diff --git a/.gitignore b/.gitignore index 1e7caa9..e59fb83 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,3 @@ Cargo.lock target/ +/.idea diff --git a/Cargo.toml b/Cargo.toml index 80126d5..cfc5314 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "hyper-rustls" -version = "0.25.0-alpha.0" +version = "0.25.0" edition = "2021" rust-version = "1.63" license = "Apache-2.0 OR ISC OR MIT" @@ -14,18 +14,18 @@ documentation = "https://docs.rs/hyper-rustls/" http = "0.2" hyper = { version = "0.14", default-features = false, features = ["client"] } log = { version = "0.4.4", optional = true } -pki-types = { package = "rustls-pki-types", version = "0.2" } -rustls-native-certs = { version = "=0.7.0-alpha.3", optional = true } -rustls = { version = "=0.22.0-alpha.6", default-features = false } +pki-types = { package = "rustls-pki-types", version = "1" } +rustls-native-certs = { version = "0.7", optional = true } +rustls = { version = "0.22", default-features = false } tokio = "1.0" -tokio-rustls = { version = "=0.25.0-alpha.4", default-features = false } -webpki-roots = { version = "=0.26.0-alpha.2", optional = true } +tokio-rustls = { version = "0.25", default-features = false } +webpki-roots = { version = "0.26", optional = true } futures-util = { version = "0.3", default-features = false } [dev-dependencies] hyper = { version = "0.14", features = ["full"] } -rustls = { version = "=0.22.0-alpha.6", default-features = false, features = ["tls12"] } -rustls-pemfile = "=2.0.0-alpha.2" +rustls = { version = "0.22", default-features = false, features = ["tls12"] } +rustls-pemfile = "2" tokio = { version = "1.0", features = ["io-std", "macros", "net", "rt-multi-thread"] } [features] diff --git a/examples/client.rs b/examples/client.rs index 773715b..58c4c28 100644 --- a/examples/client.rs +++ b/examples/client.rs @@ -52,13 +52,11 @@ async fn run_client() -> io::Result<()> { roots.add_parsable_certificates(certs); // TLS client config using the custom CA store for lookups rustls::ClientConfig::builder() - .with_safe_defaults() .with_root_certificates(roots) .with_no_client_auth() } // Default TLS client config with native roots None => rustls::ClientConfig::builder() - .with_safe_defaults() .with_native_roots()? .with_no_client_auth(), }; diff --git a/src/acceptor/builder.rs b/src/acceptor/builder.rs index eb9f62a..a4b2231 100644 --- a/src/acceptor/builder.rs +++ b/src/acceptor/builder.rs @@ -22,9 +22,9 @@ impl AcceptorBuilder { AcceptorBuilder(WantsAlpn(config)) } - /// Use rustls [defaults][with_safe_defaults] without [client authentication][with_no_client_auth] + /// Use rustls default crypto provider and safe defaults without + /// [client authentication][with_no_client_auth] /// - /// [with_safe_defaults]: rustls::ConfigBuilder::with_safe_defaults /// [with_no_client_auth]: rustls::ConfigBuilder::with_no_client_auth pub fn with_single_cert( self, @@ -33,7 +33,6 @@ impl AcceptorBuilder { ) -> Result, rustls::Error> { Ok(AcceptorBuilder(WantsAlpn( ServerConfig::builder() - .with_safe_defaults() .with_no_client_auth() .with_single_cert(cert_chain, key_der)?, ))) diff --git a/src/connector/builder.rs b/src/connector/builder.rs index e3ea1e9..4e65f86 100644 --- a/src/connector/builder.rs +++ b/src/connector/builder.rs @@ -52,74 +52,64 @@ impl ConnectorBuilder { ConnectorBuilder(WantsSchemes { tls_config: config }) } - /// Shorthand for using rustls' [safe defaults][with_safe_defaults] - /// and native roots + /// Shorthand for using rustls' default crypto provider and safe defaults, with + /// native roots. /// /// See [`ConfigBuilderExt::with_native_roots`] - /// - /// [with_safe_defaults]: rustls::ConfigBuilder::with_safe_defaults #[cfg(all(feature = "ring", feature = "rustls-native-certs"))] pub fn with_native_roots(self) -> std::io::Result> { Ok(self.with_tls_config( ClientConfig::builder() - .with_safe_defaults() .with_native_roots()? .with_no_client_auth(), )) } - /// Shorthand for using rustls' [safe defaults][with_safe_defaults] - /// with a custom [`CryptoProvider`] and native roots + /// Shorthand for using a custom [`CryptoProvider`] and native roots /// /// See [`ConfigBuilderExt::with_native_roots`] - /// - /// [with_safe_defaults]: rustls::ConfigBuilder::with_safe_defaults #[cfg(feature = "rustls-native-certs")] pub fn with_provider_and_native_roots( self, - provider: &'static dyn CryptoProvider, + provider: CryptoProvider, ) -> std::io::Result> { Ok(self.with_tls_config( - ClientConfig::builder_with_provider(provider) - .with_safe_defaults() + ClientConfig::builder_with_provider(provider.into()) + .with_safe_default_protocol_versions() + .map_err(|e| std::io::Error::new(std::io::ErrorKind::Other, e))? .with_native_roots()? .with_no_client_auth(), )) } - /// Shorthand for using rustls' [safe defaults][with_safe_defaults] - /// and Mozilla roots + /// Shorthand for using rustls' default crypto provider and its + /// safe defaults. /// /// See [`ConfigBuilderExt::with_webpki_roots`] - /// - /// [with_safe_defaults]: rustls::ConfigBuilder::with_safe_defaults #[cfg(all(feature = "ring", feature = "webpki-roots"))] pub fn with_webpki_roots(self) -> ConnectorBuilder { self.with_tls_config( ClientConfig::builder() - .with_safe_defaults() .with_webpki_roots() .with_no_client_auth(), ) } - /// Shorthand for using rustls' [safe defaults][with_safe_defaults] - /// with a custom [`CryptoProvider`] and Mozilla roots + /// Shorthand for using a custom [`CryptoProvider`], Rustls' safe default + /// protocol versions and Mozilla roots /// /// See [`ConfigBuilderExt::with_webpki_roots`] - /// - /// [with_safe_defaults]: rustls::ConfigBuilder::with_safe_defaults #[cfg(feature = "webpki-roots")] pub fn with_provider_and_webpki_roots( self, - provider: &'static dyn CryptoProvider, - ) -> ConnectorBuilder { - self.with_tls_config( - ClientConfig::builder_with_provider(provider) - .with_safe_defaults() + provider: CryptoProvider, + ) -> Result, rustls::Error> { + Ok(self.with_tls_config( + ClientConfig::builder_with_provider(provider.into()) + .with_safe_default_protocol_versions()? .with_webpki_roots() .with_no_client_auth(), - ) + )) } } @@ -331,7 +321,6 @@ mod tests { fn test_reject_predefined_alpn() { let roots = rustls::RootCertStore::empty(); let mut config_with_alpn = rustls::ClientConfig::builder() - .with_safe_defaults() .with_root_certificates(roots) .with_no_client_auth(); config_with_alpn.alpn_protocols = vec![b"fancyprotocol".to_vec()]; @@ -347,7 +336,6 @@ mod tests { fn test_alpn() { let roots = rustls::RootCertStore::empty(); let tls_config = rustls::ClientConfig::builder() - .with_safe_defaults() .with_root_certificates(roots) .with_no_client_auth(); let connector = super::ConnectorBuilder::new()