From 1951b063d7ec6d6e8db8a0b5074c73f887749208 Mon Sep 17 00:00:00 2001
From: root <root@sg2.noml.ch>
Date: Mon, 29 Dec 2025 22:18:04 +0800
Subject: initial commit

---
 packet-detector/src/bin/tls_client.rs | 51 +++++++++++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)
 create mode 100644 packet-detector/src/bin/tls_client.rs

(limited to 'packet-detector/src/bin/tls_client.rs')

diff --git a/packet-detector/src/bin/tls_client.rs b/packet-detector/src/bin/tls_client.rs
new file mode 100644
index 0000000..6098172
--- /dev/null
+++ b/packet-detector/src/bin/tls_client.rs
@@ -0,0 +1,51 @@
+//! mTLS test client
+
+use std::sync::Arc;
+use packet_detector::tls_util::LoggingVerifier;
+use rustls::pki_types::{CertificateDer, PrivateKeyDer, ServerName};
+use rustls::version::TLS12;
+use rustls::ClientConfig;
+use tokio::io::{AsyncReadExt, AsyncWriteExt};
+use tokio::net::TcpStream;
+use tokio_rustls::TlsConnector;
+
+const CERT: &str = "client_cert.pem";
+const KEY: &str = "client_key.pem";
+
+fn load_creds() -> Result<(Vec<CertificateDer<'static>>, PrivateKeyDer<'static>), Box<dyn std::error::Error>> {
+    let cert_pem = std::fs::read_to_string(CERT)?;
+    let key_pem = std::fs::read_to_string(KEY)?;
+    let certs = rustls_pemfile::certs(&mut cert_pem.as_bytes()).collect::<Result<Vec<_>, _>>()?;
+    let key = rustls_pemfile::private_key(&mut key_pem.as_bytes())?.ok_or("No key")?;
+    Ok((certs, key))
+}
+
+#[tokio::main]
+async fn main() -> Result<(), Box<dyn std::error::Error>> {
+    rustls::crypto::ring::default_provider().install_default().ok();
+
+    let host = std::env::args().nth(1).unwrap_or_else(|| "127.0.0.1".into());
+    let port: u16 = std::env::args().nth(2).and_then(|s| s.parse().ok()).unwrap_or(8443);
+
+    let (certs, key) = load_creds()?;
+    println!("Connecting to {}:{} with client cert", host, port);
+
+    let config = ClientConfig::builder_with_protocol_versions(&[&TLS12])
+        .dangerous()
+        .with_custom_certificate_verifier(Arc::new(LoggingVerifier))
+        .with_client_auth_cert(certs, key)?;
+
+    let stream = TcpStream::connect(format!("{}:{}", host, port)).await?;
+    let mut tls = TlsConnector::from(Arc::new(config))
+        .connect(ServerName::try_from(host.clone())?, stream).await?;
+    println!("TLS handshake complete!");
+
+    let req = format!("GET / HTTP/1.1\r\nHost: {}\r\nConnection: close\r\n\r\n", host);
+    tls.write_all(req.as_bytes()).await?;
+
+    let mut resp = Vec::new();
+    tls.read_to_end(&mut resp).await?;
+    println!("\n{}", String::from_utf8_lossy(&resp));
+
+    Ok(())
+}
-- 
cgit v1.2.3