Skip to content

Provide template configurations and helpers for TcpTls transport #126

@mempirate

Description

@mempirate

Description

Right now, the TLS transport doesn't provide a lot of "template" configuration, and consumers have to specify the openSSL config themselves. In the tests, we can see what this looks like:

mod helpers {
use std::{path::PathBuf, str::FromStr as _};
use openssl::ssl::{
SslAcceptor, SslAcceptorBuilder, SslConnector, SslConnectorBuilder, SslFiletype, SslMethod,
};
/// Creates a default SSL acceptor builder for testing, with a trusted CA.
pub fn default_acceptor_builder() -> SslAcceptorBuilder {
let certificate_path =
PathBuf::from_str("../testdata/certificates/server-cert.pem").unwrap();
let private_key_path =
PathBuf::from_str("../testdata/certificates/server-key.pem").unwrap();
let ca_certificate_path =
PathBuf::from_str("../testdata/certificates/ca-cert.pem").unwrap();
assert!(certificate_path.exists(), "Certificate file does not exist");
assert!(private_key_path.exists(), "Private key file does not exist");
assert!(ca_certificate_path.exists(), "CA Certificate file does not exist");
let mut acceptor_builder = SslAcceptor::mozilla_intermediate(SslMethod::tls()).unwrap();
acceptor_builder.set_certificate_file(certificate_path, SslFiletype::PEM).unwrap();
acceptor_builder.set_private_key_file(private_key_path, SslFiletype::PEM).unwrap();
acceptor_builder.set_ca_file(ca_certificate_path).unwrap();
acceptor_builder
}
/// Creates a default SSL connector builder for testing, with a trusted CA.
/// It also has client certificate and private key set for mTLS testing.
pub fn default_connector_builder() -> SslConnectorBuilder {
let certificate_path =
PathBuf::from_str("../testdata/certificates/client-cert.pem").unwrap();
let private_key_path =
PathBuf::from_str("../testdata/certificates/client-key.pem").unwrap();
let ca_certificate_path =
PathBuf::from_str("../testdata/certificates/ca-cert.pem").unwrap();
assert!(certificate_path.exists(), "Certificate file does not exist");
assert!(private_key_path.exists(), "Private key file does not exist");
assert!(ca_certificate_path.exists(), "CA Certificate file does not exist");
let mut connector_builder = SslConnector::builder(SslMethod::tls()).unwrap();
connector_builder.set_certificate_file(certificate_path, SslFiletype::PEM).unwrap();
connector_builder.set_private_key_file(private_key_path, SslFiletype::PEM).unwrap();
connector_builder.set_ca_file(ca_certificate_path).unwrap();
connector_builder
}
}

For ease of use, it would be nice to have some opinionated template configurations that are easy to use. So consumers do not have to even import openSSL configuration types, but can use whatever we provide. Stuff like:

  • server: quick server setup that just requires certs to get started, nothing additional required
  • client: dangerous authentication for self-signed certificates
  • client: client auth wrappers?

For power users, we may want to preserve lower level configuration though.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions