Support client certificates (#319)

src-tauri/yaak-http/src/client.rs

@@ -1,12 +1,12 @@
 use crate::dns::LocalhostResolver;
 use crate::error::Result;
-use crate::tls;
-use log::{debug, warn};
+use log::{debug, info, warn};
 use reqwest::redirect::Policy;
 use reqwest::{Client, Proxy};
 use reqwest_cookie_store::CookieStoreMutex;
 use std::sync::Arc;
 use std::time::Duration;
+use yaak_tls::{ClientCertificateConfig, get_tls_config};
 
 #[derive(Clone)]
 pub struct HttpConnectionProxySettingAuth {
@@ -28,11 +28,13 @@ pub enum HttpConnectionProxySetting {
 
 #[derive(Clone)]
 pub struct HttpConnectionOptions {
+    pub id: String,
     pub follow_redirects: bool,
     pub validate_certificates: bool,
     pub proxy: HttpConnectionProxySetting,
     pub cookie_provider: Option<Arc<CookieStoreMutex>>,
     pub timeout: Option<Duration>,
+    pub client_certificate: Option<ClientCertificateConfig>,
 }
 
 impl HttpConnectionOptions {
@@ -45,8 +47,10 @@ impl HttpConnectionOptions {
             .referer(false)
             .tls_info(true);
 
-        // Configure TLS
-        client = client.use_preconfigured_tls(tls::get_config(self.validate_certificates, true));
+        // Configure TLS with optional client certificate
+        let config =
+            get_tls_config(self.validate_certificates, true, self.client_certificate.clone())?;
+        client = client.use_preconfigured_tls(config);
 
         // Configure DNS resolver
         client = client.dns_resolver(LocalhostResolver::new());
@@ -85,6 +89,12 @@ impl HttpConnectionOptions {
             client = client.timeout(d);
         }
 
+        info!(
+            "Building new HTTP client validate_certificates={} client_cert={}",
+            self.validate_certificates,
+            self.client_certificate.is_some()
+        );
+
         Ok(client.build()?)
     }
 }

src-tauri/yaak-http/src/error.rs

@@ -3,8 +3,11 @@ use thiserror::Error;
 
 #[derive(Error, Debug)]
 pub enum Error {
-    #[error(transparent)]
+    #[error("Client error: {0:?}")]
     Client(#[from] reqwest::Error),
+
+    #[error(transparent)]
+    TlsError(#[from] yaak_tls::error::Error),
 }
 
 impl Serialize for Error {

src-tauri/yaak-http/src/lib.rs

@@ -7,7 +7,6 @@ pub mod dns;
 pub mod error;
 pub mod manager;
 pub mod path_placeholders;
-pub mod tls;
 
 pub fn init<R: Runtime>() -> TauriPlugin<R> {
     Builder::new("yaak-http")

src-tauri/yaak-http/src/manager.rs

@@ -20,19 +20,19 @@ impl HttpConnectionManager {
         }
     }
 
-    pub async fn get_client(&self, id: &str, opt: &HttpConnectionOptions) -> Result<Client> {
+    pub async fn get_client(&self, opt: &HttpConnectionOptions) -> Result<Client> {
         let mut connections = self.connections.write().await;
+        let id = opt.id.clone();
 
         // Clean old connections
         connections.retain(|_, (_, last_used)| last_used.elapsed() <= self.ttl);
 
-        if let Some((c, last_used)) = connections.get_mut(id) {
+        if let Some((c, last_used)) = connections.get_mut(&id) {
             info!("Re-using HTTP client {id}");
             *last_used = Instant::now();
             return Ok(c.clone());
         }
 
-        info!("Building new HTTP client {id}");
         let c = opt.build_client()?;
         connections.insert(id.into(), (c.clone(), Instant::now()));
         Ok(c)

src-tauri/yaak-http/src/tls.rs

@@ -1,81 +0,0 @@
-use rustls::client::danger::{HandshakeSignatureValid, ServerCertVerified, ServerCertVerifier};
-use rustls::crypto::ring;
-use rustls::pki_types::{CertificateDer, ServerName, UnixTime};
-use rustls::{ClientConfig, DigitallySignedStruct, SignatureScheme};
-use rustls_platform_verifier::BuilderVerifierExt;
-use std::sync::Arc;
-
-pub fn get_config(validate_certificates: bool, with_alpn: bool) -> ClientConfig {
-    let arc_crypto_provider = Arc::new(ring::default_provider());
-    let config_builder = ClientConfig::builder_with_provider(arc_crypto_provider)
-        .with_safe_default_protocol_versions()
-        .unwrap();
-    let mut client = if validate_certificates {
-        // Use platform-native verifier to validate certificates
-        config_builder.with_platform_verifier().unwrap().with_no_client_auth()
-    } else {
-        config_builder
-            .dangerous()
-            .with_custom_certificate_verifier(Arc::new(NoVerifier))
-            .with_no_client_auth()
-    };
-
-    if with_alpn {
-        client.alpn_protocols = vec![b"h2".to_vec(), b"http/1.1".to_vec()];
-    }
-
-    client
-}
-
-// Copied from reqwest: https://github.com/seanmonstar/reqwest/blob/595c80b1fbcdab73ac2ae93e4edc3406f453df25/src/tls.rs#L608
-#[derive(Debug)]
-struct NoVerifier;
-
-impl ServerCertVerifier for NoVerifier {
-    fn verify_server_cert(
-        &self,
-        _end_entity: &CertificateDer,
-        _intermediates: &[CertificateDer],
-        _server_name: &ServerName,
-        _ocsp_response: &[u8],
-        _now: UnixTime,
-    ) -> Result<ServerCertVerified, rustls::Error> {
-        Ok(ServerCertVerified::assertion())
-    }
-
-    fn verify_tls12_signature(
-        &self,
-        _message: &[u8],
-        _cert: &CertificateDer,
-        _dss: &DigitallySignedStruct,
-    ) -> Result<HandshakeSignatureValid, rustls::Error> {
-        Ok(HandshakeSignatureValid::assertion())
-    }
-
-    fn verify_tls13_signature(
-        &self,
-        _message: &[u8],
-        _cert: &CertificateDer,
-        _dss: &DigitallySignedStruct,
-    ) -> Result<HandshakeSignatureValid, rustls::Error> {
-        Ok(HandshakeSignatureValid::assertion())
-    }
-
-    fn supported_verify_schemes(&self) -> Vec<SignatureScheme> {
-        vec![
-            SignatureScheme::RSA_PKCS1_SHA1,
-            SignatureScheme::ECDSA_SHA1_Legacy,
-            SignatureScheme::RSA_PKCS1_SHA256,
-            SignatureScheme::ECDSA_NISTP256_SHA256,
-            SignatureScheme::RSA_PKCS1_SHA384,
-            SignatureScheme::ECDSA_NISTP384_SHA384,
-            SignatureScheme::RSA_PKCS1_SHA512,
-            SignatureScheme::ECDSA_NISTP521_SHA512,
-            SignatureScheme::RSA_PSS_SHA256,
-            SignatureScheme::RSA_PSS_SHA384,
-            SignatureScheme::RSA_PSS_SHA512,
-            SignatureScheme::ED25519,
-            SignatureScheme::ED448,
-        ]
-    }
-}