From 7ed5475daaa707d17521290f3c10067ccd615df3 Mon Sep 17 00:00:00 2001 From: Kevin Wang Date: Fri, 6 Nov 2026 19:38:17 -0800 Subject: [PATCH 1/4] fix(ra-rpc): verify TLS key possession for attested servers Signed-off-by: Kevin Wang --- dstack/Cargo.lock | 1 + dstack/ra-rpc/Cargo.toml | 5 +- dstack/ra-rpc/src/client.rs | 80 ++++++++++- dstack/ra-rpc/tests/server_key_possession.rs | 132 +++++++++++++++++++ 4 files changed, 214 insertions(+), 4 deletions(-) create mode 100644 dstack/ra-rpc/tests/server_key_possession.rs diff --git a/dstack/Cargo.lock b/dstack/Cargo.lock index f4ff68f9a..877a7a98c 100644 --- a/dstack/Cargo.lock +++ b/dstack/Cargo.lock @@ -5919,6 +5919,7 @@ dependencies = [ "serde", "serde_json", "tokio", + "tokio-rustls", "tracing", "x509-parser 0.16.0", ] diff --git a/dstack/ra-rpc/Cargo.toml b/dstack/ra-rpc/Cargo.toml index 8da9df01f..da0aee6a6 100644 --- a/dstack/ra-rpc/Cargo.toml +++ b/dstack/ra-rpc/Cargo.toml @@ -28,7 +28,8 @@ prost-types = { workspace = true, optional = true } or-panic.workspace = true [dev-dependencies] -tokio = { workspace = true, features = ["macros", "rt-multi-thread"] } +tokio-rustls.workspace = true +tokio = { workspace = true, features = ["macros", "rt-multi-thread", "net", "io-util"] } reqwest = { workspace = true, default-features = false, features = [ "rustls", "charset", @@ -37,5 +38,5 @@ reqwest = { workspace = true, default-features = false, features = [ [features] default = ["rocket", "client"] rocket = ["dep:rocket", "dep:rocket-vsock-listener", "dep:rustls"] -client = ["reqwest"] +client = ["reqwest", "dep:rustls"] openapi = ["dep:prost-types"] diff --git a/dstack/ra-rpc/src/client.rs b/dstack/ra-rpc/src/client.rs index 0405d5517..3136f1a2b 100644 --- a/dstack/ra-rpc/src/client.rs +++ b/dstack/ra-rpc/src/client.rs @@ -50,14 +50,19 @@ impl RaClientConfig { pub fn into_client(self) -> Result { let mut builder = Client::builder() .tls_sni(true) - .danger_accept_invalid_certs(self.tls_no_check) .danger_accept_invalid_hostnames(self.tls_no_check_hostname) .connect_timeout(Duration::from_secs(5)) .timeout(Duration::from_secs(60)); if self.cert_validator.is_some() { builder = builder.tls_info(true); } - if let (Some(cert_pem), Some(key_pem)) = (self.tls_client_cert, self.tls_client_key) { + if self.tls_no_check { + builder = builder.use_preconfigured_tls(attestation_tls_config( + self.tls_client_cert.as_deref(), + self.tls_client_key.as_deref(), + )?); + } else if let (Some(cert_pem), Some(key_pem)) = (self.tls_client_cert, self.tls_client_key) + { let identity_pem = format!("{cert_pem}\n{key_pem}"); let identity = Identity::from_pem(identity_pem.as_bytes()).context("Failed to parse identity")?; @@ -94,6 +99,77 @@ impl RaClientConfig { } } +/// Attestation is checked on the response, but TLS must still prove possession +/// of the attested certificate key. Reqwest's no-verifier also skips that proof. +#[derive(Debug)] +struct AttestationServerVerifier(Arc); + +impl rustls::client::danger::ServerCertVerifier for AttestationServerVerifier { + fn verify_server_cert( + &self, + _end_entity: &rustls::pki_types::CertificateDer<'_>, + _intermediates: &[rustls::pki_types::CertificateDer<'_>], + _server_name: &rustls::pki_types::ServerName<'_>, + _ocsp_response: &[u8], + _now: rustls::pki_types::UnixTime, + ) -> Result { + Ok(rustls::client::danger::ServerCertVerified::assertion()) + } + + fn verify_tls12_signature( + &self, + message: &[u8], + cert: &rustls::pki_types::CertificateDer<'_>, + signature: &rustls::DigitallySignedStruct, + ) -> Result { + rustls::crypto::verify_tls12_signature( + message, + cert, + signature, + &self.0.signature_verification_algorithms, + ) + } + + fn verify_tls13_signature( + &self, + message: &[u8], + cert: &rustls::pki_types::CertificateDer<'_>, + signature: &rustls::DigitallySignedStruct, + ) -> Result { + rustls::crypto::verify_tls13_signature( + message, + cert, + signature, + &self.0.signature_verification_algorithms, + ) + } + + fn supported_verify_schemes(&self) -> Vec { + self.0.signature_verification_algorithms.supported_schemes() + } +} + +fn attestation_tls_config(cert: Option<&str>, key: Option<&str>) -> Result { + use rustls::pki_types::{pem::PemObject, CertificateDer, PrivateKeyDer}; + let provider = rustls::crypto::CryptoProvider::get_default() + .cloned() + .unwrap_or_else(|| Arc::new(rustls::crypto::aws_lc_rs::default_provider())); + let builder = rustls::ClientConfig::builder_with_provider(provider.clone()) + .with_safe_default_protocol_versions()? + .dangerous() + .with_custom_certificate_verifier(Arc::new(AttestationServerVerifier(provider))); + match (cert, key) { + (Some(cert), Some(key)) => builder + .with_client_auth_cert( + CertificateDer::pem_slice_iter(cert.as_bytes()).collect::, _>>()?, + PrivateKeyDer::from_pem_slice(key.as_bytes())?, + ) + .context("invalid RA-TLS client identity"), + (None, None) => Ok(builder.with_no_client_auth()), + _ => bail!("RA-TLS client identity requires both certificate and key"), + } +} + pub struct RaClient { remote_uri: String, attestation_verifier: Arc, diff --git a/dstack/ra-rpc/tests/server_key_possession.rs b/dstack/ra-rpc/tests/server_key_possession.rs new file mode 100644 index 000000000..b50b50925 --- /dev/null +++ b/dstack/ra-rpc/tests/server_key_possession.rs @@ -0,0 +1,132 @@ +// SPDX-FileCopyrightText: © 2026 Phala Network +// +// SPDX-License-Identifier: Apache-2.0 + +#![cfg(feature = "client")] + +use std::sync::Arc; + +use prpc::client::RequestClient; +use ra_rpc::client::RaClientConfig; +use ra_tls::{ + cert::CertRequest, + rcgen::{KeyPair, PKCS_ECDSA_P256_SHA256}, +}; +use rustls::{ + pki_types::PrivatePkcs8KeyDer, + server::{ClientHello, ResolvesServerCert}, + sign::CertifiedKey, +}; +use tokio::io::{AsyncReadExt, AsyncWriteExt}; + +#[derive(Debug)] +struct FixedCertificate(Arc); + +impl ResolvesServerCert for FixedCertificate { + fn resolve(&self, _: ClientHello<'_>) -> Option> { + Some(self.0.clone()) + } +} + +#[tokio::test] +async fn tls12_requires_the_server_certificate_key_even_without_ca_validation() { + check_key_possession(&rustls::version::TLS12).await; +} + +#[tokio::test] +async fn tls13_requires_the_server_certificate_key_even_without_ca_validation() { + check_key_possession(&rustls::version::TLS13).await; +} + +async fn check_key_possession(version: &'static rustls::SupportedProtocolVersion) { + for correct_key in [true, false] { + let key = KeyPair::generate_for(&PKCS_ECDSA_P256_SHA256).unwrap(); + let cert = CertRequest::builder() + .subject("test server") + .key(&key) + .usage_server_auth(true) + .build() + .self_signed() + .unwrap(); + let signing_key = if correct_key { + key + } else { + KeyPair::generate_for(&PKCS_ECDSA_P256_SHA256).unwrap() + }; + let ca_key = KeyPair::generate_for(&PKCS_ECDSA_P256_SHA256).unwrap(); + let ca = CertRequest::builder() + .subject("test client CA") + .key(&ca_key) + .ca_level(0) + .build() + .self_signed() + .unwrap(); + let client_key = KeyPair::generate_for(&PKCS_ECDSA_P256_SHA256).unwrap(); + let client_cert = CertRequest::builder() + .subject("test client") + .key(&client_key) + .usage_client_auth(true) + .build() + .signed_by(&ca, &ca_key) + .unwrap(); + let mut roots = rustls::RootCertStore::empty(); + roots.add(ca.der().clone()).unwrap(); + let provider = Arc::new(rustls::crypto::aws_lc_rs::default_provider()); + let client_verifier = rustls::server::WebPkiClientVerifier::builder_with_provider( + Arc::new(roots), + provider.clone(), + ) + .build() + .unwrap(); + let signing_key = provider + .key_provider + .load_private_key(PrivatePkcs8KeyDer::from(signing_key.serialize_der()).into()) + .unwrap(); + // A resolver permits deliberately pairing a stolen certificate with + // another key, unlike with_single_cert which rejects it up front. + let pinned_cert = cert.der().to_vec(); + let certified = CertifiedKey::new(vec![cert.der().clone()], signing_key); + let config = rustls::ServerConfig::builder_with_provider(provider) + .with_protocol_versions(&[version]) + .unwrap() + .with_client_cert_verifier(client_verifier) + .with_cert_resolver(Arc::new(FixedCertificate(Arc::new(certified)))); + let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap(); + let address = listener.local_addr().unwrap(); + let server = tokio::spawn(async move { + let (stream, _) = listener.accept().await.unwrap(); + let Ok(mut stream) = tokio_rustls::TlsAcceptor::from(Arc::new(config)) + .accept(stream) + .await + else { + return false; + }; + let mut request = [0; 4096]; + if !matches!(stream.read(&mut request).await, Ok(n) if n > 0) { + return false; + } + stream + .write_all(b"HTTP/1.1 200 OK\r\nContent-Length: 4\r\nConnection: close\r\n\r\nnull") + .await + .unwrap(); + true + }); + let client = RaClientConfig::builder() + .remote_uri(format!("https://{address}")) + .tls_no_check(true) + .tls_client_cert(client_cert.pem()) + .tls_client_key(client_key.serialize_pem()) + .verify_server_attestation(false) + .cert_validator(Box::new(move |info| { + let info = info.ok_or_else(|| anyhow::anyhow!("missing server certificate"))?; + anyhow::ensure!(info.cert_der == pinned_cert, "server certificate changed"); + Ok(()) + })) + .build() + .into_client() + .unwrap(); + let result = client.request::<(), ()>("Probe", ()).await; + assert_eq!(result.is_ok(), correct_key, "{version:?}: {result:?}"); + assert_eq!(server.await.unwrap(), correct_key); + } +} From c8ce4d282b4964942d12a24acab5e40dfeeccf22 Mon Sep 17 00:00:00 2001 From: Kevin Wang Date: Fri, 6 Nov 2026 19:57:49 -0800 Subject: [PATCH 2/4] refactor(ra-rpc): simplify TLS verification and reuse test PKI Signed-off-by: Kevin Wang --- dstack/ra-rpc/Cargo.toml | 1 + dstack/ra-rpc/src/client.rs | 59 ++++++++++---------- dstack/ra-rpc/tests/server_key_possession.rs | 48 ++++------------ 3 files changed, 41 insertions(+), 67 deletions(-) diff --git a/dstack/ra-rpc/Cargo.toml b/dstack/ra-rpc/Cargo.toml index da0aee6a6..0a4516396 100644 --- a/dstack/ra-rpc/Cargo.toml +++ b/dstack/ra-rpc/Cargo.toml @@ -28,6 +28,7 @@ prost-types = { workspace = true, optional = true } or-panic.workspace = true [dev-dependencies] +ra-tls = { workspace = true, features = ["test-pki"] } tokio-rustls.workspace = true tokio = { workspace = true, features = ["macros", "rt-multi-thread", "net", "io-util"] } reqwest = { workspace = true, default-features = false, features = [ diff --git a/dstack/ra-rpc/src/client.rs b/dstack/ra-rpc/src/client.rs index 3136f1a2b..9d4f60010 100644 --- a/dstack/ra-rpc/src/client.rs +++ b/dstack/ra-rpc/src/client.rs @@ -14,6 +14,12 @@ use ra_tls::{ traits::CertExt, }; use reqwest::{tls::TlsInfo, Certificate, Client, Identity, Response}; +use rustls::{ + client::danger::{HandshakeSignatureValid, ServerCertVerified, ServerCertVerifier}, + crypto::WebPkiSupportedAlgorithms, + pki_types::{CertificateDer, ServerName, UnixTime}, + DigitallySignedStruct, SignatureScheme, +}; use serde::{de::DeserializeOwned, Serialize}; use bon::Builder; @@ -102,62 +108,53 @@ impl RaClientConfig { /// Attestation is checked on the response, but TLS must still prove possession /// of the attested certificate key. Reqwest's no-verifier also skips that proof. #[derive(Debug)] -struct AttestationServerVerifier(Arc); +struct AttestationServerVerifier(WebPkiSupportedAlgorithms); -impl rustls::client::danger::ServerCertVerifier for AttestationServerVerifier { +impl ServerCertVerifier for AttestationServerVerifier { fn verify_server_cert( &self, - _end_entity: &rustls::pki_types::CertificateDer<'_>, - _intermediates: &[rustls::pki_types::CertificateDer<'_>], - _server_name: &rustls::pki_types::ServerName<'_>, + _end_entity: &CertificateDer<'_>, + _intermediates: &[CertificateDer<'_>], + _server_name: &ServerName<'_>, _ocsp_response: &[u8], - _now: rustls::pki_types::UnixTime, - ) -> Result { - Ok(rustls::client::danger::ServerCertVerified::assertion()) + _now: UnixTime, + ) -> Result { + Ok(ServerCertVerified::assertion()) } fn verify_tls12_signature( &self, message: &[u8], - cert: &rustls::pki_types::CertificateDer<'_>, - signature: &rustls::DigitallySignedStruct, - ) -> Result { - rustls::crypto::verify_tls12_signature( - message, - cert, - signature, - &self.0.signature_verification_algorithms, - ) + cert: &CertificateDer<'_>, + signature: &DigitallySignedStruct, + ) -> Result { + rustls::crypto::verify_tls12_signature(message, cert, signature, &self.0) } fn verify_tls13_signature( &self, message: &[u8], - cert: &rustls::pki_types::CertificateDer<'_>, - signature: &rustls::DigitallySignedStruct, - ) -> Result { - rustls::crypto::verify_tls13_signature( - message, - cert, - signature, - &self.0.signature_verification_algorithms, - ) + cert: &CertificateDer<'_>, + signature: &DigitallySignedStruct, + ) -> Result { + rustls::crypto::verify_tls13_signature(message, cert, signature, &self.0) } - fn supported_verify_schemes(&self) -> Vec { - self.0.signature_verification_algorithms.supported_schemes() + fn supported_verify_schemes(&self) -> Vec { + self.0.supported_schemes() } } fn attestation_tls_config(cert: Option<&str>, key: Option<&str>) -> Result { - use rustls::pki_types::{pem::PemObject, CertificateDer, PrivateKeyDer}; + use rustls::pki_types::{pem::PemObject, PrivateKeyDer}; let provider = rustls::crypto::CryptoProvider::get_default() .cloned() .unwrap_or_else(|| Arc::new(rustls::crypto::aws_lc_rs::default_provider())); - let builder = rustls::ClientConfig::builder_with_provider(provider.clone()) + let verifier = AttestationServerVerifier(provider.signature_verification_algorithms); + let builder = rustls::ClientConfig::builder_with_provider(provider) .with_safe_default_protocol_versions()? .dangerous() - .with_custom_certificate_verifier(Arc::new(AttestationServerVerifier(provider))); + .with_custom_certificate_verifier(Arc::new(verifier)); match (cert, key) { (Some(cert), Some(key)) => builder .with_client_auth_cert( diff --git a/dstack/ra-rpc/tests/server_key_possession.rs b/dstack/ra-rpc/tests/server_key_possession.rs index b50b50925..10e2ba95b 100644 --- a/dstack/ra-rpc/tests/server_key_possession.rs +++ b/dstack/ra-rpc/tests/server_key_possession.rs @@ -8,10 +8,7 @@ use std::sync::Arc; use prpc::client::RequestClient; use ra_rpc::client::RaClientConfig; -use ra_tls::{ - cert::CertRequest, - rcgen::{KeyPair, PKCS_ECDSA_P256_SHA256}, -}; +use ra_tls::test_pki::{TestCa, TestCert}; use rustls::{ pki_types::PrivatePkcs8KeyDer, server::{ClientHello, ResolvesServerCert}, @@ -40,37 +37,16 @@ async fn tls13_requires_the_server_certificate_key_even_without_ca_validation() async fn check_key_possession(version: &'static rustls::SupportedProtocolVersion) { for correct_key in [true, false] { - let key = KeyPair::generate_for(&PKCS_ECDSA_P256_SHA256).unwrap(); - let cert = CertRequest::builder() - .subject("test server") - .key(&key) - .usage_server_auth(true) - .build() - .self_signed() - .unwrap(); + let server_cert = TestCert::localhost().self_signed().unwrap(); let signing_key = if correct_key { - key + server_cert.key_der() } else { - KeyPair::generate_for(&PKCS_ECDSA_P256_SHA256).unwrap() + TestCert::localhost().self_signed().unwrap().key_der() }; - let ca_key = KeyPair::generate_for(&PKCS_ECDSA_P256_SHA256).unwrap(); - let ca = CertRequest::builder() - .subject("test client CA") - .key(&ca_key) - .ca_level(0) - .build() - .self_signed() - .unwrap(); - let client_key = KeyPair::generate_for(&PKCS_ECDSA_P256_SHA256).unwrap(); - let client_cert = CertRequest::builder() - .subject("test client") - .key(&client_key) - .usage_client_auth(true) - .build() - .signed_by(&ca, &ca_key) - .unwrap(); + let ca = TestCa::new().unwrap(); + let client_cert = TestCert::localhost().signed_by(&ca).unwrap(); let mut roots = rustls::RootCertStore::empty(); - roots.add(ca.der().clone()).unwrap(); + roots.add(ca.cert_key().cert.der().clone()).unwrap(); let provider = Arc::new(rustls::crypto::aws_lc_rs::default_provider()); let client_verifier = rustls::server::WebPkiClientVerifier::builder_with_provider( Arc::new(roots), @@ -80,12 +56,12 @@ async fn check_key_possession(version: &'static rustls::SupportedProtocolVersion .unwrap(); let signing_key = provider .key_provider - .load_private_key(PrivatePkcs8KeyDer::from(signing_key.serialize_der()).into()) + .load_private_key(PrivatePkcs8KeyDer::from(signing_key).into()) .unwrap(); // A resolver permits deliberately pairing a stolen certificate with // another key, unlike with_single_cert which rejects it up front. - let pinned_cert = cert.der().to_vec(); - let certified = CertifiedKey::new(vec![cert.der().clone()], signing_key); + let pinned_cert = server_cert.cert_der(); + let certified = CertifiedKey::new(vec![server_cert.cert.der().clone()], signing_key); let config = rustls::ServerConfig::builder_with_provider(provider) .with_protocol_versions(&[version]) .unwrap() @@ -114,8 +90,8 @@ async fn check_key_possession(version: &'static rustls::SupportedProtocolVersion let client = RaClientConfig::builder() .remote_uri(format!("https://{address}")) .tls_no_check(true) - .tls_client_cert(client_cert.pem()) - .tls_client_key(client_key.serialize_pem()) + .tls_client_cert(client_cert.cert_pem()) + .tls_client_key(client_cert.key_pem()) .verify_server_attestation(false) .cert_validator(Box::new(move |info| { let info = info.ok_or_else(|| anyhow::anyhow!("missing server certificate"))?; From df9bb6885cb92b94c74dd7a393ff2f5b80afb5f3 Mon Sep 17 00:00:00 2001 From: Kevin Wang Date: Fri, 6 Nov 2026 20:02:23 -0800 Subject: [PATCH 3/4] refactor(ra-rpc): name CA bypass explicitly and isolate TLS configuration Signed-off-by: Kevin Wang --- dstack/dstack-util/src/main.rs | 10 +-- dstack/dstack-util/src/system_setup.rs | 4 +- dstack/kms/src/onboard_service.rs | 2 +- dstack/ra-rpc/src/client.rs | 82 +++----------------- dstack/ra-rpc/src/client/tls.rs | 75 ++++++++++++++++++ dstack/ra-rpc/tests/server_key_possession.rs | 2 +- 6 files changed, 93 insertions(+), 82 deletions(-) create mode 100644 dstack/ra-rpc/src/client/tls.rs diff --git a/dstack/dstack-util/src/main.rs b/dstack/dstack-util/src/main.rs index f506482a8..1046d35d1 100644 --- a/dstack/dstack-util/src/main.rs +++ b/dstack/dstack-util/src/main.rs @@ -655,14 +655,14 @@ async fn cmd_get_keys(args: GetKeysArgs) -> Result<()> { // Step 1: Fetch the KMS root CA eprintln!("Connecting to KMS: {kms_url}"); - let tls_no_check = root_ca_pem.is_none(); - if tls_no_check { + let tls_skip_ca_verification = root_ca_pem.is_none(); + if tls_skip_ca_verification { eprintln!("Warning: no --root-ca provided, TLS certificate verification is disabled for initial connection"); } let root_ca = { let client = RaClientConfig::builder() .remote_uri(kms_url.clone()) - .tls_no_check(tls_no_check) + .tls_skip_ca_verification(tls_skip_ca_verification) .tls_built_in_root_certs(false) .maybe_tls_ca_cert(root_ca_pem.clone()) .build() @@ -682,7 +682,7 @@ async fn cmd_get_keys(args: GetKeysArgs) -> Result<()> { // Step 3: Create authenticated client and request app keys let ra_client = RaClientConfig::builder() - .tls_no_check(false) + .tls_skip_ca_verification(false) .tls_built_in_root_certs(false) .remote_uri(kms_url.clone()) .tls_client_cert(cert_pair.cert_pem) @@ -819,7 +819,7 @@ async fn cmd_encrypt(args: EncryptArgs) -> Result<()> { .transpose()?; let client = RaClientConfig::builder() .remote_uri(kms_url) - .tls_no_check(false) + .tls_skip_ca_verification(false) .tls_built_in_root_certs(root_ca_pem.is_none()) .maybe_tls_ca_cert(root_ca_pem) .build() diff --git a/dstack/dstack-util/src/system_setup.rs b/dstack/dstack-util/src/system_setup.rs index 4c6399cc2..0d604076b 100644 --- a/dstack/dstack-util/src/system_setup.rs +++ b/dstack/dstack-util/src/system_setup.rs @@ -592,7 +592,7 @@ impl<'a> GatewayContext<'a> { .tls_client_key(client_key.to_string()) .tls_ca_cert(ca_cert) .tls_built_in_root_certs(false) - .tls_no_check(gateway_app_id == "any") + .tls_skip_ca_verification(gateway_app_id == "any") .verify_server_attestation(false) .cert_validator(Box::new(move |cert| cert_validator.validate(cert))) .build() @@ -2437,7 +2437,7 @@ impl<'a> Stage0<'a> { generate_self_signed_ra_cert(None).context("Failed to generate RA-TLS cert")?; let attestation_verifier = attestation_verifier(&self.shared.sys_config)?; let ra_client = RaClientConfig::builder() - .tls_no_check(false) + .tls_skip_ca_verification(false) .tls_built_in_root_certs(false) .remote_uri(kms_url.clone()) .tls_client_cert(cert_pair.cert_pem) diff --git a/dstack/kms/src/onboard_service.rs b/dstack/kms/src/onboard_service.rs index 73a91a74d..480f9b62a 100644 --- a/dstack/kms/src/onboard_service.rs +++ b/dstack/kms/src/onboard_service.rs @@ -742,7 +742,7 @@ impl Keys { }; let (ra_cert, ra_key) = gen_ra_cert(tmp_ca).await?; let client = RaClientConfig::builder() - .tls_no_check(true) + .tls_skip_ca_verification(true) .tls_built_in_root_certs(false) .remote_uri(other_kms_url.to_string()) .tls_client_cert(ra_cert) diff --git a/dstack/ra-rpc/src/client.rs b/dstack/ra-rpc/src/client.rs index 9d4f60010..bd3a848f3 100644 --- a/dstack/ra-rpc/src/client.rs +++ b/dstack/ra-rpc/src/client.rs @@ -14,16 +14,12 @@ use ra_tls::{ traits::CertExt, }; use reqwest::{tls::TlsInfo, Certificate, Client, Identity, Response}; -use rustls::{ - client::danger::{HandshakeSignatureValid, ServerCertVerified, ServerCertVerifier}, - crypto::WebPkiSupportedAlgorithms, - pki_types::{CertificateDer, ServerName, UnixTime}, - DigitallySignedStruct, SignatureScheme, -}; use serde::{de::DeserializeOwned, Serialize}; use bon::Builder; +mod tls; + pub struct CertInfo { pub cert_der: Vec, pub attestation: Option, @@ -36,8 +32,10 @@ type CertValidator = Box) -> Result<()> + Send + Sync + #[derive(Builder)] pub struct RaClientConfig { remote_uri: String, + /// Skip CA-based certificate checks (trust chain, hostname, and validity). + /// TLS handshake signatures remain verified; attestation is checked separately. #[builder(default = false)] - tls_no_check: bool, + tls_skip_ca_verification: bool, #[builder(default = true)] verify_server_attestation: bool, #[builder(default = false)] @@ -62,8 +60,8 @@ impl RaClientConfig { if self.cert_validator.is_some() { builder = builder.tls_info(true); } - if self.tls_no_check { - builder = builder.use_preconfigured_tls(attestation_tls_config( + if self.tls_skip_ca_verification { + builder = builder.use_preconfigured_tls(tls::config( self.tls_client_cert.as_deref(), self.tls_client_key.as_deref(), )?); @@ -105,68 +103,6 @@ impl RaClientConfig { } } -/// Attestation is checked on the response, but TLS must still prove possession -/// of the attested certificate key. Reqwest's no-verifier also skips that proof. -#[derive(Debug)] -struct AttestationServerVerifier(WebPkiSupportedAlgorithms); - -impl ServerCertVerifier for AttestationServerVerifier { - fn verify_server_cert( - &self, - _end_entity: &CertificateDer<'_>, - _intermediates: &[CertificateDer<'_>], - _server_name: &ServerName<'_>, - _ocsp_response: &[u8], - _now: UnixTime, - ) -> Result { - Ok(ServerCertVerified::assertion()) - } - - fn verify_tls12_signature( - &self, - message: &[u8], - cert: &CertificateDer<'_>, - signature: &DigitallySignedStruct, - ) -> Result { - rustls::crypto::verify_tls12_signature(message, cert, signature, &self.0) - } - - fn verify_tls13_signature( - &self, - message: &[u8], - cert: &CertificateDer<'_>, - signature: &DigitallySignedStruct, - ) -> Result { - rustls::crypto::verify_tls13_signature(message, cert, signature, &self.0) - } - - fn supported_verify_schemes(&self) -> Vec { - self.0.supported_schemes() - } -} - -fn attestation_tls_config(cert: Option<&str>, key: Option<&str>) -> Result { - use rustls::pki_types::{pem::PemObject, PrivateKeyDer}; - let provider = rustls::crypto::CryptoProvider::get_default() - .cloned() - .unwrap_or_else(|| Arc::new(rustls::crypto::aws_lc_rs::default_provider())); - let verifier = AttestationServerVerifier(provider.signature_verification_algorithms); - let builder = rustls::ClientConfig::builder_with_provider(provider) - .with_safe_default_protocol_versions()? - .dangerous() - .with_custom_certificate_verifier(Arc::new(verifier)); - match (cert, key) { - (Some(cert), Some(key)) => builder - .with_client_auth_cert( - CertificateDer::pem_slice_iter(cert.as_bytes()).collect::, _>>()?, - PrivateKeyDer::from_pem_slice(key.as_bytes())?, - ) - .context("invalid RA-TLS client identity"), - (None, None) => Ok(builder.with_no_client_auth()), - _ => bail!("RA-TLS client identity requires both certificate and key"), - } -} - pub struct RaClient { remote_uri: String, attestation_verifier: Arc, @@ -177,9 +113,9 @@ pub struct RaClient { } impl RaClient { - pub fn new(remote_uri: String, tls_no_check: bool) -> Result { + pub fn new(remote_uri: String, tls_skip_ca_verification: bool) -> Result { RaClientConfig::builder() - .tls_no_check(tls_no_check) + .tls_skip_ca_verification(tls_skip_ca_verification) .remote_uri(remote_uri) .build() .into_client() diff --git a/dstack/ra-rpc/src/client/tls.rs b/dstack/ra-rpc/src/client/tls.rs new file mode 100644 index 000000000..03cb5f8dd --- /dev/null +++ b/dstack/ra-rpc/src/client/tls.rs @@ -0,0 +1,75 @@ +// SPDX-FileCopyrightText: © 2026 Phala Network +// +// SPDX-License-Identifier: Apache-2.0 + +use std::sync::Arc; + +use anyhow::{bail, Context, Result}; +use rustls::{ + client::danger::{HandshakeSignatureValid, ServerCertVerified, ServerCertVerifier}, + crypto::WebPkiSupportedAlgorithms, + pki_types::{CertificateDer, ServerName, UnixTime}, + DigitallySignedStruct, SignatureScheme, +}; + +/// Attestation is checked on the response, but TLS must still prove possession +/// of the attested certificate key. Reqwest's no-verifier also skips that proof. +#[derive(Debug)] +struct SkipCaVerification(WebPkiSupportedAlgorithms); + +impl ServerCertVerifier for SkipCaVerification { + fn verify_server_cert( + &self, + _end_entity: &CertificateDer<'_>, + _intermediates: &[CertificateDer<'_>], + _server_name: &ServerName<'_>, + _ocsp_response: &[u8], + _now: UnixTime, + ) -> Result { + Ok(ServerCertVerified::assertion()) + } + + fn verify_tls12_signature( + &self, + message: &[u8], + cert: &CertificateDer<'_>, + signature: &DigitallySignedStruct, + ) -> Result { + rustls::crypto::verify_tls12_signature(message, cert, signature, &self.0) + } + + fn verify_tls13_signature( + &self, + message: &[u8], + cert: &CertificateDer<'_>, + signature: &DigitallySignedStruct, + ) -> Result { + rustls::crypto::verify_tls13_signature(message, cert, signature, &self.0) + } + + fn supported_verify_schemes(&self) -> Vec { + self.0.supported_schemes() + } +} + +pub(super) fn config(cert: Option<&str>, key: Option<&str>) -> Result { + use rustls::pki_types::{pem::PemObject, PrivateKeyDer}; + let provider = rustls::crypto::CryptoProvider::get_default() + .cloned() + .unwrap_or_else(|| Arc::new(rustls::crypto::aws_lc_rs::default_provider())); + let verifier = SkipCaVerification(provider.signature_verification_algorithms); + let builder = rustls::ClientConfig::builder_with_provider(provider) + .with_safe_default_protocol_versions()? + .dangerous() + .with_custom_certificate_verifier(Arc::new(verifier)); + match (cert, key) { + (Some(cert), Some(key)) => builder + .with_client_auth_cert( + CertificateDer::pem_slice_iter(cert.as_bytes()).collect::, _>>()?, + PrivateKeyDer::from_pem_slice(key.as_bytes())?, + ) + .context("invalid RA-TLS client identity"), + (None, None) => Ok(builder.with_no_client_auth()), + _ => bail!("RA-TLS client identity requires both certificate and key"), + } +} diff --git a/dstack/ra-rpc/tests/server_key_possession.rs b/dstack/ra-rpc/tests/server_key_possession.rs index 10e2ba95b..eeb874af7 100644 --- a/dstack/ra-rpc/tests/server_key_possession.rs +++ b/dstack/ra-rpc/tests/server_key_possession.rs @@ -89,7 +89,7 @@ async fn check_key_possession(version: &'static rustls::SupportedProtocolVersion }); let client = RaClientConfig::builder() .remote_uri(format!("https://{address}")) - .tls_no_check(true) + .tls_skip_ca_verification(true) .tls_client_cert(client_cert.cert_pem()) .tls_client_key(client_cert.key_pem()) .verify_server_attestation(false) From a2cfb1fe8c5cf6ec7765f4ebd41b52d12711c21d Mon Sep 17 00:00:00 2001 From: Kevin Wang Date: Fri, 6 Nov 2026 20:10:30 -0800 Subject: [PATCH 4/4] refactor(ra-rpc): name the CA-bypassing TLS configuration explicitly Signed-off-by: Kevin Wang --- dstack/ra-rpc/src/client.rs | 2 +- dstack/ra-rpc/src/client/tls.rs | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/dstack/ra-rpc/src/client.rs b/dstack/ra-rpc/src/client.rs index bd3a848f3..b5c133fef 100644 --- a/dstack/ra-rpc/src/client.rs +++ b/dstack/ra-rpc/src/client.rs @@ -61,7 +61,7 @@ impl RaClientConfig { builder = builder.tls_info(true); } if self.tls_skip_ca_verification { - builder = builder.use_preconfigured_tls(tls::config( + builder = builder.use_preconfigured_tls(tls::config_without_ca_verification( self.tls_client_cert.as_deref(), self.tls_client_key.as_deref(), )?); diff --git a/dstack/ra-rpc/src/client/tls.rs b/dstack/ra-rpc/src/client/tls.rs index 03cb5f8dd..1bb9a2809 100644 --- a/dstack/ra-rpc/src/client/tls.rs +++ b/dstack/ra-rpc/src/client/tls.rs @@ -52,7 +52,10 @@ impl ServerCertVerifier for SkipCaVerification { } } -pub(super) fn config(cert: Option<&str>, key: Option<&str>) -> Result { +pub(super) fn config_without_ca_verification( + cert: Option<&str>, + key: Option<&str>, +) -> Result { use rustls::pki_types::{pem::PemObject, PrivateKeyDer}; let provider = rustls::crypto::CryptoProvider::get_default() .cloned()