redlib-org · Tokarak · Sep 20, 2024 · Sep 20, 2024 · Sep 20, 2024 · Sep 21, 2024
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -10,12 +10,14 @@ authors = [
 ]
 edition = "2021"
 
+[features]
+no-https-verification = ["rustls/dangerous_configuration"]
+
 [dependencies]
 rinja = { version = "0.3.4", default-features = false }
 cached = { version = "0.51.3", features = ["async"] }
-clap = { version = "4.4.11", default-features = false, features = [
-    "std",
-    "env",
+clap = { version = "4.4.11", features = [
+    "env"
 ] }
 regex = "1.10.2"
 serde = { version = "1.0.193", features = ["derive"] }
@@ -44,6 +46,8 @@ pretty_env_logger = "0.5.0"
 dotenvy = "0.15.7"
 rss = "2.0.7"
 arc-swap = "1.7.1"
+rustls = { version = "0.21.12"  }
+ctor = "0.2.8"
 serde_json_path = "0.6.7"
 async-recursion = "1.1.1"
 

diff --git a/src/client.rs b/src/client.rs
@@ -14,6 +14,7 @@ use serde_json::Value;
 
 use std::sync::atomic::Ordering;
 use std::sync::atomic::{AtomicBool, AtomicU16};
+use std::sync::OnceLock;
 use std::{io, result::Result};
 
 use crate::dbg_msg;
@@ -30,10 +31,9 @@ const REDDIT_SHORT_URL_BASE_HOST: &str = "redd.it";
 const ALTERNATIVE_REDDIT_URL_BASE: &str = "https://www.reddit.com";
 const ALTERNATIVE_REDDIT_URL_BASE_HOST: &str = "www.reddit.com";
 
-pub static CLIENT: Lazy<Client<HttpsConnector<HttpConnector>>> = Lazy::new(|| {
-	let https = hyper_rustls::HttpsConnectorBuilder::new().with_native_roots().https_only().enable_http1().build();
-	client::Client::builder().build(https)
-});
+// CLIENT and VERIFY_HTTPS are initialised in main.rs
+pub static CLIENT: OnceLock<Client<HttpsConnector<HttpConnector>>> = OnceLock::new();
+pub static VERIFY_HTTPS: OnceLock<bool> = OnceLock::new();
 
 pub static OAUTH_CLIENT: Lazy<ArcSwap<Oauth>> = Lazy::new(|| {
 	let client = block_on(Oauth::new());
@@ -50,6 +50,50 @@ static URL_PAIRS: [(&str, &str); 2] = [
 	(REDDIT_SHORT_URL_BASE, REDDIT_SHORT_URL_BASE_HOST),
 ];
 
+/// Generate a client given a flag.
+#[allow(unused_variables)]
+pub fn generate_client(https_verification: bool) -> Client<HttpsConnector<HttpConnector>> {
+	// Use native certificates to verify requests to reddit
+	#[cfg(not(feature = "no-https-verification"))]
+	let https = hyper_rustls::HttpsConnectorBuilder::new().with_native_roots().https_only().enable_http1().build();
+
+	// If https verification is disabled for debug purposes, create a custom ClientConfig
+	#[cfg(feature = "no-https-verification")]
+	let https = if !https_verification {
+		log::warn!("HTTPS verification is disabled.");
+		use rustls::ClientConfig;
+		use std::sync::Arc;
+
+		// A custom certificate verifier that does nothing.
+		struct NoCertificateVerification;
+
+		impl rustls::client::ServerCertVerifier for NoCertificateVerification {
+			fn verify_server_cert(
+				&self,
+				_: &rustls::Certificate,
+				_: &[rustls::Certificate],
+				_: &rustls::ServerName,
+				_: &mut dyn Iterator<Item = &[u8]>,
+				_: &[u8],
+				_: std::time::SystemTime,
+			) -> Result<rustls::client::ServerCertVerified, rustls::Error> {
+				Ok(rustls::client::ServerCertVerified::assertion())
+			}
+		}
+
+		let mut config = ClientConfig::builder()
+			.with_safe_defaults()
+			.with_root_certificates(rustls::RootCertStore::empty())
+			.with_no_client_auth();
+
+		config.dangerous().set_certificate_verifier(Arc::new(NoCertificateVerification));
+		hyper_rustls::HttpsConnectorBuilder::new().with_tls_config(config).https_only().enable_http1().build()
+	} else {
+		hyper_rustls::HttpsConnectorBuilder::new().with_native_roots().https_only().enable_http1().build()
+	};
+	client::Client::builder().build(https)
+}
+
 /// Gets the canonical path for a resource on Reddit. This is accomplished by
 /// making a `HEAD` request to Reddit at the path given in `path`.
 ///
@@ -154,7 +198,7 @@ async fn stream(url: &str, req: &Request<Body>) -> Result<Response<Body>, String
 	let parsed_uri = url.parse::<Uri>().map_err(|_| "Couldn't parse URL".to_string())?;
 
 	// Build the hyper client from the HTTPS connector.
-	let client: Client<_, Body> = CLIENT.clone();
+	let client: Client<_, Body> = CLIENT.get().unwrap().clone();
 
 	let mut builder = Request::get(parsed_uri);
 
@@ -216,7 +260,7 @@ fn request(method: &'static Method, path: String, redirect: bool, quarantine: bo
 	let url = format!("{base_path}{path}");
 
 	// Construct the hyper client from the HTTPS connector.
-	let client: Client<_, Body> = CLIENT.clone();
+	let client: Client<_, Body> = CLIENT.get().unwrap().clone();
 
 	let (token, vendor_id, device_id, user_agent, loid) = {
 		let client = OAUTH_CLIENT.load_full();

diff --git a/src/instance_info.rs b/src/instance_info.rs
@@ -1,4 +1,5 @@
 use crate::{
+	client::VERIFY_HTTPS,
 	config::{Config, CONFIG},
 	server::RequestExt,
 	utils::{ErrorTemplate, Preferences},
@@ -88,6 +89,7 @@ pub struct InstanceInfo {
 	git_commit: String,
 	deploy_date: String,
 	compile_mode: String,
+	verify_https: bool,
 	deploy_unix_ts: i64,
 	config: Config,
 }
@@ -103,6 +105,7 @@ impl InstanceInfo {
 			compile_mode: "Debug".into(),
 			#[cfg(not(debug_assertions))]
 			compile_mode: "Release".into(),
+			verify_https: *VERIFY_HTTPS.get().unwrap(),
 			deploy_unix_ts: OffsetDateTime::now_local().unwrap_or_else(|_| OffsetDateTime::now_utc()).unix_timestamp(),
 			config: CONFIG.clone(),
 		}
@@ -127,6 +130,7 @@ impl InstanceInfo {
 				["SFW only", &convert(&self.config.sfw_only)],
 				["Pushshift frontend", &convert(&self.config.pushshift)],
 				["RSS enabled", &convert(&self.config.enable_rss)],
+				["Reddit HTTPS verification", &self.verify_https.to_string()],
 				["Full URL", &convert(&self.config.full_url)],
 				//TODO: fallback to crate::config::DEFAULT_PUSHSHIFT_FRONTEND
 			])
@@ -168,6 +172,7 @@ impl InstanceInfo {
 				SFW only: {:?}\n
 				Pushshift frontend: {:?}\n
 				RSS enabled: {:?}\n
+				Reddit HTTPS Verification: {:?}\n
 				Full URL: {:?}\n
                 Config:\n
                     Banner: {:?}\n
@@ -194,6 +199,7 @@ impl InstanceInfo {
 					self.compile_mode,
 					self.config.sfw_only,
 					self.config.enable_rss,
+					self.verify_https,
 					self.config.full_url,
 					self.config.pushshift,
 					self.config.banner,

diff --git a/src/main.rs b/src/main.rs
@@ -22,13 +22,13 @@ use futures_lite::FutureExt;
 use hyper::{header::HeaderValue, Body, Request, Response};
 
 mod client;
-use client::{canonical_path, proxy};
+use client::{canonical_path, generate_client, proxy, CLIENT};
 use log::info;
 use once_cell::sync::Lazy;
 use server::RequestExt;
 use utils::{error, redirect, ThemeAssets};
 
-use crate::client::OAUTH_CLIENT;
+use crate::client::{OAUTH_CLIENT, VERIFY_HTTPS};
 
 mod server;
 
@@ -119,7 +119,7 @@ async fn main() {
 	// Initialize logger
 	pretty_env_logger::init();
 
-	let matches = Command::new("Redlib")
+	let mut cmd = Command::new("Redlib")
 		.version(env!("CARGO_PKG_VERSION"))
 		.about("Private front-end for Reddit written in Rust ")
 		.arg(
@@ -158,11 +158,28 @@ async fn main() {
 				.default_value("604800")
 				.num_args(1),
 		)
-		.get_matches();
+		.arg(
+			Arg::new("no-https-verification")
+				.long("no-https-verification")
+				.help("Disables HTTPS certificate verification between the instance and reddit. This can be useful to debug the HTTPS connection with an HTTPS sniffer. Only works when the 'no-https-verification' feature is enabled at compile time.")
+				.action(ArgAction::SetFalse)
+		);
+	let matches = cmd.get_matches_mut();
+
+	#[cfg(not(feature = "no-https-verification"))]
+	if !matches.get_flag("no-https-verification") {
+		cmd
+			.error(
+				clap::error::ErrorKind::InvalidValue,
+				"`--no-https-verification` can only be enabled if the `no-https-verification` feature is enabled",
+			)
+			.exit()
+	}
 
 	let address = matches.get_one::<String>("address").unwrap();
 	let port = matches.get_one::<String>("port").unwrap();
 	let hsts = matches.get_one("hsts").map(|m: &String| m.as_str());
+	VERIFY_HTTPS.set(matches.get_flag("no-https-verification")).unwrap();
 
 	let listener = [address, ":", port].concat();
 
@@ -177,6 +194,8 @@ async fn main() {
 	// in OAUTH case, we need to retrieve the token to avoid paying penalty
 	// at first request
 
+	info!("Creating HTTP client.");
+	CLIENT.set(generate_client(*VERIFY_HTTPS.get().unwrap())).unwrap();
 	info!("Evaluating config.");
 	Lazy::force(&config::CONFIG);
 	info!("Evaluating instance info.");
@@ -389,3 +408,9 @@ async fn main() {
 		eprintln!("Server error: {e}");
 	}
 }
+
+#[cfg(test)]
+#[ctor::ctor]
+fn init() {
+	CLIENT.set(generate_client(false)).unwrap();
+}
diff --git a/src/oauth.rs b/src/oauth.rs
@@ -94,7 +94,7 @@ impl Oauth {
 		trace!("Sending token request...");
 
 		// Send request
-		let client: client::Client<_, Body> = CLIENT.clone();
+		let client: client::Client<_, Body> = CLIENT.get().unwrap().clone();
 		let resp = client.request(request).await.ok()?;
 
 		trace!("Received response with status {} and length {:?}", resp.status(), resp.headers().get("content-length"));