Skip to content

Commit 5e4a6e9

Browse files
krishvishalkrishvishal
committed
Address review comments
1 parent 62e0cbe commit 5e4a6e9

8 files changed

Lines changed: 127 additions & 108 deletions

File tree

‎Cargo.toml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,6 @@ license = "MIT"
2626
repository = "https://github.com/compio-rs/compio"
2727

2828
[workspace.dependencies]
29-
compio = { path = "./compio", version = "0.16.0" }
3029
compio-buf = { path = "./compio-buf", version = "0.7.0" }
3130
compio-driver = { path = "./compio-driver", version = "0.9.0", default-features = false }
3231
compio-runtime = { path = "./compio-runtime", version = "0.9.0" }

‎compio-ws/Cargo.toml‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,8 @@ repository = { workspace = true }
1111

1212
[dependencies]
1313
rustls = { workspace = true, optional = true, default-features = false }
14-
rustls-native-certs = { version = "0.8", optional = true }
15-
tungstenite = "0.27.0"
14+
rustls-platform-verifier = { version = "0.6.0", optional = true }
15+
tungstenite = "0.28.0"
1616
compio-io = { workspace = true }
1717
compio-net = { workspace = true, optional = true }
1818
compio-tls = { workspace = true, optional = true, default-features = false, features = [
@@ -27,7 +27,7 @@ log = "0.4"
2727
default = []
2828
connect = ["dep:compio-net"]
2929
rustls = ["connect", "dep:compio-tls", "dep:rustls", "compio-tls/rustls"]
30-
rustls-native-certs = ["rustls", "dep:rustls-native-certs"]
30+
rustls-platform-verifier = ["rustls", "dep:rustls-platform-verifier"]
3131
webpki-roots = ["rustls", "dep:webpki-roots"]
3232
ring = ["rustls?/ring", "compio-tls?/ring"]
3333

@@ -63,3 +63,7 @@ required-features = ["connect", "rustls", "ring"]
6363
[[example]]
6464
name = "client_tls"
6565
required-features = ["connect", "rustls", "ring"]
66+
67+
[[test]]
68+
name = "websocket"
69+
required-features = ["connect", "compio-driver/io-uring"]

‎compio-ws/src/lib.rs‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,6 @@ pub use crate::rustls::{
3535
connect_async_with_config, connect_async_with_tls_connector,
3636
connect_async_with_tls_connector_and_config,
3737
};
38-
pub use crate::stream::MaybeTlsStream;
3938

4039
pub struct WebSocketStream<S> {
4140
inner: WebSocket<GrowableSyncStream<S>>,

‎compio-ws/src/rustls.rs‎

Lines changed: 67 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
1-
#[cfg(any(feature = "rustls-native-certs", feature = "webpki-roots"))]
1+
#[cfg(any(feature = "rustls-platform-verifier", feature = "webpki-roots"))]
22
use std::sync::Arc;
33

44
use compio_io::{AsyncRead, AsyncWrite};
55
use compio_net::TcpStream;
66
use compio_tls::TlsConnector;
7-
#[cfg(any(feature = "rustls-native-certs", feature = "webpki-roots"))]
7+
#[cfg(any(feature = "rustls-platform-verifier", feature = "webpki-roots"))]
88
use rustls::{ClientConfig, RootCertStore};
99
use tungstenite::{
1010
Error,
@@ -37,92 +37,93 @@ where
3737
let connector = if let Some(connector) = connector {
3838
connector
3939
} else {
40-
// Only create root_store when we actually have certificate features enabled
41-
#[cfg(any(feature = "rustls-native-certs", feature = "webpki-roots"))]
42-
let root_store = {
43-
let mut store = RootCertStore::empty();
44-
45-
#[cfg(feature = "rustls-native-certs")]
46-
{
47-
let cert_result = rustls_native_certs::load_native_certs();
48-
49-
// Log any errors that occurred
50-
for err in &cert_result.errors {
51-
log::warn!("Error loading native certificate: {err}");
52-
}
40+
// Create TLS connector with platform verifier when feature is enabled
41+
#[cfg(feature = "rustls-platform-verifier")]
42+
{
43+
use rustls_platform_verifier::BuilderVerifierExt;
5344

54-
if !cert_result.certs.is_empty() {
55-
let (added, ignored) =
56-
store.add_parsable_certificates(cert_result.certs);
45+
// Use platform's native certificate verification
46+
// This provides better security and enterprise integration
47+
let config_result = ClientConfig::builder().with_platform_verifier();
48+
49+
match config_result {
50+
Ok(config_builder) => {
5751
log::debug!(
58-
"Added {added} native root certificates (ignored {ignored})"
52+
"Using rustls-platform-verifier for certificate validation"
5953
);
54+
TlsConnector::from(Arc::new(config_builder.with_no_client_auth()))
55+
}
56+
Err(e) => {
57+
log::warn!("Error creating platform verifier: {e}");
6058

6159
// Only fail if webpki-roots is NOT enabled as fallback
6260
#[cfg(not(feature = "webpki-roots"))]
63-
if added == 0 {
61+
{
6462
return Err(Error::Io(std::io::Error::new(
65-
std::io::ErrorKind::NotFound,
66-
"No valid native root certificates found",
63+
std::io::ErrorKind::Other,
64+
format!("Failed to create platform verifier: {}", e),
6765
)));
6866
}
69-
} else {
70-
log::warn!("No native root certificates found");
7167

72-
// Only fail if webpki-roots is NOT enabled as fallback
73-
#[cfg(not(feature = "webpki-roots"))]
74-
return Err(Error::Io(std::io::Error::new(
75-
std::io::ErrorKind::NotFound,
76-
"No native root certificates found",
77-
)));
68+
// Fall through to webpki-roots if available
69+
#[cfg(feature = "webpki-roots")]
70+
{
71+
use log::debug;
72+
73+
let mut root_store = RootCertStore::empty();
74+
let webpki_certs = webpki_roots::TLS_SERVER_ROOTS.to_vec();
75+
root_store.extend(webpki_certs);
76+
debug!(
77+
"Falling back to {} webpki root certificates",
78+
webpki_roots::TLS_SERVER_ROOTS.len()
79+
);
80+
81+
TlsConnector::from(Arc::new(
82+
ClientConfig::builder()
83+
.with_root_certificates(root_store)
84+
.with_no_client_auth(),
85+
))
86+
}
7887
}
7988
}
89+
}
8090

81-
// Load webpki-roots whenever the feature is enabled
82-
// This serves as a fallback when native-certs is also enabled
83-
#[cfg(feature = "webpki-roots")]
84-
{
85-
use log::debug;
86-
87-
let webpki_certs = webpki_roots::TLS_SERVER_ROOTS.to_vec();
88-
store.extend(webpki_certs);
89-
debug!(
90-
"Added {} webpki root certificates",
91-
webpki_roots::TLS_SERVER_ROOTS.len()
92-
);
93-
}
94-
95-
store
96-
};
97-
98-
// Check if we have neither feature enabled
99-
#[cfg(not(any(feature = "rustls-native-certs", feature = "webpki-roots")))]
91+
// Use webpki-roots when platform-verifier is not available
92+
// This serves as a fallback or standalone certificate source
93+
#[cfg(all(
94+
feature = "webpki-roots",
95+
not(feature = "rustls-platform-verifier")
96+
))]
10097
{
101-
return Err(Error::Io(std::io::Error::new(
102-
std::io::ErrorKind::NotFound,
103-
"No root certificate features enabled. Enable either \
104-
'rustls-native-certs' or 'webpki-roots'",
105-
)));
106-
}
98+
use log::debug;
10799

108-
// Check if root_store is empty (only when features are enabled)
109-
#[cfg(any(feature = "rustls-native-certs", feature = "webpki-roots"))]
110-
if root_store.is_empty() {
111-
return Err(Error::Io(std::io::Error::new(
112-
std::io::ErrorKind::NotFound,
113-
"No root certificates available",
114-
)));
115-
}
100+
let mut root_store = RootCertStore::empty();
101+
let webpki_certs = webpki_roots::TLS_SERVER_ROOTS.to_vec();
102+
root_store.extend(webpki_certs);
103+
debug!(
104+
"Using {} webpki root certificates",
105+
webpki_roots::TLS_SERVER_ROOTS.len()
106+
);
116107

117-
// Create the TLS connector (only when features are enabled)
118-
#[cfg(any(feature = "rustls-native-certs", feature = "webpki-roots"))]
119-
{
120108
TlsConnector::from(Arc::new(
121109
ClientConfig::builder()
122110
.with_root_certificates(root_store)
123111
.with_no_client_auth(),
124112
))
125113
}
114+
115+
// Check if we have neither feature enabled
116+
#[cfg(not(any(
117+
feature = "rustls-platform-verifier",
118+
feature = "webpki-roots"
119+
)))]
120+
{
121+
return Err(Error::Io(std::io::Error::new(
122+
std::io::ErrorKind::NotFound,
123+
"No root certificate features enabled. Enable either \
124+
'rustls-platform-verifier' or 'webpki-roots'",
125+
)));
126+
}
126127
};
127128

128129
connector

‎compio-ws/src/stream.rs‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,15 @@
1+
#[cfg(feature = "rustls")]
12
use std::io::Result as IoResult;
23

4+
#[cfg(feature = "rustls")]
35
use compio_buf::{BufResult, IoBuf, IoBufMut};
6+
#[cfg(feature = "rustls")]
47
use compio_io::{AsyncRead, AsyncWrite};
58
#[cfg(feature = "rustls")]
69
use compio_tls::TlsStream;
710

811
/// Stream that can be either plain TCP or TLS-encrypted
12+
#[cfg(feature = "rustls")]
913
#[derive(Debug)]
1014
#[allow(clippy::large_enum_variant)]
1115
pub enum MaybeTlsStream<S> {
@@ -16,6 +20,7 @@ pub enum MaybeTlsStream<S> {
1620
Tls(TlsStream<S>),
1721
}
1822

23+
#[cfg(feature = "rustls")]
1924
impl<S> MaybeTlsStream<S> {
2025
pub fn plain(stream: S) -> Self {
2126
MaybeTlsStream::Plain(stream)
@@ -38,6 +43,7 @@ impl<S> MaybeTlsStream<S> {
3843
}
3944
}
4045

46+
#[cfg(feature = "rustls")]
4147
impl<S> AsyncRead for MaybeTlsStream<S>
4248
where
4349
S: AsyncRead + AsyncWrite + Unpin + 'static,
@@ -51,6 +57,7 @@ where
5157
}
5258
}
5359

60+
#[cfg(feature = "rustls")]
5461
impl<S> AsyncWrite for MaybeTlsStream<S>
5562
where
5663
S: AsyncRead + AsyncWrite + Unpin + 'static,
@@ -79,5 +86,3 @@ where
7986
}
8087
}
8188
}
82-
83-
impl<S> Unpin for MaybeTlsStream<S> where S: Unpin {}

0 commit comments

Comments
 (0)