tuxmain/netreplay
Watch
1
0
Fork
You've already forked netreplay
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Server: load certificate chains

Browse source
This commit is contained in:
Pascal Engélibert 2026-08-24 12:23:39 +02:00
commit 1af09f72e9
2 changed files with 37 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

10
src/record.rs
View file

@ -322,6 +322,16 @@ impl LyingCertificateRegistry {
} }
let ctx = ctx_builder.build(); let ctx = ctx_builder.build();
let mut key_file = std::fs::OpenOptions::new()
.truncate(true)
.write(true)
.create(true)
.open(PathBuf::from(&self.certs_dir).join(format!("{servername}.key")))
.unwrap();
key_file
.write_all(&new_key.private_key_to_pem_pkcs8().unwrap())
.unwrap();
let mut names: Vec<String> = new_cert let mut names: Vec<String> = new_cert
.subject_name() .subject_name()
.entries() .entries()

50
src/server.rs
View file

@ -124,6 +124,22 @@ pub async fn play(
match file { match file {
Ok(file) => { Ok(file) => {
if file.file_name().as_encoded_bytes().ends_with(b".crt") { if file.file_name().as_encoded_bytes().ends_with(b".crt") {
let mut chain = Vec::new();
let mut names = Vec::new();
let mut key_path = file.path().to_path_buf();
key_path.pop();
let file_name = file.file_name().to_str().unwrap().to_string();
let mut key_file_name = file_name[0..file_name.len() - 4].to_string();
key_file_name.push_str(".key");
let key =
PrivateKeyDer::from_pem_file(key_path.join(key_file_name)).unwrap();
let key = config
.crypto_provider()
.key_provider
.load_private_key(key)
.unwrap();
for section in for section in
<(pem::SectionKind, Vec<u8>) as PemObject>::pem_file_iter(file.path()) <(pem::SectionKind, Vec<u8>) as PemObject>::pem_file_iter(file.path())
.unwrap() .unwrap()
@ -132,29 +148,12 @@ pub async fn play(
if kind == SectionKind::Certificate { if kind == SectionKind::Certificate {
let (_rem, cert) = let (_rem, cert) =
x509_parser::parse_x509_certificate(&data).unwrap(); x509_parser::parse_x509_certificate(&data).unwrap();
if !cert.is_ca() {
//println!("File: {:?}", file.file_name()); chain.push(CertificateDer::from_slice(Box::leak(
let mut key_path = file.path().to_path_buf();
key_path.pop();
let file_name = file.file_name().to_str().unwrap().to_string();
let mut key_file_name =
file_name[0..file_name.len() - 4].to_string();
key_file_name.push_str(".key");
let key =
PrivateKeyDer::from_pem_file(key_path.join(key_file_name))
.unwrap();
let key = config
.crypto_provider()
.key_provider
.load_private_key(key)
.unwrap();
// This wants static lifetime...
let cert_key = CertifiedKey::new(
vec![CertificateDer::from_slice(Box::leak(
data.to_vec().into_boxed_slice(), data.to_vec().into_boxed_slice(),
))], )));
key,
); if !cert.is_ca() {
for name in cert for name in cert
.subject_alternative_name() .subject_alternative_name()
.unwrap() .unwrap()
@ -167,12 +166,17 @@ pub async fn play(
println!("Add name to resolver: {:?}", name); println!("Add name to resolver: {:?}", name);
} }
if let GeneralName::DNSName(name) = name { if let GeneralName::DNSName(name) = name {
resolver.add(name, cert_key.clone()).unwrap(); names.push(name.to_string());
} }
} }
} }
} }
} }
let cert_key = CertifiedKey::new(chain, key);
for name in names {
resolver.add(&name, cert_key.clone()).unwrap();
}
} }
} }
Err(e) => eprintln!("Error listing cert directory: {e:?}"), Err(e) => eprintln!("Error listing cert directory: {e:?}"),