aprl/hai
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

awa

Browse source
This commit is contained in:
April John 2025-03-20 12:07:20 +01:00
parent 58c3ec763a
commit c4c6e17df4
6 changed files with 224 additions and 28 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

47
Cargo.lock generated
View file

@ -92,7 +92,7 @@ dependencies = [
"hashbrown 0.15.2",
"paste",
"static_assertions",
"windows",
"windows 0.58.0",
"windows-core 0.58.0",
]
@ -1874,8 +1874,10 @@ dependencies = [
"quinn",
"rcgen",
"rustls 0.23.23",
"rustls-pemfile 2.2.0",
"shadow-rs",
"tokio",
"tracing",
"trust-dns-resolver",
]
@ -1941,13 +1943,13 @@ dependencies = [
[[package]]
name = "hostname"
version = "0.3.1"
version = "0.4.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "3c731c3e10504cc8ed35cfe2f1db4c9274c3d35fa486e3b31df46f068ef3e867"
checksum = "f9c7c7c8ac16c798734b8a24560c1362120597c40d5e1459f09498f8f6c8f2ba"
dependencies = [
"cfg-if",
"libc",
"match_cfg",
"winapi",
"windows 0.52.0",
]
[[package]]
@ -2151,7 +2153,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b77d01e822461baa8409e156015a1d91735549f0f2c17691bd2d996bef238f7f"
dependencies = [
"byteorder-lite",
"quick-error 2.0.1",
"quick-error",
]
[[package]]
@ -2452,12 +2454,6 @@ dependencies = [
"libc",
]
[[package]]
name = "match_cfg"
version = "0.1.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ffbee8634e0d45d258acb448e7eaab3fce7a0a467395d4d9f228e3c1f01fb2e4"
[[package]]
name = "memchr"
version = "2.7.4"
@ -3214,12 +3210,6 @@ version = "1.0.16"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "afbdc74edc00b6f6a218ca6a5364d6226a259d4b8ea1af4a0ea063f27e179f4d"
[[package]]
name = "quick-error"
version = "1.2.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
[[package]]
name = "quick-error"
version = "2.0.1"
@ -3428,12 +3418,11 @@ checksum = "19b30a45b0cd0bcca8037f3d0dc3421eaf95327a17cad11964fb8179b4fc4832"
[[package]]
name = "resolv-conf"
version = "0.7.0"
version = "0.7.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "52e44394d2086d010551b14b53b1f24e31647570cd1deb0379e2c21b329aba00"
checksum = "48375394603e3dd4b2d64371f7148fd8c7baa2680e28741f2cb8d23b59e3d4c4"
dependencies = [
"hostname",
"quick-error 1.2.3",
]
[[package]]
@ -4970,7 +4959,7 @@ dependencies = [
"wasm-bindgen",
"web-sys",
"wgpu-types",
"windows",
"windows 0.58.0",
]
[[package]]
@ -4999,9 +4988,9 @@ dependencies = [
[[package]]
name = "widestring"
version = "1.1.0"
version = "1.2.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7219d36b6eac893fa81e84ebe06485e7dcbb616177469b142df14f1f4deb1311"
checksum = "dd7cf3379ca1aac9eea11fba24fd7e315d621f8dfe35c8d7d2be8b793726e07d"
[[package]]
name = "winapi"
@ -5034,6 +5023,16 @@ version = "0.4.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
[[package]]
name = "windows"
version = "0.52.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e48a53791691ab099e5e2ad123536d0fff50652600abaf43bbf952894110d0be"
dependencies = [
"windows-core 0.52.0",
"windows-targets 0.52.6",
]
[[package]]
name = "windows"
version = "0.58.0"

2
Cargo.toml
View file

@ -22,6 +22,8 @@ rcgen = { version = "0.13" }
rustls = { version = "0.23", features = ["prefer-post-quantum"] }
shadow-rs = "0.38"
tokio = { version = "1.43", features = ["full"] }
rustls-pemfile = "2.2.0"
tracing = "0.1.41"
trust-dns-resolver = { version = "0.23.2", features = ["tokio", "tokio-rustls", "rustls", "dns-over-rustls"] }
[build-dependencies]

122
src/main.rs
View file

@ -12,17 +12,23 @@ mod quic;
use std::fs::File;
use std::net::SocketAddr;
use std::path::{Path, PathBuf};
use std::str::FromStr;
use bunt::println;
use clap::{Parser, Subcommand};
use config::{Config, FileFormat, Source};
use log::{debug, info};
use log::{debug, error, info};
use pman::{init_process_manager, ProcessCommand, ProcessManager};
use shadow_rs::shadow;
use std::sync::{Arc, Mutex, OnceLock};
use anyhow::{bail, Context};
use quinn::crypto::rustls::QuicServerConfig;
use rustls::pki_types::{CertificateDer, PrivateKeyDer, PrivatePkcs8KeyDer};
use tokio::{signal, sync::mpsc::Sender};
use trust_dns_resolver::config::{ResolverConfig, ResolverOpts};
use trust_dns_resolver::{Resolver, TokioAsyncResolver};
use crate::quic::ALPN_QUIC_HTTP;
use crate::quic::server::handle_connection;
shadow!(build);
@ -53,6 +59,29 @@ enum Commands {
#[command(about = "Start client as GUI")]
GuiClient,
Devtest,
Server {
/// file to log TLS keys to for debugging
#[clap(long = "keylog")]
keylog: bool,
/// TLS private key in PEM format
#[clap(short = 'k', long = "key", requires = "cert")]
key: Option<PathBuf>,
/// TLS certificate in PEM format
#[clap(short = 'c', long = "cert", requires = "key")]
cert: Option<PathBuf>,
/// Enable stateless retries
#[clap(long = "stateless-retry")]
stateless_retry: bool,
/// Address to listen on
#[clap(long = "listen", default_value = "[::1]:4433")]
listen: SocketAddr,
/// Client address to block
#[clap(long = "block")]
block: Option<SocketAddr>,
/// Maximum number of concurrent connections to allow
#[clap(long = "connection-limit")]
connection_limit: Option<usize>,
}
}
fn config() -> &'static Config {
@ -131,6 +160,97 @@ async fn main() -> anyhow::Result<()> {
}
}
}
Commands::Server {
keylog, key, cert, stateless_retry, listen, block, connection_limit
} => {
let (certs, key) = if let (Some(key_path), Some(cert_path)) = (&key, &cert) {
let key = std::fs::read(key_path).context("failed to read private key")?;
let key = if key_path.extension().is_some_and(|x| x == "der") {
PrivateKeyDer::Pkcs8(PrivatePkcs8KeyDer::from(key))
} else {
rustls_pemfile::private_key(&mut &*key)
.context("malformed PKCS #1 private key")?
.ok_or_else(|| anyhow::Error::msg("no private keys found"))?
};
let cert_chain = std::fs::read(cert_path).context("failed to read certificate chain")?;
let cert_chain = if cert_path.extension().is_some_and(|x| x == "der") {
vec![CertificateDer::from(cert_chain)]
} else {
rustls_pemfile::certs(&mut &*cert_chain)
.collect::<Result<_, _>>()
.context("invalid PEM-encoded certificate")?
};
(cert_chain, key)
} else {
let default_dir = dirs::data_dir().unwrap();
let path = default_dir.join("hai-server");
let cert_path = path.join("cert.der");
let key_path = path.join("key.der");
let (cert, key) = match std::fs::read(&cert_path).and_then(|x| Ok((x, std::fs::read(&key_path)?))) {
Ok((cert, key)) => (
CertificateDer::from(cert),
PrivateKeyDer::try_from(key).map_err(anyhow::Error::msg)?,
),
Err(ref e) if e.kind() == std::io::ErrorKind::NotFound => {
info!("generating self-signed certificate");
let cert = rcgen::generate_simple_self_signed(vec!["localhost".into()]).unwrap();
let key = PrivatePkcs8KeyDer::from(cert.key_pair.serialize_der());
let cert = cert.cert.into();
std::fs::create_dir_all(path).context("failed to create certificate directory")?;
std::fs::write(&cert_path, &cert).context("failed to write certificate")?;
std::fs::write(&key_path, key.secret_pkcs8_der())
.context("failed to write private key")?;
(cert, key.into())
}
Err(e) => {
bail!("failed to read certificate: {}", e);
}
};
(vec![cert], key)
};
let mut server_crypto = rustls::ServerConfig::builder()
//TODO change to auth
.with_no_client_auth()
.with_single_cert(certs, key)?;
server_crypto.alpn_protocols = ALPN_QUIC_HTTP.iter().map(|&x| x.into()).collect();
if keylog {
server_crypto.key_log = Arc::new(rustls::KeyLogFile::new());
}
let mut server_config =
quinn::ServerConfig::with_crypto(Arc::new(QuicServerConfig::try_from(server_crypto)?));
let transport_config = Arc::get_mut(&mut server_config.transport).unwrap();
transport_config.max_concurrent_uni_streams(0_u8.into());
let endpoint = quinn::Endpoint::server(server_config, listen)?;
eprintln!("listening on {}", endpoint.local_addr()?);
while let Some(conn) = endpoint.accept().await {
if connection_limit
.is_some_and(|n| endpoint.open_connections() >= n)
{
info!("refusing due to open connection limit");
conn.refuse();
} else if Some(conn.remote_address()) == block {
info!("refusing blocked client IP address");
conn.refuse();
} else if stateless_retry && !conn.remote_address_validated() {
info!("requiring connection to validate its address");
conn.retry().unwrap();
} else {
info!("accepting connection");
let fut = handle_connection(conn);
tokio::spawn(async move {
if let Err(e) = fut.await {
error!("connection failed: {reason}", reason = e.to_string())
}
});
}
}
}
};
//handling anything here for gui wont work

4
src/quic/client.rs
View file

@ -11,7 +11,7 @@ use rustls::pki_types::CertificateDer;
/// - server_certs: a list of trusted certificates in DER format.
fn configure_client(
server_certs: Option<&[&[u8]]>,
) -> Result<ClientConfig, Box<dyn Error + Send + Sync + 'static>> {
) -> anyhow::Result<ClientConfig> {
if let Some(server_certs) = server_certs {
let mut certs = rustls::RootCertStore::empty();
for cert in server_certs {
@ -33,7 +33,7 @@ fn configure_client(
pub fn make_client_endpoint(
bind_addr: SocketAddr,
server_certs: Option<&[&[u8]]>,
) -> Result<Endpoint, Box<dyn Error + Send + Sync + 'static>> {
) -> anyhow::Result<Endpoint> {
let client_cfg = configure_client(server_certs)?;
let mut endpoint = Endpoint::client(bind_addr)?;
endpoint.set_default_client_config(client_cfg);

4
src/quic/mod.rs
View file

@ -1,2 +1,4 @@
pub(crate) mod server;
pub(crate) mod client;
pub(crate) mod client;
pub const ALPN_QUIC_HTTP: &[&[u8]] = &[b"hq-29"];

73
src/quic/server.rs
View file

@ -1,9 +1,13 @@
use std::error::Error;
use std::fmt::Debug;
use std::net::SocketAddr;
use std::sync::Arc;
use anyhow::anyhow;
use log::{error, info};
use quinn::{Endpoint, ServerConfig};
use rustls::pki_types::{CertificateDer, PrivatePkcs8KeyDer};
use rustls::pki_types::pem::PemObject;
use tracing::{info_span, Instrument};
/// Constructs a QUIC endpoint configured to listen for incoming connections on a certain address
/// and port.
@ -45,4 +49,73 @@ fn configure_server(
transport_config.max_concurrent_uni_streams(0_u8.into());
Ok((server_config, cert_der))
}
pub async fn handle_connection(conn: quinn::Incoming) -> anyhow::Result<()> {
let connection = conn.await?;
let span = info_span!(
"connection",
remote = %connection.remote_address(),
protocol = %connection
.handshake_data()
.unwrap()
.downcast::<quinn::crypto::rustls::HandshakeData>().unwrap()
.protocol
.map_or_else(|| "<none>".into(), |x| String::from_utf8_lossy(&x).into_owned())
);
async {
info!("established");
// Each stream initiated by the client constitutes a new request.
loop {
let stream = connection.accept_bi().await;
let stream = match stream {
Err(quinn::ConnectionError::ApplicationClosed { .. }) => {
info!("connection closed");
return Ok(());
}
Err(e) => {
return Err(e);
}
Ok(s) => s,
};
let fut = handle_request(stream);
tokio::spawn(
async move {
if let Err(e) = fut.await {
error!("failed: {reason}", reason = e.to_string());
}
}
.instrument(info_span!("request")),
);
}
}
.instrument(span)
.await?;
Ok(())
}
async fn handle_request(
(mut send, mut recv): (quinn::SendStream, quinn::RecvStream),
) -> anyhow::Result<()> {
let req = recv
.read_to_end(64 * 1024)
.await
.map_err(|e| anyhow!("failed reading request: {}", e))?;
let mut escaped = String::new();
for &x in &req[..] {
let part = std::ascii::escape_default(x).collect::<Vec<_>>();
escaped.push_str(std::str::from_utf8(&part)?);
}
tracing::info!(content = %escaped);
// Execute the request
let resp = "Hello World {}";
// Write the response
send.write_all(&resp.as_bytes())
.await
.map_err(|e| anyhow!("failed to send response: {}", e))?;
// Gracefully terminate the stream
send.finish()?;
info!("complete");
Ok(())
}