Ok(true)
+            } else {
+                // TODO (after implementing `expires`) update cert if known is expired
+                eprintln!(
+                    "Error: certs do not match! Possibly MitM attack.\nKnown FP: {}\nGot:      {}",
+                    &known_cert.fingerprint, &this_fp,
+                );
+                Ok(false)
             }
+        } else {
+            // host is unknown, generate hash and add to known_hosts
+            let this_fp = generate_fingerprint(cert, fingerprint::Algorithm::Sha512);
+            eprintln!(
+                "Warning: updating known_hosts with cert {} for {}",
+                &this_fp, &host,
+            );
 
-    fn verify_tls12_signature(
+            (|| {
-        &self,
+                // trick with cloning file descriptor
-        message: &[u8],
+                // because we are not allowed to mutate &self
-        cert: &tokio_rustls::rustls::pki_types::CertificateDer<'_>,
+                let mut f = std::fs::File::from(
-        dss: &tokio_rustls::rustls::DigitallySignedStruct,
+                    self.f.lock().unwrap().as_fd().try_clone_to_owned().unwrap(),
-    ) -> Result<HandshakeSignatureValid, tokio_rustls::rustls::Error> {
+                );
-        Ok(HandshakeSignatureValid::assertion())
+                f.write_all(host.as_bytes())?;
-    }
+                f.write_all(b" 0 sha512 ")?; // TODO after implementing `expires`
+                f.write_all(&this_fp.as_bytes())?;
+                f.write(b"\n")?;
+                Ok::<(), std::io::Error>(())
+            })()
+            .unwrap_or_else(|e| {
+                eprintln!("Could not add cert to file: {:?}", e);
+            });
 
-    fn verify_tls13_signature(
+            self.map.insert(
-        &self,
+                host.to_owned(),
-        message: &[u8],
+                SelfsignedCert {
-        cert: &tokio_rustls::rustls::pki_types::CertificateDer<'_>,
+                    algo: fingerprint::Algorithm::Sha512,
-        dss: &tokio_rustls::rustls::DigitallySignedStruct,
+                    fingerprint: this_fp,
-    ) -> Result<HandshakeSignatureValid, tokio_rustls::rustls::Error> {
+                    expires: 0, // TODO after implementing cert parsing in tokio-gemini
-        Ok(HandshakeSignatureValid::assertion())
+                },
-    }
+            );
 
-    fn supported_verify_schemes(&self) -> Vec<tokio_rustls::rustls::SignatureScheme> {
+            Ok(true)
-        vec![
+        }
-            SignatureScheme::ECDSA_NISTP256_SHA256,
-            SignatureScheme::ECDSA_NISTP384_SHA384,
-            SignatureScheme::ECDSA_NISTP521_SHA512,
-        ]
     }
 }

src/certs/fingerprint.rs

@@ -6,15 +6,13 @@ use super::verifier::CertificateDer;
 const SHA256_B64_LEN: usize = 44; // 4 * ((256 / 8) as f64 / 3 as f64).ceil()
 const SHA512_B64_LEN: usize = 88; // 4 * ((512 / 8) as f64 / 3 as f64).ceil()
 
+#[derive(Debug, Clone, Copy)]
 pub enum Algorithm {
     Sha256,
     Sha512,
 }
 
-pub fn generate_fingerprint(
+pub fn generate_fingerprint(cert: &CertificateDer, algo: Algorithm) -> String {
-    cert: &CertificateDer,
-    algo: Algorithm,
-) -> Result<String, base64ct::InvalidLengthError> {
     match algo {
         Algorithm::Sha256 => {
             let mut hasher = Sha256::new();
@@ -23,7 +21,12 @@ pub fn generate_fingerprint(
             }
             let bin = hasher.finalize();
             let mut buf = [0; SHA256_B64_LEN];
-            Base64Unpadded::encode(&bin, &mut buf).map(|hash| hash.to_owned())
+            // Note on unwrap:
+            // Encoder returns error only if buffer length is insufficient.
+            // SHA-256 is *always* 256 bits (32 bytes),
+            // after we apply base64 formula we get 44 bytes in output including padding.
+            // See also comment near const SHA256_B64_LEN
+            Base64Unpadded::encode(&bin, &mut buf).unwrap().to_owned()
         }
         Algorithm::Sha512 => {
             let mut hasher = Sha512::new();
@@ -32,7 +35,9 @@ pub fn generate_fingerprint(
             }
             let bin = hasher.finalize();
             let mut buf = [0; SHA512_B64_LEN];
-            Base64Unpadded::encode(&bin, &mut buf).map(|hash| hash.to_owned())
+            // Same explanation for unwrap, see above
+            // SHA-512 is always 512 bits or 64 bytes
+            Base64Unpadded::encode(&bin, &mut buf).unwrap().to_owned()
         }
     }
 }

src/certs/insecure.rs

@@ -5,11 +5,11 @@ use tokio_rustls::rustls::{
 };
 
 #[derive(Debug)]
-pub struct AllowAllCertVerifier(CryptoProvider);
+pub struct AllowAllCertVerifier(std::sync::Arc<CryptoProvider>);
 
 impl AllowAllCertVerifier {
-    fn yes_i_know_what_i_am_doing(provider: CryptoProvider) -> Self {
+    pub fn yes_i_know_what_i_am_doing() -> Self {
-        AllowAllCertVerifier(provider)
+        AllowAllCertVerifier(CryptoProvider::get_default().unwrap().clone())
     }
 }
 

src/certs/verifier.rs

@@ -17,9 +17,9 @@ pub trait SelfsignedCertVerifier: Send + Sync {
 }
 
 pub struct SelfsignedCert {
-    algo: super::fingerprint::Algorithm,
+    pub algo: super::fingerprint::Algorithm,
-    fingerprint: String,
+    pub fingerprint: String,
-    expires: u64,
+    pub expires: u64,
 }
 
 pub struct CustomCertVerifier {