From 9f4bbd7f034cf9c50f46f7c7a2f7202d1b5a9e9e Mon Sep 17 00:00:00 2001 From: Jose Quintana Date: Thu, 21 Apr 2022 23:01:20 +0200 Subject: [PATCH] refactor: update `tokio-rustls` to `v0.23` --- Cargo.lock | 39 ++++++++++++++++++++++++--------------- Cargo.toml | 3 ++- src/tls.rs | 52 ++++++++++++++++++++++++++++------------------------ 3 files changed, 54 insertions(+), 40 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index e6c88f4..7cd7654 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -34,9 +34,9 @@ dependencies = [ [[package]] name = "anyhow" -version = "1.0.56" +version = "1.0.57" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4361135be9122e0870de935d7c439aef945b9f9ddd4199a553b5270b49c82a27" +checksum = "08f9b8508dccb7687a1d6c4ce66b2b0ecef467c94667de27d8d7fe1f8d2a9cdc" [[package]] name = "async-compression" @@ -484,9 +484,9 @@ checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646" [[package]] name = "libc" -version = "0.2.123" +version = "0.2.124" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cb691a747a7ab48abc15c5b42066eaafde10dc427e3b6ee2a1cf43db04c763bd" +checksum = "21a41fed9d98f27ab1c6d161da622a4fa35e8a54a8adc24bbf3ddd0ef70b0e50" [[package]] name = "listenfd" @@ -738,11 +738,10 @@ dependencies = [ [[package]] name = "rustls" -version = "0.19.1" +version = "0.20.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "35edb675feee39aec9c99fa5ff985081995a06d594114ae14cbe797ad7b7a6d7" +checksum = "4fbfeb8d0ddb84706bc597a5574ab8912817c52a397f819e5b614e2265206921" dependencies = [ - "base64", "log", "ring", "sct", @@ -750,6 +749,15 @@ dependencies = [ ] [[package]] +name = "rustls-pemfile" +version = "0.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5eebeaeb360c87bfb72e84abdb3447159c0eaececf1bef2aecd65a8be949d1c9" +dependencies = [ + "base64", +] + +[[package]] name = "scopeguard" version = "1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" @@ -757,9 +765,9 @@ checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd" [[package]] name = "sct" -version = "0.6.1" +version = "0.7.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b362b83898e0e69f38515b82ee15aa80636befe47c3b6d3d89a911e78fc228ce" +checksum = "d53dcdb7c9f8158937a7981b48accfd39a43af418591a5d008c7b22b5e1b7ca4" dependencies = [ "ring", "untrusted", @@ -864,6 +872,7 @@ dependencies = [ "num_cpus", "percent-encoding", "pin-project", + "rustls-pemfile", "signal-hook", "signal-hook-tokio", "structopt", @@ -992,9 +1001,9 @@ dependencies = [ [[package]] name = "tokio-rustls" -version = "0.22.0" +version = "0.23.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bc6844de72e57df1980054b38be3a9f4702aba4858be64dd700181a8a6d0e1b6" +checksum = "4151fda0cf2798550ad0b34bcfc9b9dcc2a9d2471c895c68f3a8818e54f2389e" dependencies = [ "rustls", "tokio", @@ -1056,9 +1065,9 @@ dependencies = [ [[package]] name = "tracing-log" -version = "0.1.2" +version = "0.1.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a6923477a48e41c1951f1999ef8bb5a3023eb723ceadafe78ffb65dc366761e3" +checksum = "78ddad33d2d10b1ed7eb9d1f518a5674713876e97e5bb9b7345a7984fbb4f922" dependencies = [ "lazy_static", "log", @@ -1231,9 +1240,9 @@ dependencies = [ [[package]] name = "webpki" -version = "0.21.4" +version = "0.22.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b8e38c0608262c46d4a56202ebabdeb094cef7e560ca7a226c6bf055188aa4ea" +checksum = "f095d78192e208183081cc07bc5515ef55216397af48b873e5edcd72637fa1bd" dependencies = [ "ring", "untrusted", diff --git a/Cargo.toml b/Cargo.toml index 285b413..d88e041 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -45,7 +45,8 @@ pin-project = "1.0" structopt = { version = "0.3", default-features = false } time = { version = "0.1", default-features = false } tokio = { version = "1", default-features = false, features = ["rt-multi-thread", "macros", "fs", "io-util", "signal"] } -tokio-rustls = { version = "0.22" } +tokio-rustls = { version = "0.23" } +rustls-pemfile = "0.2" tokio-util = { version = "0.7", default-features = false, features = ["io"] } tracing = { version = "0.1", default-features = false, features = ["std"] } tracing-subscriber = { version = "0.3", default-features = false, features = ["smallvec", "parking_lot", "fmt", "ansi", "tracing-log"] } diff --git a/src/tls.rs b/src/tls.rs index e03a850..3701411 100644 --- a/src/tls.rs +++ b/src/tls.rs @@ -17,8 +17,8 @@ use hyper::server::conn::{AddrIncoming, AddrStream}; use crate::transport::Transport; use tokio_rustls::rustls::{ - AllowAnyAnonymousOrAuthenticatedClient, AllowAnyAuthenticatedClient, NoClientAuth, - RootCertStore, ServerConfig, TLSError, + server::{AllowAnyAnonymousOrAuthenticatedClient, AllowAnyAuthenticatedClient, NoClientAuth}, + Certificate, Error as TlsError, PrivateKey, RootCertStore, ServerConfig, }; /// Represents errors that can occur building the TlsConfig @@ -34,7 +34,7 @@ pub enum TlsConfigError { /// An error from an empty key EmptyKey, /// An error from an invalid key - InvalidKey(TLSError), + InvalidKey(TlsError), } impl std::fmt::Display for TlsConfigError { @@ -171,8 +171,11 @@ impl TlsConfigBuilder { pub fn build(mut self) -> Result { let mut cert_rdr = BufReader::new(self.cert); - let cert = tokio_rustls::rustls::internal::pemfile::certs(&mut cert_rdr) - .map_err(|()| TlsConfigError::CertParseError)?; + let cert = rustls_pemfile::certs(&mut cert_rdr) + .map_err(|_e| TlsConfigError::CertParseError)? + .into_iter() + .map(Certificate) + .collect(); let key = { // convert it to Vec to allow reading it again if key is RSA @@ -185,21 +188,17 @@ impl TlsConfigBuilder { return Err(TlsConfigError::EmptyKey); } - let mut pkcs8 = tokio_rustls::rustls::internal::pemfile::pkcs8_private_keys( - &mut key_vec.as_slice(), - ) - .map_err(|()| TlsConfigError::Pkcs8ParseError)?; + let mut pkcs8 = rustls_pemfile::pkcs8_private_keys(&mut key_vec.as_slice()) + .map_err(|_e| TlsConfigError::Pkcs8ParseError)?; if !pkcs8.is_empty() { - pkcs8.remove(0) + PrivateKey(pkcs8.remove(0)) } else { - let mut rsa = tokio_rustls::rustls::internal::pemfile::rsa_private_keys( - &mut key_vec.as_slice(), - ) - .map_err(|()| TlsConfigError::RsaParseError)?; + let mut rsa = rustls_pemfile::rsa_private_keys(&mut key_vec.as_slice()) + .map_err(|_e| TlsConfigError::RsaParseError)?; if !rsa.is_empty() { - rsa.remove(0) + PrivateKey(rsa.remove(0)) } else { return Err(TlsConfigError::EmptyKey); } @@ -209,13 +208,17 @@ impl TlsConfigBuilder { fn read_trust_anchor( trust_anchor: Box, ) -> Result { - let mut reader = BufReader::new(trust_anchor); + let trust_anchors = { + let mut reader = BufReader::new(trust_anchor); + rustls_pemfile::certs(&mut reader).map_err(TlsConfigError::Io)? + }; let mut store = RootCertStore::empty(); - if let Ok((0, _)) | Err(()) = store.add_pem_file(&mut reader) { - Err(TlsConfigError::CertParseError) - } else { - Ok(store) + let (added, _skipped) = store.add_parsable_certificates(&trust_anchors); + if added == 0 { + return Err(TlsConfigError::CertParseError); } + + Ok(store) } let client_auth = match self.client_auth { @@ -228,11 +231,12 @@ impl TlsConfigBuilder { } }; - let mut config = ServerConfig::new(client_auth); - config - .set_single_cert_with_ocsp_and_sct(cert, key, self.ocsp_resp, Vec::new()) + let mut config = ServerConfig::builder() + .with_safe_defaults() + .with_client_cert_verifier(client_auth) + .with_single_cert_with_ocsp_and_sct(cert, key, self.ocsp_resp, Vec::new()) .map_err(TlsConfigError::InvalidKey)?; - config.set_protocols(&["h2".into(), "http/1.1".into()]); + config.alpn_protocols = vec!["h2".into(), "http/1.1".into()]; Ok(config) } } -- libgit2 1.7.2