11use std:: {
2+ convert:: TryFrom ,
23 fs:: File ,
34 io:: { BufReader , Seek , SeekFrom } ,
45 pin:: Pin ,
56 sync:: Arc ,
67 task:: { Context , Poll } ,
8+ time:: SystemTime ,
79} ;
810
911use futures_io:: { AsyncRead , AsyncWrite } ;
1012use rustls:: {
11- internal :: pemfile ,
13+ client :: { ClientConfig , ServerCertVerified , ServerCertVerifier , ServerName } ,
1214 Certificate ,
15+ Error as TlsError ,
16+ OwnedTrustAnchor ,
1317 RootCertStore ,
14- ServerCertVerified ,
15- ServerCertVerifier ,
16- TLSError ,
1718} ;
18- use rustls_pemfile:: { read_one, Item } ;
19+ use rustls_pemfile:: { certs , read_one, Item } ;
1920use tokio:: io:: AsyncWrite as TokioAsyncWrite ;
2021use tokio_rustls:: TlsConnector ;
21- use webpki:: DNSNameRef ;
2222use webpki_roots:: TLS_SERVER_ROOTS ;
2323
2424use crate :: {
@@ -39,7 +39,7 @@ impl AsyncTlsStream {
3939 tcp_stream : AsyncTcpStream ,
4040 cfg : TlsOptions ,
4141 ) -> Result < Self > {
42- let name = DNSNameRef :: try_from_ascii_str ( host) . map_err ( |e| ErrorKind :: DnsResolve {
42+ let name = ServerName :: try_from ( host) . map_err ( |e| ErrorKind :: DnsResolve {
4343 message : format ! ( "could not resolve {:?}: {}" , host, e) ,
4444 } ) ?;
4545 let mut tls_config = make_rustls_config ( cfg) ?;
@@ -82,39 +82,38 @@ impl AsyncWrite for AsyncTlsStream {
8282
8383/// Converts `TlsOptions` into a rustls::ClientConfig.
8484fn make_rustls_config ( cfg : TlsOptions ) -> Result < rustls:: ClientConfig > {
85- let mut config = rustls:: ClientConfig :: new ( ) ;
86-
87- if let Some ( true ) = cfg. allow_invalid_certificates {
88- config
89- . dangerous ( )
90- . set_certificate_verifier ( Arc :: new ( NoCertVerifier { } ) ) ;
91- }
92-
9385 let mut store = RootCertStore :: empty ( ) ;
9486 if let Some ( path) = cfg. ca_file_path {
95- store
96- . add_pem_file ( & mut BufReader :: new ( File :: open ( & path) ?) )
97- . map_err ( |_| ErrorKind :: InvalidTlsConfig {
87+ let ders = certs ( & mut BufReader :: new ( File :: open ( & path) ?) ) . map_err ( |_| {
88+ ErrorKind :: InvalidTlsConfig {
9889 message : format ! (
9990 "Unable to parse PEM-encoded root certificate from {}" ,
10091 path. display( )
10192 ) ,
102- } ) ?;
93+ }
94+ } ) ?;
95+ store. add_parsable_certificates ( & ders) ;
10396 } else {
104- store. add_server_trust_anchors ( & TLS_SERVER_ROOTS ) ;
97+ let trust_anchors = TLS_SERVER_ROOTS . 0 . iter ( ) . map ( |ta| {
98+ OwnedTrustAnchor :: from_subject_spki_name_constraints (
99+ ta. subject ,
100+ ta. spki ,
101+ ta. name_constraints ,
102+ )
103+ } ) ;
104+ store. add_server_trust_anchors ( trust_anchors) ;
105105 }
106106
107- config. root_store = store;
108-
109- if let Some ( path) = cfg. cert_key_file_path {
107+ let mut config = if let Some ( path) = cfg. cert_key_file_path {
110108 let mut file = BufReader :: new ( File :: open ( & path) ?) ;
111- let certs = match pemfile :: certs ( & mut file) {
112- Ok ( certs) => certs,
113- Err ( ( ) ) => {
109+ let certs = match certs ( & mut file) {
110+ Ok ( certs) => certs. into_iter ( ) . map ( Certificate ) . collect ( ) ,
111+ Err ( error ) => {
114112 return Err ( ErrorKind :: InvalidTlsConfig {
115113 message : format ! (
116- "Unable to parse PEM-encoded client certificate from {}" ,
117- path. display( )
114+ "Unable to parse PEM-encoded client certificate from {}: {}" ,
115+ path. display( ) ,
116+ error,
118117 ) ,
119118 }
120119 . into ( ) )
@@ -146,11 +145,24 @@ fn make_rustls_config(cfg: TlsOptions) -> Result<rustls::ClientConfig> {
146145 }
147146 } ;
148147
148+ ClientConfig :: builder ( )
149+ . with_safe_defaults ( )
150+ . with_root_certificates ( store)
151+ . with_single_cert ( certs, key)
152+ . map_err ( |error| ErrorKind :: InvalidTlsConfig {
153+ message : error. to_string ( ) ,
154+ } ) ?
155+ } else {
156+ ClientConfig :: builder ( )
157+ . with_safe_defaults ( )
158+ . with_root_certificates ( store)
159+ . with_no_client_auth ( )
160+ } ;
161+
162+ if let Some ( true ) = cfg. allow_invalid_certificates {
149163 config
150- . set_single_client_cert ( certs, key)
151- . map_err ( |e| ErrorKind :: InvalidTlsConfig {
152- message : e. to_string ( ) ,
153- } ) ?;
164+ . dangerous ( )
165+ . set_certificate_verifier ( Arc :: new ( NoCertVerifier { } ) ) ;
154166 }
155167
156168 Ok ( config)
@@ -161,11 +173,13 @@ struct NoCertVerifier {}
161173impl ServerCertVerifier for NoCertVerifier {
162174 fn verify_server_cert (
163175 & self ,
164- _: & RootCertStore ,
176+ _: & Certificate ,
165177 _: & [ Certificate ] ,
166- _: webpki:: DNSNameRef ,
178+ _: & ServerName ,
179+ _: & mut dyn Iterator < Item = & [ u8 ] > ,
167180 _: & [ u8 ] ,
168- ) -> std:: result:: Result < ServerCertVerified , TLSError > {
181+ _: SystemTime ,
182+ ) -> std:: result:: Result < ServerCertVerified , TlsError > {
169183 Ok ( ServerCertVerified :: assertion ( ) )
170184 }
171185}
0 commit comments