Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

hyper-rustls 0.25 prep, rustls 0.22 update #242

Merged
merged 3 commits into from
Dec 6, 2023
Merged

hyper-rustls 0.25 prep, rustls 0.22 update #242

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
70a1a24
proj: git ignore .idea
cpu Dec 2, 2023
cac05d4
Cargo: update to rustls 0.22
cpu Dec 2, 2023
d2d8cd9
Cargo: version 0.25.0-alpha.0 -> 0.25
cpu Dec 2, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,3 @@
Cargo.lock
target/
/.idea
16 changes: 8 additions & 8 deletions Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
[package]
name = "hyper-rustls"
version = "0.25.0-alpha.0"
version = "0.25.0"
edition = "2021"
rust-version = "1.63"
license = "Apache-2.0 OR ISC OR MIT"
Expand All @@ -14,18 +14,18 @@ documentation = "https://docs.rs/hyper-rustls/"
http = "0.2"
hyper = { version = "0.14", default-features = false, features = ["client"] }
log = { version = "0.4.4", optional = true }
pki-types = { package = "rustls-pki-types", version = "0.2" }
rustls-native-certs = { version = "=0.7.0-alpha.3", optional = true }
rustls = { version = "=0.22.0-alpha.6", default-features = false }
pki-types = { package = "rustls-pki-types", version = "1" }
rustls-native-certs = { version = "0.7", optional = true }
rustls = { version = "0.22", default-features = false }
tokio = "1.0"
tokio-rustls = { version = "=0.25.0-alpha.4", default-features = false }
webpki-roots = { version = "=0.26.0-alpha.2", optional = true }
tokio-rustls = { version = "0.25", default-features = false }
webpki-roots = { version = "0.26", optional = true }
futures-util = { version = "0.3", default-features = false }

[dev-dependencies]
hyper = { version = "0.14", features = ["full"] }
rustls = { version = "=0.22.0-alpha.6", default-features = false, features = ["tls12"] }
rustls-pemfile = "=2.0.0-alpha.2"
rustls = { version = "0.22", default-features = false, features = ["tls12"] }
rustls-pemfile = "2"
tokio = { version = "1.0", features = ["io-std", "macros", "net", "rt-multi-thread"] }

[features]
Expand Down
2 changes: 0 additions & 2 deletions examples/client.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,13 +52,11 @@ async fn run_client() -> io::Result<()> {
roots.add_parsable_certificates(certs);
// TLS client config using the custom CA store for lookups
rustls::ClientConfig::builder()
.with_safe_defaults()
.with_root_certificates(roots)
.with_no_client_auth()
}
// Default TLS client config with native roots
None => rustls::ClientConfig::builder()
.with_safe_defaults()
.with_native_roots()?
.with_no_client_auth(),
};
Expand Down
5 changes: 2 additions & 3 deletions src/acceptor/builder.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,9 +22,9 @@ impl AcceptorBuilder<WantsTlsConfig> {
AcceptorBuilder(WantsAlpn(config))
}

/// Use rustls [defaults][with_safe_defaults] without [client authentication][with_no_client_auth]
/// Use rustls default crypto provider and safe defaults without
Copy link
Member Author

@cpu cpu Dec 2, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think some of these doc updates in this branch that lose the doc link to the removed with_safe_defaults would benefit from pointing at the ring::default_provider fn where we could document the safe defaults better.

I'll chase this down before merge.

/// [client authentication][with_no_client_auth]
///
/// [with_safe_defaults]: rustls::ConfigBuilder::with_safe_defaults
/// [with_no_client_auth]: rustls::ConfigBuilder::with_no_client_auth
pub fn with_single_cert(
self,
Expand All @@ -33,7 +33,6 @@ impl AcceptorBuilder<WantsTlsConfig> {
) -> Result<AcceptorBuilder<WantsAlpn>, rustls::Error> {
Ok(AcceptorBuilder(WantsAlpn(
ServerConfig::builder()
.with_safe_defaults()
.with_no_client_auth()
.with_single_cert(cert_chain, key_der)?,
)))
Expand Down
46 changes: 17 additions & 29 deletions src/connector/builder.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,74 +52,64 @@ impl ConnectorBuilder<WantsTlsConfig> {
ConnectorBuilder(WantsSchemes { tls_config: config })
}

/// Shorthand for using rustls' [safe defaults][with_safe_defaults]
/// and native roots
/// Shorthand for using rustls' default crypto provider and safe defaults, with
/// native roots.
cpu marked this conversation as resolved.
Show resolved Hide resolved
///
/// See [`ConfigBuilderExt::with_native_roots`]
///
/// [with_safe_defaults]: rustls::ConfigBuilder::with_safe_defaults
#[cfg(all(feature = "ring", feature = "rustls-native-certs"))]
pub fn with_native_roots(self) -> std::io::Result<ConnectorBuilder<WantsSchemes>> {
Ok(self.with_tls_config(
ClientConfig::builder()
.with_safe_defaults()
.with_native_roots()?
.with_no_client_auth(),
))
}

/// Shorthand for using rustls' [safe defaults][with_safe_defaults]
/// with a custom [`CryptoProvider`] and native roots
/// Shorthand for using a custom [`CryptoProvider`] and native roots
///
/// See [`ConfigBuilderExt::with_native_roots`]
///
/// [with_safe_defaults]: rustls::ConfigBuilder::with_safe_defaults
#[cfg(feature = "rustls-native-certs")]
pub fn with_provider_and_native_roots(
self,
provider: &'static dyn CryptoProvider,
provider: CryptoProvider,
) -> std::io::Result<ConnectorBuilder<WantsSchemes>> {
Ok(self.with_tls_config(
ClientConfig::builder_with_provider(provider)
.with_safe_defaults()
ClientConfig::builder_with_provider(provider.into())
.with_safe_default_protocol_versions()
.map_err(|e| std::io::Error::new(std::io::ErrorKind::Other, e))?
.with_native_roots()?
.with_no_client_auth(),
))
}

/// Shorthand for using rustls' [safe defaults][with_safe_defaults]
/// and Mozilla roots
/// Shorthand for using rustls' default crypto provider and its
/// safe defaults.
///
/// See [`ConfigBuilderExt::with_webpki_roots`]
///
/// [with_safe_defaults]: rustls::ConfigBuilder::with_safe_defaults
#[cfg(all(feature = "ring", feature = "webpki-roots"))]
pub fn with_webpki_roots(self) -> ConnectorBuilder<WantsSchemes> {
self.with_tls_config(
ClientConfig::builder()
.with_safe_defaults()
.with_webpki_roots()
.with_no_client_auth(),
)
}

/// Shorthand for using rustls' [safe defaults][with_safe_defaults]
/// with a custom [`CryptoProvider`] and Mozilla roots
/// Shorthand for using a custom [`CryptoProvider`], Rustls' safe default
/// protocol versions and Mozilla roots
///
/// See [`ConfigBuilderExt::with_webpki_roots`]
///
/// [with_safe_defaults]: rustls::ConfigBuilder::with_safe_defaults
#[cfg(feature = "webpki-roots")]
pub fn with_provider_and_webpki_roots(
self,
provider: &'static dyn CryptoProvider,
) -> ConnectorBuilder<WantsSchemes> {
self.with_tls_config(
ClientConfig::builder_with_provider(provider)
.with_safe_defaults()
provider: CryptoProvider,
) -> Result<ConnectorBuilder<WantsSchemes>, rustls::Error> {
Ok(self.with_tls_config(
ClientConfig::builder_with_provider(provider.into())
.with_safe_default_protocol_versions()?
.with_webpki_roots()
.with_no_client_auth(),
)
))
}
}

Expand Down Expand Up @@ -331,7 +321,6 @@ mod tests {
fn test_reject_predefined_alpn() {
let roots = rustls::RootCertStore::empty();
let mut config_with_alpn = rustls::ClientConfig::builder()
.with_safe_defaults()
.with_root_certificates(roots)
.with_no_client_auth();
config_with_alpn.alpn_protocols = vec![b"fancyprotocol".to_vec()];
Expand All @@ -347,7 +336,6 @@ mod tests {
fn test_alpn() {
let roots = rustls::RootCertStore::empty();
let tls_config = rustls::ClientConfig::builder()
.with_safe_defaults()
.with_root_certificates(roots)
.with_no_client_auth();
let connector = super::ConnectorBuilder::new()
Expand Down