Support connecting to the uplink over SPKI-pinned TLS

src/config.rs

@@ -400,6 +400,13 @@ pub struct Uplink {
     pub host: String,
     pub port: u16,
     pub password: String,
+    // Connect to the uplink over TLS, authenticated by pinning the server's SPKI
+    // fingerprint (base64 SHA256 of its SubjectPublicKeyInfo) rather than a CA — the
+    // link cert is typically self-signed. Off by default (plaintext, e.g. loopback).
+    #[serde(default)]
+    pub tls: bool,
+    #[serde(default)]
+    pub spki_fingerprint: String,
 }
 
 #[derive(Debug, Deserialize)]

src/link.rs

@@ -1,15 +1,57 @@
 use std::borrow::Cow;
+use std::pin::Pin;
 use std::sync::Arc;
+use std::task::{Context, Poll};
 
 use anyhow::Result;
-use tokio::io::{AsyncReadExt, AsyncWriteExt, BufReader};
+use tokio::io::{AsyncRead, AsyncReadExt, AsyncWrite, AsyncWriteExt, BufReader, ReadBuf};
 use tokio::net::TcpStream;
 use tokio::sync::{mpsc, Mutex};
+use tokio_rustls::client::TlsStream;
+use tokio_rustls::rustls::pki_types::ServerName;
+use tokio_rustls::TlsConnector;
 
 use crate::engine::db::Db;
 use crate::engine::Engine;
 use crate::proto::{NetAction, Protocol};
 
+// The uplink socket, plaintext or TLS. Both inner types are Unpin, so projecting
+// the pin is a plain re-pin of the inner stream.
+enum UplinkStream {
+    Plain(TcpStream),
+    Tls(Box<TlsStream<TcpStream>>),
+}
+
+impl AsyncRead for UplinkStream {
+    fn poll_read(self: Pin<&mut Self>, cx: &mut Context<'_>, buf: &mut ReadBuf<'_>) -> Poll<std::io::Result<()>> {
+        match self.get_mut() {
+            UplinkStream::Plain(s) => Pin::new(s).poll_read(cx, buf),
+            UplinkStream::Tls(s) => Pin::new(s.as_mut()).poll_read(cx, buf),
+        }
+    }
+}
+
+impl AsyncWrite for UplinkStream {
+    fn poll_write(self: Pin<&mut Self>, cx: &mut Context<'_>, buf: &[u8]) -> Poll<std::io::Result<usize>> {
+        match self.get_mut() {
+            UplinkStream::Plain(s) => Pin::new(s).poll_write(cx, buf),
+            UplinkStream::Tls(s) => Pin::new(s.as_mut()).poll_write(cx, buf),
+        }
+    }
+    fn poll_flush(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<std::io::Result<()>> {
+        match self.get_mut() {
+            UplinkStream::Plain(s) => Pin::new(s).poll_flush(cx),
+            UplinkStream::Tls(s) => Pin::new(s.as_mut()).poll_flush(cx),
+        }
+    }
+    fn poll_shutdown(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<std::io::Result<()>> {
+        match self.get_mut() {
+            UplinkStream::Plain(s) => Pin::new(s).poll_shutdown(cx),
+            UplinkStream::Tls(s) => Pin::new(s.as_mut()).poll_shutdown(cx),
+        }
+    }
+}
+
 // Cap on one uplink line (well above IRC's 512 + generous room for message tags),
 // so a misbehaving uplink can't grow an unbounded read buffer.
 const MAX_UPLINK_LINE: usize = 16 * 1024;
@@ -100,13 +142,19 @@ fn redact(line: &str) -> Cow<'_, str> {
 // The engine is shared with the gossip layer, so it is locked per operation and
 // never held across the registration key-stretching await.
 #[allow(clippy::too_many_arguments)] // the link driver legitimately wires up many collaborators
-pub async fn run(mut proto: Box<dyn Protocol>, engine: Arc<Mutex<Engine>>, addr: &str, mut irc_rx: mpsc::UnboundedReceiver<NetAction>, irc_tx: mpsc::UnboundedSender<NetAction>, email: Option<crate::config::Email>, keycard: Option<crate::config::Keycard>, dict_server: Option<String>) -> Result<()> {
-    let stream = TcpStream::connect(addr).await?;
+pub async fn run(mut proto: Box<dyn Protocol>, engine: Arc<Mutex<Engine>>, addr: &str, tls: Option<(TlsConnector, ServerName<'static>)>, mut irc_rx: mpsc::UnboundedReceiver<NetAction>, irc_tx: mpsc::UnboundedSender<NetAction>, email: Option<crate::config::Email>, keycard: Option<crate::config::Keycard>, dict_server: Option<String>) -> Result<()> {
+    let tcp = TcpStream::connect(addr).await?;
     // Disable Nagle: service replies are small multi-line bursts, and without this
     // the last segment of a reply is held ~40ms waiting on a delayed ACK, so a
     // HELP visibly lags before it lands. Every ircd sets this on every socket.
-    stream.set_nodelay(true)?;
-    let (read, mut write) = stream.into_split();
+    tcp.set_nodelay(true)?;
+    // Wrap in TLS (SPKI-pinned) when configured; otherwise stay plaintext.
+    let stream = match tls {
+        Some((connector, name)) => UplinkStream::Tls(Box::new(connector.connect(name, tcp).await?)),
+        None => UplinkStream::Plain(tcp),
+    };
+    let (read, write) = tokio::io::split(stream);
+    let mut write = write;
     let mut reader = BufReader::new(read);
 
     for line in proto.handshake() {

src/main.rs

@@ -11,6 +11,7 @@ mod health;
 mod jsonrpc;
 mod keycard;
 mod link;
+mod uplink_tls;
 mod migrate;
 mod proto;
 mod version;
@@ -377,13 +378,20 @@ async fn main() -> Result<()> {
     }
 
     let addr = format!("{}:{}", cfg.uplink.host, cfg.uplink.port);
-    tracing::info!(server = %cfg.server.name, %addr, "linking to uplink");
+    let uplink_tls = match uplink_tls::connector(&cfg.uplink) {
+        Ok(t) => t,
+        Err(e) => {
+            tracing::error!(%e, "uplink TLS misconfigured");
+            return Err(e);
+        }
+    };
+    tracing::info!(server = %cfg.server.name, %addr, tls = uplink_tls.is_some(), "linking to uplink");
     // Run until the uplink loop ends or the process is asked to stop. Every
     // committed change is already fsync'd, so a clean stop loses nothing; this
     // just lets systemd stop us without waiting out the kill timeout.
     let shutdown_engine = engine.clone();
     tokio::select! {
-        res = link::run(proto, engine, &addr, irc_rx, irc_tx, cfg.email.clone(), cfg.keycard.clone(), cfg.dictserv.as_ref().map(|d| d.server.clone())) => res,
+        res = link::run(proto, engine, &addr, uplink_tls, irc_rx, irc_tx, cfg.email.clone(), cfg.keycard.clone(), cfg.dictserv.as_ref().map(|d| d.server.clone())) => res,
         _ = shutdown_signal() => {
             // Flush stat counters + the incident ring so a clean stop/restart keeps
             // StatServ history and OperServ LOGSEARCH.

src/uplink_tls.rs

@@ -0,0 +1,94 @@
+//! Optional TLS for the ircd uplink (#370). The link cert is typically self-signed,
+//! so instead of a CA we authenticate the server by pinning its SPKIFP — the base64
+//! SHA256 of its SubjectPublicKeyInfo (which, unlike a whole-cert fingerprint,
+//! survives a certificate renewal that keeps the same key). The normal PASS
+//! handshake still runs inside the TLS channel.
+
+use std::sync::Arc;
+
+use anyhow::{anyhow, Result};
+use base64::Engine;
+use tokio_rustls::rustls::client::danger::{HandshakeSignatureValid, ServerCertVerified, ServerCertVerifier};
+use tokio_rustls::rustls::crypto::{self, CryptoProvider};
+use tokio_rustls::rustls::pki_types::{CertificateDer, ServerName, UnixTime};
+use tokio_rustls::rustls::{ClientConfig, DigitallySignedStruct, Error, SignatureScheme};
+use tokio_rustls::TlsConnector;
+
+use crate::config::Uplink;
+
+/// The SPKIFP of a certificate: base64(SHA256(SubjectPublicKeyInfo DER)).
+pub fn spki_fingerprint(cert: &CertificateDer) -> Result<String> {
+    use x509_cert::der::{Decode, Encode};
+    let parsed = x509_cert::Certificate::from_der(cert.as_ref())?;
+    let spki = parsed.tbs_certificate.subject_public_key_info.to_der()?;
+    let digest = <sha2::Sha256 as sha2::Digest>::digest(&spki);
+    Ok(base64::engine::general_purpose::STANDARD.encode(digest))
+}
+
+// Accept the server iff its SPKIFP matches the pinned value; the handshake
+// signature is still verified against that key by the crypto provider, so only the
+// holder of the pinned key can complete the connection.
+#[derive(Debug)]
+struct SpkiPin {
+    expected: String,
+    provider: Arc<CryptoProvider>,
+}
+
+impl ServerCertVerifier for SpkiPin {
+    fn verify_server_cert(&self, end_entity: &CertificateDer, _intermediates: &[CertificateDer], _server_name: &ServerName, _ocsp: &[u8], _now: UnixTime) -> Result<ServerCertVerified, Error> {
+        let got = spki_fingerprint(end_entity).map_err(|e| Error::General(format!("uplink cert unreadable: {e}")))?;
+        if got == self.expected {
+            Ok(ServerCertVerified::assertion())
+        } else {
+            Err(Error::General("uplink SPKI fingerprint does not match the pinned value".into()))
+        }
+    }
+
+    fn verify_tls12_signature(&self, message: &[u8], cert: &CertificateDer, dss: &DigitallySignedStruct) -> Result<HandshakeSignatureValid, Error> {
+        crypto::verify_tls12_signature(message, cert, dss, &self.provider.signature_verification_algorithms)
+    }
+
+    fn verify_tls13_signature(&self, message: &[u8], cert: &CertificateDer, dss: &DigitallySignedStruct) -> Result<HandshakeSignatureValid, Error> {
+        crypto::verify_tls13_signature(message, cert, dss, &self.provider.signature_verification_algorithms)
+    }
+
+    fn supported_verify_schemes(&self) -> Vec<SignatureScheme> {
+        self.provider.signature_verification_algorithms.supported_schemes()
+    }
+}
+
+/// A TLS connector + server name for the uplink, or `None` when TLS is off.
+pub fn connector(uplink: &Uplink) -> Result<Option<(TlsConnector, ServerName<'static>)>> {
+    if !uplink.tls {
+        return Ok(None);
+    }
+    if uplink.spki_fingerprint.is_empty() {
+        return Err(anyhow!("uplink.tls is set but uplink.spki_fingerprint is empty"));
+    }
+    // Install a process-default provider if nothing else did yet (idempotent).
+    let _ = crypto::aws_lc_rs::default_provider().install_default();
+    let provider = Arc::new(crypto::aws_lc_rs::default_provider());
+    let verifier = Arc::new(SpkiPin { expected: uplink.spki_fingerprint.clone(), provider });
+    let config = ClientConfig::builder()
+        .dangerous()
+        .with_custom_certificate_verifier(verifier)
+        .with_no_client_auth();
+    let name = ServerName::try_from(uplink.host.clone())?;
+    Ok(Some((TlsConnector::from(Arc::new(config)), name)))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    // The SPKIFP matches `openssl x509 -pubkey | openssl pkey -pubin -outform DER |
+    // openssl dgst -sha256 -binary | base64` for this fixed self-signed cert.
+    #[test]
+    fn spki_fingerprint_matches_openssl() {
+        let der = base64::engine::general_purpose::STANDARD.decode(
+            "MIIDCTCCAfGgAwIBAgIUJf3uwnHdwpCANK0wddShifEEProwDQYJKoZIhvcNAQELBQAwFDESMBAGA1UEAwwJZWNoby10ZXN0MB4XDTI2MDcyMTEzNDIxNFoXDTI2MDcyMzEzNDIxNFowFDESMBAGA1UEAwwJZWNoby10ZXN0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu/L8m2F/7ELMezgktDchrlVGh6VQpT+uatXG0IvVPOS9BNm60xLAaijEvv7oI1paWCBM4EKpRPhZH5Of5xyBNtvfpyUdLKKeS5NiRNrGQJwXU0wz8j1Wrwe6qyffWPBO3RlBd+PvRLgCGlE1oV5gyw+TkjCo+9eLNgwIVIJP5/HCmEohSgtpOjqOthzVt/DjwfaH8VUbHC9r718cNfj1stfL46wW/sevQThmqEwFshOWxGKPbcJNhlpcC/LXr6YO2RwlzGnF2AEkvC7ZzG4dKCDZNYYgOgR7sKFcUArBE+4mvKQBcG1qDj4GBLeH82n0jRZSf0f6EpHjKCPTkvnJswIDAQABo1MwUTAdBgNVHQ4EFgQU6cgHWvusLXkexbuZ/9KOtzexegMwHwYDVR0jBBgwFoAU6cgHWvusLXkexbuZ/9KOtzexegMwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAbuujq+xvRbRlq+FXC2PHhWlyCqHPEn7rKC7vr77rdXIMVxAzY3rlAfHgyTgL41XrDsx58dfKswUp3g2VxJZHwKXQhoCKRWo+fAxJ6bHVWXrPkJJYZtI/JtggKNcORWw6VT0081UhXaRANDlGHMQ+MfTr3NaNz+aIAMhMtL4BSobSocjn4eAUaFxXVF0yznT8+U8MiGMgThOLrnyvzg9NK7D4iNf3gC1XRyD1RHP6w7ji/tpmLR4CQ6A3i2ywYD8ZQilBQhBa2abzP7zxHbQe8wHbopWPaz5QQ34bxpZ8MLKgY2OqzNndqt8+ZUYv9uk8AllnBT/fQbWC1b02B8gNMQ==",
+        ).unwrap();
+        let cert = CertificateDer::from(der);
+        assert_eq!(spki_fingerprint(&cert).unwrap(), "Wh/ag/dtBCpXhiYPhRWV66kx3FutmTyNw1dysTbWvao=");
+    }
+}