@@ -34,7 +34,9 @@ type Certify = Box<
3434 > + Send ,
3535> ;
3636
37- const TLS_VERSIONS : & [ rustls:: ProtocolVersion ] = & [ rustls:: ProtocolVersion :: TLSv1_3 ] ;
37+ static TLS_VERSIONS : & [ & rustls:: SupportedProtocolVersion ] = & [ & rustls:: version:: TLS13 ] ;
38+ static TLS_SUPPORTED_CIPHERSUITES : & [ rustls:: SupportedCipherSuite ] =
39+ & [ rustls:: cipher_suite:: TLS13_CHACHA20_POLY1305_SHA256 ] ;
3840
3941struct Certificates {
4042 pub leaf : Vec < u8 > ,
@@ -48,14 +50,11 @@ impl Certificates {
4850 {
4951 let f = fs:: File :: open ( p) ?;
5052 let mut r = io:: BufReader :: new ( f) ;
51- let certs = rustls :: internal :: pemfile :: certs ( & mut r)
53+ let mut certs = rustls_pemfile :: certs ( & mut r)
5254 . map_err ( |_| io:: Error :: new ( io:: ErrorKind :: Other , "rustls error reading certs" ) ) ?;
53- let leaf = certs
54- . get ( 0 )
55- . ok_or_else ( || io:: Error :: new ( io:: ErrorKind :: Other , "no certs in pemfile" ) ) ?
56- . as_ref ( )
57- . into ( ) ;
58- let intermediates = certs[ 1 ..] . iter ( ) . map ( |i| i. as_ref ( ) . into ( ) ) . collect ( ) ;
55+ let mut certs = certs. drain ( ..) ;
56+ let leaf = certs. next ( ) . expect ( "no leaf cert in pemfile" ) ;
57+ let intermediates = certs. collect ( ) ;
5958
6059 Ok ( Certificates {
6160 leaf,
@@ -95,21 +94,30 @@ impl Identity {
9594 ) -> ( Arc < rustls:: ClientConfig > , Arc < rustls:: ServerConfig > ) {
9695 use std:: io:: Cursor ;
9796 let mut roots = rustls:: RootCertStore :: empty ( ) ;
98- roots
99- . add_pem_file ( & mut Cursor :: new ( trust_anchors) )
100- . expect ( "add pem file" ) ;
101-
102- let mut client_config = rustls:: ClientConfig :: new ( ) ;
103- client_config. root_store = roots;
104-
105- let mut server_config = rustls:: ServerConfig :: new (
106- rustls:: AllowAnyAnonymousOrAuthenticatedClient :: new ( client_config. root_store . clone ( ) ) ,
107- ) ;
108-
109- server_config. versions = TLS_VERSIONS . to_vec ( ) ;
110- server_config
111- . set_single_cert ( certs. chain ( ) , key)
112- . expect ( "set server resover" ) ;
97+ let trust_anchors =
98+ rustls_pemfile:: certs ( & mut Cursor :: new ( trust_anchors) ) . expect ( "error parsing pemfile" ) ;
99+ let ( added, skipped) = roots. add_parsable_certificates ( & trust_anchors[ ..] ) ;
100+ assert_ne ! ( added, 0 , "trust anchors must include at least one cert" ) ;
101+ assert_eq ! ( skipped, 0 , "no certs in pemfile should be invalid" ) ;
102+
103+ let client_config = rustls:: ClientConfig :: builder ( )
104+ . with_cipher_suites ( TLS_SUPPORTED_CIPHERSUITES )
105+ . with_safe_default_kx_groups ( )
106+ . with_protocol_versions ( TLS_VERSIONS )
107+ . expect ( "client config must be valid" )
108+ . with_root_certificates ( roots. clone ( ) )
109+ . with_no_client_auth ( ) ;
110+
111+ let server_config = rustls:: ServerConfig :: builder ( )
112+ . with_cipher_suites ( TLS_SUPPORTED_CIPHERSUITES )
113+ . with_safe_default_kx_groups ( )
114+ . with_protocol_versions ( TLS_VERSIONS )
115+ . expect ( "server config must be valid" )
116+ . with_client_cert_verifier ( rustls:: server:: AllowAnyAnonymousOrAuthenticatedClient :: new (
117+ roots,
118+ ) )
119+ . with_single_cert ( certs. chain ( ) , key)
120+ . unwrap ( ) ;
113121
114122 ( Arc :: new ( client_config) , Arc :: new ( server_config) )
115123 }
0 commit comments