1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
|
//! mTLS test client
use std::sync::Arc;
use packet_detector::tls_util::LoggingVerifier;
use rustls::pki_types::{CertificateDer, PrivateKeyDer, ServerName};
use rustls::version::TLS12;
use rustls::ClientConfig;
use tokio::io::{AsyncReadExt, AsyncWriteExt};
use tokio::net::TcpStream;
use tokio_rustls::TlsConnector;
const CERT: &str = "client_cert.pem";
const KEY: &str = "client_key.pem";
fn load_creds() -> Result<(Vec<CertificateDer<'static>>, PrivateKeyDer<'static>), Box<dyn std::error::Error>> {
let cert_pem = std::fs::read_to_string(CERT)?;
let key_pem = std::fs::read_to_string(KEY)?;
let certs = rustls_pemfile::certs(&mut cert_pem.as_bytes()).collect::<Result<Vec<_>, _>>()?;
let key = rustls_pemfile::private_key(&mut key_pem.as_bytes())?.ok_or("No key")?;
Ok((certs, key))
}
#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
rustls::crypto::ring::default_provider().install_default().ok();
let host = std::env::args().nth(1).unwrap_or_else(|| "127.0.0.1".into());
let port: u16 = std::env::args().nth(2).and_then(|s| s.parse().ok()).unwrap_or(8443);
let (certs, key) = load_creds()?;
println!("Connecting to {}:{} with client cert", host, port);
let config = ClientConfig::builder_with_protocol_versions(&[&TLS12])
.dangerous()
.with_custom_certificate_verifier(Arc::new(LoggingVerifier))
.with_client_auth_cert(certs, key)?;
let stream = TcpStream::connect(format!("{}:{}", host, port)).await?;
let mut tls = TlsConnector::from(Arc::new(config))
.connect(ServerName::try_from(host.clone())?, stream).await?;
println!("TLS handshake complete!");
let req = format!("GET / HTTP/1.1\r\nHost: {}\r\nConnection: close\r\n\r\n", host);
tls.write_all(req.as_bytes()).await?;
let mut resp = Vec::new();
tls.read_to_end(&mut resp).await?;
println!("\n{}", String::from_utf8_lossy(&resp));
Ok(())
}
|
