take rustls 0.23.14+, use pki-types for PEM

Sets the minimum rustls version to 0.23.14 to ensure pki-types 1.10 is
re-exported. This is the version that added the PEM decoder bits that
allow removing a dependency on rustls-pemfile.

Author: cpu

Cargo.lock

@@ -14,5 +14,4 @@ env_logger = "0.10"
 log = "0.4"
 openssl-probe = "0.1"
 openssl-sys = "0.9"
-rustls = "0.23"
-rustls-pemfile = "2"
+rustls = "0.23.14"

Cargo.toml

@@ -9,13 +9,6 @@ use std::os::raw::{c_char, c_int, c_long, c_uchar, c_uint, c_void};
 use std::sync::Arc;
 use std::{fs, path::PathBuf};
 
-use openssl_sys::{
-    stack_st_SSL_CIPHER, stack_st_X509, stack_st_X509_NAME, stack_st_void, NID_undef,
-    OPENSSL_malloc, TLSEXT_NAMETYPE_host_name, BIGNUM, EVP_CIPHER_CTX, EVP_PKEY, HMAC_CTX,
-    OPENSSL_NPN_NEGOTIATED, OPENSSL_NPN_NO_OVERLAP, X509, X509_STORE, X509_STORE_CTX,
-};
-use rustls::pki_types::{CertificateDer, PrivatePkcs8KeyDer};
-
 use crate::bio::{Bio, BIO, BIO_METHOD};
 use crate::callbacks::SslCallbackContext;
 use crate::constants::{named_group_to_nid, sig_scheme_to_type_nid};
@@ -31,6 +24,13 @@ use crate::not_thread_safe::NotThreadSafe;
 use crate::sign::OpenSslCertifiedKey;
 use crate::x509::{load_certs, OwnedX509, OwnedX509Stack};
 use crate::{conf, HandshakeState, ShutdownResult};
+use openssl_sys::{
+    stack_st_SSL_CIPHER, stack_st_X509, stack_st_X509_NAME, stack_st_void, NID_undef,
+    OPENSSL_malloc, TLSEXT_NAMETYPE_host_name, BIGNUM, EVP_CIPHER_CTX, EVP_PKEY, HMAC_CTX,
+    OPENSSL_NPN_NEGOTIATED, OPENSSL_NPN_NO_OVERLAP, X509, X509_STORE, X509_STORE_CTX,
+};
+use rustls::pki_types::pem::PemObject;
+use rustls::pki_types::{CertificateDer, PrivateKeyDer, PrivatePkcs8KeyDer};
 
 /// Makes a entry function definition.
 ///
@@ -462,12 +462,12 @@ pub(crate) fn use_cert_chain_file(file_name: &str) -> Result<Vec<CertificateDer<
     };
 
     let mut chain = Vec::new();
-    for cert in rustls_pemfile::certs(&mut file_reader) {
+    for cert in CertificateDer::pem_reader_iter(&mut file_reader) {
         let cert = match cert {
             Ok(cert) => cert,
             Err(err) => {
                 log::trace!("Failed to parse {file_name:?}: {err:?}");
-                return Err(Error::from_io(err));
+                return Err(Error::from_pem(err));
             }
         };
 
@@ -507,15 +507,11 @@ pub(crate) fn use_private_key_file(file_name: &str, file_type: c_int) -> Result<
                 Err(err) => return Err(Error::from_io(err)),
             };
 
-            match rustls_pemfile::private_key(&mut file_reader) {
-                Ok(Some(key)) => key,
-                Ok(None) => {
-                    log::trace!("No keys found in {file_name:?}");
-                    return Err(Error::bad_data("pem file"));
-                }
+            match PrivateKeyDer::from_pem_reader(&mut file_reader) {
+                Ok(key) => key,
                 Err(err) => {
                     log::trace!("Failed to read {file_name:?}: {err:?}");
-                    return Err(Error::from_io(err));
+                    return Err(Error::from_pem(err));
                 }
             }
         }

src/entry.rs

@@ -3,6 +3,7 @@ use core::ptr;
 use std::ffi::CString;
 
 use openssl_sys::{ERR_new, ERR_set_error, ERR_RFLAGS_OFFSET, ERR_RFLAG_FATAL};
+use rustls::pki_types::pem;
 use rustls::AlertDescription;
 
 // See openssl/err.h for the source of these magic numbers.
@@ -100,6 +101,14 @@ impl Error {
         }
     }
 
+    pub fn from_pem(err: pem::Error) -> Self {
+        Self {
+            lib: Lib::User,
+            reason: Reason::OperationFailed,
+            string: Some(err.to_string()),
+        }
+    }
+
     pub fn from_io(err: std::io::Error) -> Self {
         match err.kind() {
             std::io::ErrorKind::WouldBlock => Self {

src/error.rs

@@ -3,15 +3,15 @@ use core::{ptr, slice};
 use std::path::PathBuf;
 use std::{fs, io};
 
+use crate::error::Error;
 use openssl_sys::{
     d2i_X509, i2d_X509, stack_st_X509, OPENSSL_free, OPENSSL_sk_new_null, OPENSSL_sk_num,
     OPENSSL_sk_push, OPENSSL_sk_value, X509_STORE_free, X509_STORE_new, X509_free, OPENSSL_STACK,
     X509, X509_STORE,
 };
+use rustls::pki_types::pem::PemObject;
 use rustls::pki_types::CertificateDer;
 
-use crate::error::Error;
-
 /// Safe, owning wrapper around an OpenSSL `STACK_OF(X509)` object.
 ///
 /// The items are owned by the stack.
@@ -273,12 +273,12 @@ pub(crate) fn load_certs<'a>(
             Err(err) => return Err(Error::from_io(err).raise()),
         };
 
-        for cert in rustls_pemfile::certs(&mut file_reader) {
+        for cert in CertificateDer::pem_reader_iter(&mut file_reader) {
             match cert {
                 Ok(cert) => certs.push(cert),
                 Err(err) => {
                     log::trace!("Failed to parse {file_name:?}: {err:?}");
-                    return Err(Error::from_io(err).raise());
+                    return Err(Error::from_pem(err).raise());
                 }
             };
         }