Don't panic on empty chain

Author: kazk

src/imp/openssl.rs

@@ -116,13 +116,15 @@ fn load_android_root_certs(connector: &mut SslContextBuilder) -> Result<(), Erro
 pub enum Error {
     Normal(ErrorStack),
     Ssl(ssl::Error, X509VerifyResult),
+    EmptyChain,
 }
 
 impl error::Error for Error {
     fn source(&self) -> Option<&(dyn error::Error + 'static)> {
         match *self {
             Error::Normal(ref e) => error::Error::source(e),
             Error::Ssl(ref e, _) => error::Error::source(e),
+            Error::EmptyChain => None,
         }
     }
 }
@@ -133,6 +135,10 @@ impl fmt::Display for Error {
             Error::Normal(ref e) => fmt::Display::fmt(e, fmt),
             Error::Ssl(ref e, X509VerifyResult::OK) => fmt::Display::fmt(e, fmt),
             Error::Ssl(ref e, v) => write!(fmt, "{} ({})", e, v),
+            Error::EmptyChain => write!(
+                fmt,
+                "at least one certificate must be provided to create an identity"
+            ),
         }
     }
 }
@@ -164,14 +170,9 @@ impl Identity {
     pub fn from_pkcs8(buf: &[u8], key: &[u8]) -> Result<Identity, Error> {
         let pkey = PKey::private_key_from_pem(key)?;
         let mut cert_chain = X509::stack_from_pem(buf)?.into_iter();
-        let cert = cert_chain.next();
+        let cert = cert_chain.next().ok_or(Error::EmptyChain)?;
         let chain = cert_chain.collect();
-        Ok(Identity {
-            pkey,
-            // an identity must have at least one certificate, the leaf cert
-            cert: cert.expect("at least one certificate must be provided to create an identity"),
-            chain,
-        })
+        Ok(Identity { pkey, cert, chain })
     }
 }
 

src/imp/schannel.rs

@@ -98,8 +98,18 @@ impl Identity {
     pub fn from_pkcs8(pem: &[u8], key: &[u8]) -> Result<Identity, Error> {
         let mut store = Memory::new()?.into_store();
         let mut cert_iter = pem::PemBlock::new(pem).into_iter();
-        let leaf = cert_iter.next().expect("at least one certificate must be provided to create an identity");
-        let cert = CertContext::from_pem(std::str::from_utf8(leaf).map_err(|_| io::Error::new(io::ErrorKind::InvalidInput, "leaf cert contains invalid utf8"))?)?;
+        let leaf = cert_iter.next().ok_or_else(|| {
+            io::Error::new(
+                io::ErrorKind::InvalidInput,
+                "at least one certificate must be provided to create an identity",
+            )
+        })?;
+        let cert = CertContext::from_pem(std::str::from_utf8(leaf).map_err(|_| {
+            io::Error::new(
+                io::ErrorKind::InvalidInput,
+                "leaf cert contains invalid utf8",
+            )
+        })?)?;
 
         let mut options = AcquireOptions::new();
         options.container("schannel");

src/imp/security_framework.rs

@@ -104,10 +104,14 @@ impl Identity {
             .keychain(&keychain)
             .import(&pem)?;
 
-        let ident = SecIdentity::with_certificate(&[keychain], &items.certificates[0])?;
+        let cert = items
+            .certificates
+            .get(0)
+            .ok_or_else(|| Error(base::Error::from(errSecParam)))?;
+        let ident = SecIdentity::with_certificate(&[keychain], cert)?;
         Ok(Identity {
             identity: ident,
-            chain: items.certificates
+            chain: items.certificates,
         })
     }