Skip to content

Commit 500dc3a

Browse files
hawkwolix0r
andauthored
meshtls-rustls: update to rustls 0.20 and tokio-rustls 0.23 (#1362)
This branch updates linkerd-meshtls-rustls to use rustls version 0.20, tokio-rustls 0.23, and webpki 0.22. Co-authored-by: Oliver Gould <[email protected]>
1 parent 50003a4 commit 500dc3a

File tree

14 files changed

+262
-160
lines changed

14 files changed

+262
-160
lines changed

Cargo.lock

Lines changed: 19 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -945,6 +945,7 @@ dependencies = [
945945
"linkerd-tracing",
946946
"linkerd2-proxy-api",
947947
"regex",
948+
"rustls-pemfile",
948949
"socket2 0.4.2",
949950
"tokio",
950951
"tokio-rustls",
@@ -953,7 +954,6 @@ dependencies = [
953954
"tower",
954955
"tracing",
955956
"tracing-subscriber",
956-
"webpki",
957957
]
958958

959959
[[package]]
@@ -1235,6 +1235,7 @@ dependencies = [
12351235
"linkerd-tls",
12361236
"linkerd-tls-test-util",
12371237
"ring",
1238+
"rustls-pemfile",
12381239
"thiserror",
12391240
"tokio",
12401241
"tokio-rustls",
@@ -2171,17 +2172,25 @@ dependencies = [
21712172

21722173
[[package]]
21732174
name = "rustls"
2174-
version = "0.19.1"
2175+
version = "0.20.0"
21752176
source = "registry+https://github.com/rust-lang/crates.io-index"
2176-
checksum = "35edb675feee39aec9c99fa5ff985081995a06d594114ae14cbe797ad7b7a6d7"
2177+
checksum = "9b5ac6078ca424dc1d3ae2328526a76787fecc7f8011f520e3276730e711fc95"
21772178
dependencies = [
2178-
"base64",
21792179
"log",
21802180
"ring",
21812181
"sct",
21822182
"webpki",
21832183
]
21842184

2185+
[[package]]
2186+
name = "rustls-pemfile"
2187+
version = "0.2.1"
2188+
source = "registry+https://github.com/rust-lang/crates.io-index"
2189+
checksum = "5eebeaeb360c87bfb72e84abdb3447159c0eaececf1bef2aecd65a8be949d1c9"
2190+
dependencies = [
2191+
"base64",
2192+
]
2193+
21852194
[[package]]
21862195
name = "ryu"
21872196
version = "1.0.5"
@@ -2196,9 +2205,9 @@ checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
21962205

21972206
[[package]]
21982207
name = "sct"
2199-
version = "0.6.1"
2208+
version = "0.7.0"
22002209
source = "registry+https://github.com/rust-lang/crates.io-index"
2201-
checksum = "b362b83898e0e69f38515b82ee15aa80636befe47c3b6d3d89a911e78fc228ce"
2210+
checksum = "d53dcdb7c9f8158937a7981b48accfd39a43af418591a5d008c7b22b5e1b7ca4"
22022211
dependencies = [
22032212
"ring",
22042213
"untrusted",
@@ -2446,9 +2455,9 @@ dependencies = [
24462455

24472456
[[package]]
24482457
name = "tokio-rustls"
2449-
version = "0.22.0"
2458+
version = "0.23.1"
24502459
source = "registry+https://github.com/rust-lang/crates.io-index"
2451-
checksum = "bc6844de72e57df1980054b38be3a9f4702aba4858be64dd700181a8a6d0e1b6"
2460+
checksum = "4baa378e417d780beff82bf54ceb0d195193ea6a00c14e22359e7f39456b5689"
24522461
dependencies = [
24532462
"rustls",
24542463
"tokio",
@@ -2866,8 +2875,8 @@ dependencies = [
28662875

28672876
[[package]]
28682877
name = "webpki"
2869-
version = "0.21.4"
2870-
source = "git+https://github.com/linkerd/webpki?branch=cert-dns-names-0.21#a4acca51d3dab4c99680e570dd4498b0c8b13b94"
2878+
version = "0.22.0"
2879+
source = "git+https://github.com/linkerd/webpki?branch=cert-dns-names-0.22#a26def03ec88d3b69542ccd2f0073369ecedc4f9"
28712880
dependencies = [
28722881
"ring",
28732882
"untrusted",

Cargo.toml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,4 +76,4 @@ debug = false
7676
lto = true
7777

7878
[patch.crates-io]
79-
webpki = { git = "https://github.com/linkerd/webpki", branch = "cert-dns-names-0.21" }
79+
webpki = { git = "https://github.com/linkerd/webpki", branch = "cert-dns-names-0.22" }

linkerd/app/inbound/fuzz/Cargo.toml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,4 +35,4 @@ test = true
3535
doc = false
3636

3737
[patch.crates-io]
38-
webpki = { git = "https://github.com/linkerd/webpki", branch = "cert-dns-names-0.21"}
38+
webpki = { git = "https://github.com/linkerd/webpki", branch = "cert-dns-names-0.22"}

linkerd/app/integration/Cargo.toml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,11 +33,11 @@ regex = "1"
3333
socket2 = "0.4"
3434
tokio = { version = "1", features = ["io-util", "net", "rt", "macros"] }
3535
tokio-stream = { version = "0.1.8", features = ["sync"] }
36-
tokio-rustls = "0.22"
36+
tokio-rustls = "0.23.1"
37+
rustls-pemfile = "0.2.1"
3738
tower = { version = "0.4.10", default-features = false }
3839
tonic = { version = "0.6", default-features = false }
3940
tracing = "0.1.29"
40-
webpki = "0.21"
4141
tracing-subscriber = { version = "0.3", default-features = false, features = ["fmt", "std"] }
4242

4343
[dev-dependencies]

linkerd/app/integration/src/client.rs

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,16 @@
11
use super::*;
22
use linkerd_app_core::proxy::http::trace;
33
use std::io;
4-
use std::sync::{Arc, Mutex};
4+
use std::{
5+
convert::TryFrom,
6+
sync::{Arc, Mutex},
7+
};
58
use tokio::net::TcpStream;
69
use tokio::sync::{mpsc, oneshot};
710
use tokio::task::JoinHandle;
8-
use tokio_rustls::rustls::ClientConfig;
11+
use tokio_rustls::rustls::{self, ClientConfig};
912
use tracing::info_span;
1013
use tracing::instrument::Instrument;
11-
use webpki::{DNSName, DNSNameRef};
1214

1315
type ClientError = hyper::Error;
1416
type Request = http::Request<hyper::Body>;
@@ -18,17 +20,15 @@ type Sender = mpsc::UnboundedSender<(Request, oneshot::Sender<Result<Response, C
1820
#[derive(Clone)]
1921
pub struct TlsConfig {
2022
client_config: Arc<ClientConfig>,
21-
name: DNSName,
23+
name: rustls::ServerName,
2224
}
2325

2426
impl TlsConfig {
2527
pub fn new(client_config: Arc<ClientConfig>, name: &str) -> Self {
26-
let dns_name = DNSNameRef::try_from_ascii_str(name)
27-
.expect("no_fail")
28-
.to_owned();
28+
let name = rustls::ServerName::try_from(name).expect("name must be a valid DNS name");
2929
TlsConfig {
3030
client_config,
31-
name: dns_name,
31+
name,
3232
}
3333
}
3434
}
@@ -327,7 +327,7 @@ impl tower::Service<hyper::Uri> for Conn {
327327
}) = tls
328328
{
329329
let io = tokio_rustls::TlsConnector::from(client_config.clone())
330-
.connect(DNSName::as_ref(&name), io)
330+
.connect(name, io)
331331
.await?;
332332
Box::pin(io) as Pin<Box<dyn Io + Send + 'static>>
333333
} else {

linkerd/app/integration/src/identity.rs

Lines changed: 31 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,9 @@ type Certify = Box<
3434
> + Send,
3535
>;
3636

37-
const TLS_VERSIONS: &[rustls::ProtocolVersion] = &[rustls::ProtocolVersion::TLSv1_3];
37+
static TLS_VERSIONS: &[&rustls::SupportedProtocolVersion] = &[&rustls::version::TLS13];
38+
static TLS_SUPPORTED_CIPHERSUITES: &[rustls::SupportedCipherSuite] =
39+
&[rustls::cipher_suite::TLS13_CHACHA20_POLY1305_SHA256];
3840

3941
struct Certificates {
4042
pub leaf: Vec<u8>,
@@ -48,14 +50,11 @@ impl Certificates {
4850
{
4951
let f = fs::File::open(p)?;
5052
let mut r = io::BufReader::new(f);
51-
let certs = rustls::internal::pemfile::certs(&mut r)
53+
let mut certs = rustls_pemfile::certs(&mut r)
5254
.map_err(|_| io::Error::new(io::ErrorKind::Other, "rustls error reading certs"))?;
53-
let leaf = certs
54-
.get(0)
55-
.ok_or_else(|| io::Error::new(io::ErrorKind::Other, "no certs in pemfile"))?
56-
.as_ref()
57-
.into();
58-
let intermediates = certs[1..].iter().map(|i| i.as_ref().into()).collect();
55+
let mut certs = certs.drain(..);
56+
let leaf = certs.next().expect("no leaf cert in pemfile");
57+
let intermediates = certs.collect();
5958

6059
Ok(Certificates {
6160
leaf,
@@ -95,21 +94,30 @@ impl Identity {
9594
) -> (Arc<rustls::ClientConfig>, Arc<rustls::ServerConfig>) {
9695
use std::io::Cursor;
9796
let mut roots = rustls::RootCertStore::empty();
98-
roots
99-
.add_pem_file(&mut Cursor::new(trust_anchors))
100-
.expect("add pem file");
101-
102-
let mut client_config = rustls::ClientConfig::new();
103-
client_config.root_store = roots;
104-
105-
let mut server_config = rustls::ServerConfig::new(
106-
rustls::AllowAnyAnonymousOrAuthenticatedClient::new(client_config.root_store.clone()),
107-
);
108-
109-
server_config.versions = TLS_VERSIONS.to_vec();
110-
server_config
111-
.set_single_cert(certs.chain(), key)
112-
.expect("set server resover");
97+
let trust_anchors =
98+
rustls_pemfile::certs(&mut Cursor::new(trust_anchors)).expect("error parsing pemfile");
99+
let (added, skipped) = roots.add_parsable_certificates(&trust_anchors[..]);
100+
assert_ne!(added, 0, "trust anchors must include at least one cert");
101+
assert_eq!(skipped, 0, "no certs in pemfile should be invalid");
102+
103+
let client_config = rustls::ClientConfig::builder()
104+
.with_cipher_suites(TLS_SUPPORTED_CIPHERSUITES)
105+
.with_safe_default_kx_groups()
106+
.with_protocol_versions(TLS_VERSIONS)
107+
.expect("client config must be valid")
108+
.with_root_certificates(roots.clone())
109+
.with_no_client_auth();
110+
111+
let server_config = rustls::ServerConfig::builder()
112+
.with_cipher_suites(TLS_SUPPORTED_CIPHERSUITES)
113+
.with_safe_default_kx_groups()
114+
.with_protocol_versions(TLS_VERSIONS)
115+
.expect("server config must be valid")
116+
.with_client_cert_verifier(rustls::server::AllowAnyAnonymousOrAuthenticatedClient::new(
117+
roots,
118+
))
119+
.with_single_cert(certs.chain(), key)
120+
.unwrap();
113121

114122
(Arc::new(client_config), Arc::new(server_config))
115123
}

linkerd/dns/name/src/name.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -165,7 +165,7 @@ fn is_valid_reference_dns_id(hostname: untrusted::Input<'_>) -> bool {
165165
// https://tools.ietf.org/html/rfc5280#section-4.2.1.6:
166166
//
167167
// When the subjectAltName extension contains a domain name system
168-
// label, the domain name MUST be stored in the dNSName (an IA5String).
168+
// label, the domain name MUST be stored in the DNSName (an IA5String).
169169
// The name MUST be in the "preferred name syntax", as specified by
170170
// Section 3.5 of [RFC1034] and as modified by Section 2.1 of
171171
// [RFC1123].

linkerd/dns/src/lib.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -142,7 +142,7 @@ mod tests {
142142
#[test]
143143
fn test_dns_name_parsing() {
144144
// Make sure `dns::Name`'s validation isn't too strict. It is
145-
// implemented in terms of `webpki::DNSName` which has many more tests
145+
// implemented in terms of `webpki::DnsName` which has many more tests
146146
// at https://github.com/briansmith/webpki/blob/master/tests/dns_name_tests.rs.
147147

148148
struct Case {

linkerd/meshtls/rustls/Cargo.toml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,11 +18,12 @@ linkerd-stack = { path = "../../stack" }
1818
linkerd-tls = { path = "../../tls" }
1919
linkerd-tls-test-util = { path = "../../tls/test-util", optional = true }
2020
ring = { version = "0.16.19", features = ["std"] }
21+
rustls-pemfile = "0.2"
2122
thiserror = "1"
2223
tokio = { version = "1", features = ["macros", "rt", "sync"] }
23-
tokio-rustls = "0.22"
24+
tokio-rustls = { version = "0.23.1", features = ["dangerous_configuration"] }
2425
tracing = "0.1"
25-
webpki = "0.21"
26+
webpki = "0.22"
2627

2728
[dev-dependencies]
2829
linkerd-tls-test-util = { path = "../../tls/test-util" }

linkerd/meshtls/rustls/src/client.rs

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@ use futures::prelude::*;
22
use linkerd_io as io;
33
use linkerd_stack::{NewService, Service};
44
use linkerd_tls::{client::AlpnProtocols, ClientTls, HasNegotiatedProtocol, NegotiatedProtocolRef};
5-
use std::{pin::Pin, sync::Arc, task::Context};
5+
use std::{convert::TryFrom, pin::Pin, sync::Arc, task::Context};
66
use tokio::sync::watch;
7-
use tokio_rustls::rustls::{ClientConfig, Session};
7+
use tokio_rustls::rustls::{self, ClientConfig};
88

99
/// A `NewService` that produces `Connect` services from a dynamic TLS configuration.
1010
#[derive(Clone)]
@@ -15,7 +15,7 @@ pub struct NewClient {
1515
/// A `Service` that initiates client-side TLS connections.
1616
#[derive(Clone)]
1717
pub struct Connect {
18-
server_id: webpki::DNSName,
18+
server_id: rustls::ServerName,
1919
config: Arc<ClientConfig>,
2020
}
2121

@@ -68,9 +68,8 @@ impl Connect {
6868
}
6969
};
7070

71-
let server_id = webpki::DNSNameRef::try_from_ascii(client_tls.server_id.as_bytes())
72-
.expect("identity must be a valid DNS name")
73-
.to_owned();
71+
let server_id = rustls::ServerName::try_from(client_tls.server_id.as_str())
72+
.expect("identity must be a valid DNS name");
7473

7574
Self { server_id, config }
7675
}
@@ -90,7 +89,8 @@ where
9089

9190
fn call(&mut self, io: I) -> Self::Future {
9291
tokio_rustls::TlsConnector::from(self.config.clone())
93-
.connect(self.server_id.as_ref(), io)
92+
// XXX(eliza): it's a bummer that the server name has to be cloned here...
93+
.connect(self.server_id.clone(), io)
9494
.map_ok(ClientIo)
9595
}
9696
}
@@ -145,7 +145,7 @@ impl<I> HasNegotiatedProtocol for ClientIo<I> {
145145
self.0
146146
.get_ref()
147147
.1
148-
.get_alpn_protocol()
148+
.alpn_protocol()
149149
.map(NegotiatedProtocolRef)
150150
}
151151
}

0 commit comments

Comments
 (0)