undercroft

commit bcad262a20061a0fe638397c731a96dbc19c9248
parent e729c1e3cbd08596d0f85034a4dc4bf569c61556
Author: Daniel Barlow <dan@telent.net>
Date:   Tue, 21 Apr 2026 22:22:42 +0100

verify provided client cert

Diffstat:
M
Cargo.lock
 | 
5
+++--
M
Cargo.toml
 | 
1
+
M
src/main.rs
 | 
27
++++++++++++++++++++-------

3 files changed, 24 insertions(+), 9 deletions(-)
diff --git a/Cargo.lock b/Cargo.lock
@@ -609,9 +609,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.35"
+version = "0.23.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "533f54bc6a7d4f647e46ad909549eda97bf5afc1585190ef692b4286b198bd8f"
+checksum = "69f9466fb2c14ea04357e91413efb882e2a6d4a406e625449bc0a5d360d53a21"
 dependencies = [
  "aws-lc-rs",
  "log",
@@ -751,6 +751,7 @@ dependencies = [
  "hyper",
  "hyper-util",
  "log",
+ "rustls",
  "tokio",
  "tokio-rustls",
  "tower-service",
diff --git a/Cargo.toml b/Cargo.toml
@@ -13,3 +13,4 @@ tokio = { version =  "1.52.0", features = ["full"] }
 tokio-rustls = "0.26"
 tower-service = "0.3.2"
 log = "0.4.29"
+rustls = "0.23.38"
diff --git a/src/main.rs b/src/main.rs
@@ -11,6 +11,11 @@ use tokio_rustls::{
     rustls::ServerConfig,
     TlsAcceptor,
 };
+use rustls::{
+    server::WebPkiClientVerifier,
+    RootCertStore
+};
+
 use tower_service::Service;
 
 use clap::Parser;
@@ -33,7 +38,6 @@ struct Cli {
     secrets: String
 }
 
-// verify peer key was signed by ca cert
 // decrypt sops file
 // serve it
 
@@ -44,9 +48,6 @@ async fn main() {
     let port = cli.port.unwrap_or(3000);
     println!("port = {:?}", port);
 
-    // let store = load_store_from_pem(cli.ca_certificate).unwrap();
-    // let client_cert_verifier = Arc::new(AllowAnyAnonymousOrAuthenticatedClient::new(store));
-
     let private_key = PrivateKeyDer::from_pem_file(cli.key).unwrap();
 
     let certs = CertificateDer::pem_file_iter(cli.certificate)
@@ -54,11 +55,23 @@ async fn main() {
         .map(|cert| cert.unwrap())
         .collect();
 
+    let ca_cert =  CertificateDer::pem_file_iter(cli.ca_certificate)
+        .unwrap()
+        .map(|cert| cert.unwrap())
+        .next();
+
+    let mut root_cert_store = RootCertStore::empty();
+    if let Some(c) = ca_cert {
+	root_cert_store.add(c).expect("bad ca certificate");
+    };
+    let client_cert_verifier =
+	WebPkiClientVerifier::builder(root_cert_store.into())
+	.build()
+	.unwrap();
+
     let mut c =
         ServerConfig::builder()
-    //        .with_safe_defaults()
-	.with_no_client_auth()
-//        .with_client_cert_verifier(client_cert_verifier)
+        .with_client_cert_verifier(client_cert_verifier)
         .with_single_cert(certs, private_key)
         .expect("bad certificate/key");