Skip to content

Commit 49140ea

Browse files
a-winga-wing
authored
Update depend rcgen (#559)
* Update depend rcgen * Update depend x509-parser * Update depend rcgen and rustls * fix dtls test * fix test webrtc * change rustls features aws_lc_rs => ring
1 parent f452145 commit 49140ea

File tree

20 files changed

+467
-381
lines changed

20 files changed

+467
-381
lines changed

‎Cargo.lock

Lines changed: 334 additions & 288 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎dtls/Cargo.toml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -40,11 +40,11 @@ tokio = { version = "1.32.0", features = [
4040
] }
4141
async-trait = "0.1"
4242
x25519-dalek = { version = "2", features = ["static_secrets"] }
43-
x509-parser = "0.15"
43+
x509-parser = "0.16"
4444
der-parser = "8.1"
45-
rcgen = "0.11"
45+
rcgen = "0.13"
4646
ring = "0.17"
47-
rustls = { version = "0.21", features = ["dangerous_configuration"]}
47+
rustls = { version = "0.23", default-features = false, features = ["std", "ring"] }
4848
bincode = "1"
4949
serde = { version = "1", features = ["derive"] }
5050
subtle = "2"

‎dtls/examples/dial/verify/dial_verify.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ async fn main() -> Result<(), Error> {
6969
let mut cert_pool = rustls::RootCertStore::empty();
7070
let certs = load_certificate("dtls/examples/certificates/server.pub.pem".into())?;
7171
for cert in &certs {
72-
if cert_pool.add(cert).is_err() {
72+
if cert_pool.add(cert.to_owned()).is_err() {
7373
return Err(Error::Other("cert_pool add_pem_file failed".to_owned()));
7474
}
7575
}

‎dtls/examples/hub/Cargo.toml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ util = { path = "../../../util", package = "webrtc-util", default-features = fal
1010
dtls = { package = "webrtc-dtls", path = "../../" }
1111

1212
tokio = { version = "1.32.0", features = ["full"] }
13-
rcgen = { version = "0.11", features = ["pem", "x509-parser"] }
14-
rustls = "0.21"
13+
rcgen = { version = "0.13", features = ["pem", "x509-parser"] }
14+
rustls = { version = "0.23", default-features = false }
1515
rustls-pemfile = "1"
1616
thiserror = "1"

‎dtls/examples/hub/src/utilities.rs

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ use std::path::PathBuf;
44

55
use dtls::crypto::{Certificate, CryptoPrivateKey};
66
use rcgen::KeyPair;
7+
use rustls::pki_types::CertificateDer;
78
use thiserror::Error;
89

910
use super::*;
@@ -101,12 +102,12 @@ pub fn load_key(path: PathBuf) -> Result<CryptoPrivateKey, Error> {
101102
}
102103

103104
/// load_certificate Load/read certificate(s) from file
104-
pub fn load_certificate(path: PathBuf) -> Result<Vec<rustls::Certificate>, Error> {
105+
pub fn load_certificate(path: PathBuf) -> Result<Vec<CertificateDer<'static>>, Error> {
105106
let f = File::open(path)?;
106107

107108
let mut reader = BufReader::new(f);
108109
match rustls_pemfile::certs(&mut reader) {
109-
Ok(certs) => Ok(certs.into_iter().map(rustls::Certificate).collect()),
110+
Ok(certs) => Ok(certs.into_iter().map(CertificateDer::from).collect()),
110111
Err(_) => Err(Error::ErrNoCertificateFound),
111112
}
112113
}

‎dtls/examples/listen/verify/listen_verify.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ async fn main() -> Result<(), Error> {
6464
let mut cert_pool = rustls::RootCertStore::empty();
6565
let certs = load_certificate("dtls/examples/certificates/server.pub.pem".into())?;
6666
for cert in &certs {
67-
if cert_pool.add(cert).is_err() {
67+
if cert_pool.add(cert.to_owned()).is_err() {
6868
return Err(Error::Other("cert_pool add_pem_file failed".to_owned()));
6969
}
7070
}

‎dtls/src/conn/conn_test.rs

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
use std::time::SystemTime;
22

33
use rand::Rng;
4+
use rustls::pki_types::CertificateDer;
45
use util::conn::conn_pipe::*;
56
use util::KeyingMaterialExporter;
67

@@ -860,13 +861,13 @@ async fn test_client_certificate() -> Result<()> {
860861
let srv_cert = Certificate::generate_self_signed(vec!["localhost".to_owned()])?;
861862
let mut srv_ca_pool = rustls::RootCertStore::empty();
862863
srv_ca_pool
863-
.add(&srv_cert.certificate[0])
864+
.add(srv_cert.certificate[0].to_owned())
864865
.map_err(|_err| Error::Other("add srv_cert error".to_owned()))?;
865866

866867
let cert = Certificate::generate_self_signed(vec!["localhost".to_owned()])?;
867868
let mut ca_pool = rustls::RootCertStore::empty();
868869
ca_pool
869-
.add(&cert.certificate[0])
870+
.add(cert.certificate[0].to_owned())
870871
.map_err(|_err| Error::Other("add cert error".to_owned()))?;
871872

872873
let tests = vec![
@@ -1291,21 +1292,21 @@ async fn test_extended_master_secret() -> Result<()> {
12911292
Ok(())
12921293
}
12931294

1294-
fn fn_not_expected_chain(_cert: &[Vec<u8>], chain: &[rustls::Certificate]) -> Result<()> {
1295+
fn fn_not_expected_chain(_cert: &[Vec<u8>], chain: &[CertificateDer<'static>]) -> Result<()> {
12951296
if !chain.is_empty() {
12961297
return Err(Error::Other(ERR_NOT_EXPECTED_CHAIN.to_owned()));
12971298
}
12981299
Ok(())
12991300
}
13001301

1301-
fn fn_expected_chain(_cert: &[Vec<u8>], chain: &[rustls::Certificate]) -> Result<()> {
1302+
fn fn_expected_chain(_cert: &[Vec<u8>], chain: &[CertificateDer<'static>]) -> Result<()> {
13021303
if chain.is_empty() {
13031304
return Err(Error::Other(ERR_EXPECTED_CHAIN.to_owned()));
13041305
}
13051306
Ok(())
13061307
}
13071308

1308-
fn fn_wrong_cert(_cert: &[Vec<u8>], _chain: &[rustls::Certificate]) -> Result<()> {
1309+
fn fn_wrong_cert(_cert: &[Vec<u8>], _chain: &[CertificateDer<'static>]) -> Result<()> {
13091310
Err(Error::Other(ERR_WRONG_CERT.to_owned()))
13101311
}
13111312

@@ -1330,7 +1331,7 @@ async fn test_server_certificate() -> Result<()> {
13301331
let cert = Certificate::generate_self_signed(vec![server_name.clone()])?;
13311332
let mut ca_pool = rustls::RootCertStore::empty();
13321333
ca_pool
1333-
.add(&cert.certificate[0])
1334+
.add(cert.certificate[0].clone())
13341335
.map_err(|_err| Error::Other("add cert error".to_owned()))?;
13351336

13361337
let tests = vec![

‎dtls/src/conn/mod.rs

Lines changed: 23 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -221,16 +221,33 @@ impl DTLSConn {
221221
client_cert_verifier: if config.client_auth as u8
222222
>= ClientAuthType::VerifyClientCertIfGiven as u8
223223
{
224-
Some(Arc::new(rustls::server::AllowAnyAuthenticatedClient::new(
225-
config.client_cas,
226-
)))
224+
Some(
225+
rustls::server::WebPkiClientVerifier::builder(Arc::new(config.client_cas))
226+
.allow_unauthenticated()
227+
.build()
228+
.unwrap_or(
229+
rustls::server::WebPkiClientVerifier::builder(Arc::new(
230+
gen_self_signed_root_cert(),
231+
))
232+
.allow_unauthenticated()
233+
.build()
234+
.unwrap(),
235+
),
236+
)
227237
} else {
228238
None
229239
},
230-
server_cert_verifier: Arc::new(rustls::client::WebPkiVerifier::new(
240+
server_cert_verifier: rustls::client::WebPkiServerVerifier::builder(Arc::new(
231241
config.roots_cas,
232-
None,
233-
)),
242+
))
243+
.build()
244+
.unwrap_or(
245+
rustls::client::WebPkiServerVerifier::builder(
246+
Arc::new(gen_self_signed_root_cert()),
247+
)
248+
.build()
249+
.unwrap(),
250+
),
234251
retransmit_interval,
235252
//log: logger,
236253
initial_epoch: 0,

‎dtls/src/crypto/crypto_test.rs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -190,7 +190,7 @@ fn test_certificate_verify() -> Result<()> {
190190
&certificate_ecdsa256
191191
.certificate
192192
.iter()
193-
.map(|x| x.0.clone())
193+
.map(|x| x.as_ref().to_owned())
194194
.collect::<Vec<Vec<u8>>>(),
195195
false,
196196
)?;
@@ -212,7 +212,7 @@ fn test_certificate_verify() -> Result<()> {
212212
&certificate_ed25519
213213
.certificate
214214
.iter()
215-
.map(|x| x.0.clone())
215+
.map(|x| x.as_ref().to_owned())
216216
.collect::<Vec<Vec<u8>>>(),
217217
false,
218218
)?;

‎dtls/src/crypto/mod.rs

Lines changed: 34 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,12 @@ use std::sync::Arc;
1111

1212
use der_parser::oid;
1313
use der_parser::oid::Oid;
14-
use rcgen::KeyPair;
14+
15+
use rustls::client::danger::ServerCertVerifier;
16+
use rustls::pki_types::{CertificateDer, ServerName};
17+
use rustls::server::danger::ClientCertVerifier;
18+
19+
use rcgen::{generate_simple_self_signed, CertifiedKey, KeyPair};
1520
use ring::rand::SystemRandom;
1621
use ring::signature::{EcdsaKeyPair, Ed25519KeyPair};
1722

@@ -24,7 +29,7 @@ use crate::signature_hash_algorithm::{HashAlgorithm, SignatureAlgorithm, Signatu
2429
#[derive(Clone, PartialEq, Debug)]
2530
pub struct Certificate {
2631
/// DER-encoded certificates.
27-
pub certificate: Vec<rustls::Certificate>,
32+
pub certificate: Vec<CertificateDer<'static>>,
2833
/// Private key.
2934
pub private_key: CryptoPrivateKey,
3035
}
@@ -34,12 +39,11 @@ impl Certificate {
3439
///
3540
/// See [`rcgen::generate_simple_self_signed`].
3641
pub fn generate_self_signed(subject_alt_names: impl Into<Vec<String>>) -> Result<Self> {
37-
let cert = rcgen::generate_simple_self_signed(subject_alt_names)?;
38-
let key_pair = cert.get_key_pair();
39-
42+
let CertifiedKey { cert, key_pair } =
43+
generate_simple_self_signed(subject_alt_names).unwrap();
4044
Ok(Certificate {
41-
certificate: vec![rustls::Certificate(cert.serialize_der()?)],
42-
private_key: CryptoPrivateKey::try_from(key_pair)?,
45+
certificate: vec![cert.der().to_owned()],
46+
private_key: CryptoPrivateKey::try_from(&key_pair)?,
4347
})
4448
}
4549

@@ -50,14 +54,13 @@ impl Certificate {
5054
subject_alt_names: impl Into<Vec<String>>,
5155
alg: &'static rcgen::SignatureAlgorithm,
5256
) -> Result<Self> {
53-
let mut params = rcgen::CertificateParams::new(subject_alt_names);
54-
params.alg = alg;
55-
let cert = rcgen::Certificate::from_params(params)?;
56-
let key_pair = cert.get_key_pair();
57+
let params = rcgen::CertificateParams::new(subject_alt_names).unwrap();
58+
let key_pair = rcgen::KeyPair::generate_for(alg).unwrap();
59+
let cert = params.self_signed(&key_pair).unwrap();
5760

5861
Ok(Certificate {
59-
certificate: vec![rustls::Certificate(cert.serialize_der()?)],
60-
private_key: CryptoPrivateKey::try_from(key_pair)?,
62+
certificate: vec![cert.der().to_owned()],
63+
private_key: CryptoPrivateKey::try_from(&key_pair)?,
6164
})
6265
}
6366

@@ -78,7 +81,7 @@ impl Certificate {
7881
)));
7982
}
8083

81-
let keypair = rcgen::KeyPair::from_der(pems[0].contents())
84+
let keypair = KeyPair::try_from(pems[0].contents())
8285
.map_err(|e| Error::InvalidPEM(format!("can't decode keypair: {e}")))?;
8386

8487
let mut rustls_certs = Vec::new();
@@ -89,7 +92,7 @@ impl Certificate {
8992
p.tag()
9093
)));
9194
}
92-
rustls_certs.push(rustls::Certificate(p.contents().to_vec()));
95+
rustls_certs.push(CertificateDer::from(p.contents().to_vec()));
9396
}
9497

9598
Ok(Certificate {
@@ -108,7 +111,7 @@ impl Certificate {
108111
for rustls_cert in &self.certificate {
109112
data.push(pem::Pem::new(
110113
"CERTIFICATE".to_string(),
111-
rustls_cert.0.clone(),
114+
rustls_cert.as_ref(),
112115
));
113116
}
114117
pem::encode_many(&data)
@@ -427,14 +430,14 @@ pub(crate) fn verify_certificate_verify(
427430
)
428431
}
429432

430-
pub(crate) fn load_certs(raw_certificates: &[Vec<u8>]) -> Result<Vec<rustls::Certificate>> {
433+
pub(crate) fn load_certs(raw_certificates: &[Vec<u8>]) -> Result<Vec<CertificateDer<'static>>> {
431434
if raw_certificates.is_empty() {
432435
return Err(Error::ErrLengthMismatch);
433436
}
434437

435438
let mut certs = vec![];
436439
for raw_cert in raw_certificates {
437-
let cert = rustls::Certificate(raw_cert.to_vec());
440+
let cert = CertificateDer::from(raw_cert.to_vec());
438441
certs.push(cert);
439442
}
440443

@@ -443,16 +446,19 @@ pub(crate) fn load_certs(raw_certificates: &[Vec<u8>]) -> Result<Vec<rustls::Cer
443446

444447
pub(crate) fn verify_client_cert(
445448
raw_certificates: &[Vec<u8>],
446-
cert_verifier: &Arc<dyn rustls::server::ClientCertVerifier>,
447-
) -> Result<Vec<rustls::Certificate>> {
449+
cert_verifier: &Arc<dyn ClientCertVerifier>,
450+
) -> Result<Vec<CertificateDer<'static>>> {
448451
let chains = load_certs(raw_certificates)?;
449452

450453
let (end_entity, intermediates) = chains
451454
.split_first()
452455
.ok_or(Error::ErrClientCertificateRequired)?;
453456

454-
match cert_verifier.verify_client_cert(end_entity, intermediates, std::time::SystemTime::now())
455-
{
457+
match cert_verifier.verify_client_cert(
458+
end_entity,
459+
intermediates,
460+
rustls::pki_types::UnixTime::now(),
461+
) {
456462
Ok(_) => {}
457463
Err(err) => return Err(Error::Other(err.to_string())),
458464
};
@@ -462,12 +468,12 @@ pub(crate) fn verify_client_cert(
462468

463469
pub(crate) fn verify_server_cert(
464470
raw_certificates: &[Vec<u8>],
465-
cert_verifier: &Arc<dyn rustls::client::ServerCertVerifier>,
471+
cert_verifier: &Arc<dyn ServerCertVerifier>,
466472
server_name: &str,
467-
) -> Result<Vec<rustls::Certificate>> {
473+
) -> Result<Vec<CertificateDer<'static>>> {
468474
let chains = load_certs(raw_certificates)?;
469-
let dns_name = match rustls::server::DnsName::try_from_ascii(server_name.as_ref()) {
470-
Ok(dns_name) => dns_name,
475+
let server_name = match ServerName::try_from(server_name) {
476+
Ok(server_name) => server_name,
471477
Err(err) => return Err(Error::Other(err.to_string())),
472478
};
473479

@@ -477,10 +483,9 @@ pub(crate) fn verify_server_cert(
477483
match cert_verifier.verify_server_cert(
478484
end_entity,
479485
intermediates,
480-
&rustls::ServerName::DnsName(dns_name.to_owned()),
481-
&mut [].into_iter(),
486+
&server_name,
482487
&[],
483-
std::time::SystemTime::now(),
488+
rustls::pki_types::UnixTime::now(),
484489
) {
485490
Ok(_) => {}
486491
Err(err) => return Err(Error::Other(err.to_string())),

0 commit comments

Comments
 (0)