@@ -8,7 +8,7 @@ use std::{
88} ;
99
1010use linkerd2_proxy_api:: identity as pb;
11- use tokio_rustls:: rustls:: { self , pki_types :: CertificateDer , server :: WebPkiClientVerifier } ;
11+ use tokio_rustls:: rustls;
1212use tonic as grpc;
1313
1414pub struct Identity {
@@ -36,7 +36,7 @@ type Certify = Box<
3636
3737static TLS_VERSIONS : & [ & rustls:: SupportedProtocolVersion ] = & [ & rustls:: version:: TLS13 ] ;
3838static TLS_SUPPORTED_CIPHERSUITES : & [ rustls:: SupportedCipherSuite ] =
39- & [ rustls:: crypto :: ring :: cipher_suite:: TLS13_CHACHA20_POLY1305_SHA256 ] ;
39+ & [ rustls:: cipher_suite:: TLS13_CHACHA20_POLY1305_SHA256 ] ;
4040
4141struct Certificates {
4242 pub leaf : Vec < u8 > ,
@@ -50,32 +50,23 @@ impl Certificates {
5050 {
5151 let f = fs:: File :: open ( p) ?;
5252 let mut r = io:: BufReader :: new ( f) ;
53- let mut certs = rustls_pemfile:: certs ( & mut r) ;
54- let leaf = certs
55- . next ( )
56- . expect ( "no leaf cert in pemfile" )
57- . map_err ( |_| io:: Error :: new ( io:: ErrorKind :: Other , "rustls error reading certs" ) ) ?
58- . as_ref ( )
59- . to_vec ( ) ;
60- let intermediates = certs
61- . map ( |cert| cert. map ( |cert| cert. as_ref ( ) . to_vec ( ) ) )
62- . collect :: < Result < Vec < _ > , _ > > ( )
53+ let mut certs = rustls_pemfile:: certs ( & mut r)
6354 . map_err ( |_| io:: Error :: new ( io:: ErrorKind :: Other , "rustls error reading certs" ) ) ?;
55+ let mut certs = certs. drain ( ..) ;
56+ let leaf = certs. next ( ) . expect ( "no leaf cert in pemfile" ) ;
57+ let intermediates = certs. collect ( ) ;
6458
6559 Ok ( Certificates {
6660 leaf,
6761 intermediates,
6862 } )
6963 }
7064
71- pub fn chain ( & self ) -> Vec < rustls:: pki_types :: CertificateDer < ' static > > {
65+ pub fn chain ( & self ) -> Vec < rustls:: Certificate > {
7266 let mut chain = Vec :: with_capacity ( self . intermediates . len ( ) + 1 ) ;
7367 chain. push ( self . leaf . clone ( ) ) ;
7468 chain. extend ( self . intermediates . clone ( ) ) ;
75- chain
76- . into_iter ( )
77- . map ( rustls:: pki_types:: CertificateDer :: from)
78- . collect ( )
69+ chain. into_iter ( ) . map ( rustls:: Certificate ) . collect ( )
7970 }
8071
8172 pub fn response ( & self ) -> pb:: CertifyResponse {
@@ -88,49 +79,43 @@ impl Certificates {
8879}
8980
9081impl Identity {
91- fn load_key < P > ( p : P ) -> rustls:: pki_types :: PrivateKeyDer < ' static >
82+ fn load_key < P > ( p : P ) -> rustls:: PrivateKey
9283 where
9384 P : AsRef < Path > ,
9485 {
9586 let p8 = fs:: read ( & p) . expect ( "read key" ) ;
96- rustls:: pki_types :: PrivateKeyDer :: try_from ( p8) . expect ( "decode key" )
87+ rustls:: PrivateKey ( p8)
9788 }
9889
9990 fn configs (
10091 trust_anchors : & str ,
10192 certs : & Certificates ,
102- key : rustls:: pki_types :: PrivateKeyDer < ' static > ,
93+ key : rustls:: PrivateKey ,
10394 ) -> ( Arc < rustls:: ClientConfig > , Arc < rustls:: ServerConfig > ) {
10495 use std:: io:: Cursor ;
10596 let mut roots = rustls:: RootCertStore :: empty ( ) ;
106- let trust_anchors = rustls_pemfile:: certs ( & mut Cursor :: new ( trust_anchors) )
107- . map ( |bytes| bytes. map ( CertificateDer :: from) )
108- . collect :: < Result < Vec < _ > , _ > > ( )
109- . expect ( "error parsing pemfile" ) ;
110- let ( added, skipped) = roots. add_parsable_certificates ( trust_anchors) ;
97+ let trust_anchors =
98+ rustls_pemfile:: certs ( & mut Cursor :: new ( trust_anchors) ) . expect ( "error parsing pemfile" ) ;
99+ let ( added, skipped) = roots. add_parsable_certificates ( & trust_anchors[ ..] ) ;
111100 assert_ne ! ( added, 0 , "trust anchors must include at least one cert" ) ;
112101 assert_eq ! ( skipped, 0 , "no certs in pemfile should be invalid" ) ;
113102
114- let mut provider = rustls:: crypto:: ring:: default_provider ( ) ;
115- provider. cipher_suites = TLS_SUPPORTED_CIPHERSUITES . to_vec ( ) ;
116- let provider = Arc :: new ( provider) ;
117-
118- let client_config = rustls:: ClientConfig :: builder_with_provider ( provider. clone ( ) )
103+ let client_config = rustls:: ClientConfig :: builder ( )
104+ . with_cipher_suites ( TLS_SUPPORTED_CIPHERSUITES )
105+ . with_safe_default_kx_groups ( )
119106 . with_protocol_versions ( TLS_VERSIONS )
120107 . expect ( "client config must be valid" )
121108 . with_root_certificates ( roots. clone ( ) )
122109 . with_no_client_auth ( ) ;
123110
124- let client_cert_verifier =
125- WebPkiClientVerifier :: builder_with_provider ( Arc :: new ( roots) , provider. clone ( ) )
126- . allow_unauthenticated ( )
127- . build ( )
128- . expect ( "server verifier must be valid" ) ;
129-
130- let server_config = rustls:: ServerConfig :: builder_with_provider ( provider)
111+ let server_config = rustls:: ServerConfig :: builder ( )
112+ . with_cipher_suites ( TLS_SUPPORTED_CIPHERSUITES )
113+ . with_safe_default_kx_groups ( )
131114 . with_protocol_versions ( TLS_VERSIONS )
132115 . expect ( "server config must be valid" )
133- . with_client_cert_verifier ( client_cert_verifier)
116+ . with_client_cert_verifier ( Arc :: new (
117+ rustls:: server:: AllowAnyAnonymousOrAuthenticatedClient :: new ( roots) ,
118+ ) )
134119 . with_single_cert ( certs. chain ( ) , key)
135120 . unwrap ( ) ;
136121
0 commit comments