-
Notifications
You must be signed in to change notification settings - Fork 12
Open
Labels
Description
Description
Right now, the TLS transport doesn't provide a lot of "template" configuration, and consumers have to specify the openSSL config themselves. In the tests, we can see what this looks like:
msg-rs/msg-socket/tests/it/reqrep.rs
Lines 12 to 60 in 5124830
| mod helpers { | |
| use std::{path::PathBuf, str::FromStr as _}; | |
| use openssl::ssl::{ | |
| SslAcceptor, SslAcceptorBuilder, SslConnector, SslConnectorBuilder, SslFiletype, SslMethod, | |
| }; | |
| /// Creates a default SSL acceptor builder for testing, with a trusted CA. | |
| pub fn default_acceptor_builder() -> SslAcceptorBuilder { | |
| let certificate_path = | |
| PathBuf::from_str("../testdata/certificates/server-cert.pem").unwrap(); | |
| let private_key_path = | |
| PathBuf::from_str("../testdata/certificates/server-key.pem").unwrap(); | |
| let ca_certificate_path = | |
| PathBuf::from_str("../testdata/certificates/ca-cert.pem").unwrap(); | |
| assert!(certificate_path.exists(), "Certificate file does not exist"); | |
| assert!(private_key_path.exists(), "Private key file does not exist"); | |
| assert!(ca_certificate_path.exists(), "CA Certificate file does not exist"); | |
| let mut acceptor_builder = SslAcceptor::mozilla_intermediate(SslMethod::tls()).unwrap(); | |
| acceptor_builder.set_certificate_file(certificate_path, SslFiletype::PEM).unwrap(); | |
| acceptor_builder.set_private_key_file(private_key_path, SslFiletype::PEM).unwrap(); | |
| acceptor_builder.set_ca_file(ca_certificate_path).unwrap(); | |
| acceptor_builder | |
| } | |
| /// Creates a default SSL connector builder for testing, with a trusted CA. | |
| /// It also has client certificate and private key set for mTLS testing. | |
| pub fn default_connector_builder() -> SslConnectorBuilder { | |
| let certificate_path = | |
| PathBuf::from_str("../testdata/certificates/client-cert.pem").unwrap(); | |
| let private_key_path = | |
| PathBuf::from_str("../testdata/certificates/client-key.pem").unwrap(); | |
| let ca_certificate_path = | |
| PathBuf::from_str("../testdata/certificates/ca-cert.pem").unwrap(); | |
| assert!(certificate_path.exists(), "Certificate file does not exist"); | |
| assert!(private_key_path.exists(), "Private key file does not exist"); | |
| assert!(ca_certificate_path.exists(), "CA Certificate file does not exist"); | |
| let mut connector_builder = SslConnector::builder(SslMethod::tls()).unwrap(); | |
| connector_builder.set_certificate_file(certificate_path, SslFiletype::PEM).unwrap(); | |
| connector_builder.set_private_key_file(private_key_path, SslFiletype::PEM).unwrap(); | |
| connector_builder.set_ca_file(ca_certificate_path).unwrap(); | |
| connector_builder | |
| } | |
| } |
For ease of use, it would be nice to have some opinionated template configurations that are easy to use. So consumers do not have to even import openSSL configuration types, but can use whatever we provide. Stuff like:
- server: quick server setup that just requires certs to get started, nothing additional required
- client: dangerous authentication for self-signed certificates
- client: client auth wrappers?
For power users, we may want to preserve lower level configuration though.