11#![ cfg( feature = "tls" ) ]
22use futures:: channel;
3- use std:: io:: BufReader ;
4- use std:: str:: FromStr ;
5- use std:: sync:: Arc ;
6- use std:: { fs, thread} ;
3+ use std:: { str:: FromStr , thread} ;
74use tentacle:: {
85 async_trait,
96 builder:: { MetaBuilder , ServiceBuilder } ,
@@ -18,16 +15,11 @@ use tentacle::{
1815 traits:: { ServiceHandle , ServiceProtocol } ,
1916 ProtocolId , SessionId ,
2017} ;
21- use tokio_rustls:: rustls:: server:: WebPkiClientVerifier ;
22- use tokio_rustls:: rustls:: version:: { TLS12 , TLS13 } ;
23- use tokio_rustls:: rustls:: {
24- crypto:: aws_lc_rs:: default_provider,
25- crypto:: aws_lc_rs:: ALL_CIPHER_SUITES ,
26- pki_types:: {
27- pem:: PemObject , CertificateDer , PrivateKeyDer , PrivatePkcs1KeyDer , PrivatePkcs8KeyDer ,
28- } ,
29- ClientConfig , RootCertStore , ServerConfig , SupportedCipherSuite , SupportedProtocolVersion ,
30- } ;
18+
19+ #[ path = "./tls_common.rs" ]
20+ mod tls;
21+
22+ use tls:: { make_client_config, make_server_config, NetConfig } ;
3123
3224pub fn create < F > ( meta : ProtocolMeta , shandle : F , cert_path : String ) -> Service < F , NoopKeyProvider >
3325where
@@ -118,30 +110,6 @@ impl ServiceProtocol for PHandle {
118110 }
119111}
120112
121- #[ derive( Debug , Clone ) ]
122- pub struct NetConfig {
123- server_cert_chain : Option < String > ,
124- server_key : Option < String > ,
125-
126- ca_cert : Option < String > ,
127-
128- protocols : Option < Vec < String > > ,
129- cypher_suits : Option < Vec < String > > ,
130- }
131-
132- impl NetConfig {
133- pub fn example ( node_dir : String ) -> Self {
134- Self {
135- server_cert_chain : Some ( node_dir. clone ( ) + "server.crt" ) ,
136- server_key : Some ( node_dir. clone ( ) + "server.key" ) ,
137- ca_cert : Some ( node_dir + "ca.crt" ) ,
138-
139- protocols : None ,
140- cypher_suits : None ,
141- }
142- }
143- }
144-
145113fn create_meta ( id : ProtocolId ) -> ( ProtocolMeta , crossbeam_channel:: Receiver < bytes:: Bytes > ) {
146114 // NOTE: channel size must large, otherwise send will failed.
147115 let ( sender, receiver) = crossbeam_channel:: unbounded ( ) ;
@@ -178,183 +146,6 @@ fn create_shandle() -> (
178146 )
179147}
180148
181- fn find_suite ( name : & str ) -> Option < SupportedCipherSuite > {
182- for suite in ALL_CIPHER_SUITES {
183- let cs_name = format ! ( "{:?}" , suite. suite( ) ) . to_lowercase ( ) ;
184-
185- if cs_name == name. to_string ( ) . to_lowercase ( ) {
186- return Some ( * suite) ;
187- }
188- }
189-
190- None
191- }
192-
193- fn lookup_suites ( suites : & [ String ] ) -> Vec < SupportedCipherSuite > {
194- let mut out = Vec :: new ( ) ;
195-
196- for cs_name in suites {
197- let scs = find_suite ( cs_name) ;
198- match scs {
199- Some ( s) => out. push ( s) ,
200- None => panic ! ( "cannot look up cipher suite '{}'" , cs_name) ,
201- }
202- }
203-
204- out
205- }
206-
207- /// Make a vector of protocol versions named in `versions`
208- fn lookup_versions ( versions : & [ String ] ) -> Vec < & ' static SupportedProtocolVersion > {
209- let mut out = Vec :: new ( ) ;
210-
211- for vname in versions {
212- let version = match vname. as_ref ( ) {
213- "1.2" => & TLS12 ,
214- "1.3" => & TLS13 ,
215- _ => panic ! (
216- "cannot look up version '{}', valid are '1.2' and '1.3'" ,
217- vname
218- ) ,
219- } ;
220- out. push ( version) ;
221- }
222-
223- out
224- }
225-
226- fn load_certs ( filename : & str ) -> Vec < CertificateDer < ' static > > {
227- let certfile = fs:: File :: open ( filename) . expect ( "cannot open certificate file" ) ;
228- let mut reader = BufReader :: new ( certfile) ;
229- CertificateDer :: pem_reader_iter ( & mut reader)
230- . collect :: < Result < Vec < _ > , _ > > ( )
231- . unwrap ( )
232- }
233-
234- fn load_private_key ( filename : & str ) -> PrivateKeyDer < ' static > {
235- let keyfile = fs:: File :: open ( filename) . expect ( "cannot open private key file" ) ;
236- let mut reader = BufReader :: new ( keyfile) ;
237- let mut rsa_keys = PrivatePkcs1KeyDer :: pem_reader_iter ( & mut reader) ;
238-
239- let rsa_keys_peek = rsa_keys. next ( ) ;
240-
241- if let Some ( rsa_keys_peek) = rsa_keys_peek {
242- return PrivateKeyDer :: Pkcs1 ( rsa_keys_peek. unwrap ( ) . clone_key ( ) ) ;
243- }
244-
245- let keyfile = fs:: File :: open ( filename) . expect ( "cannot open private key file" ) ;
246- let mut reader = BufReader :: new ( keyfile) ;
247- let mut pkcs8_keys = PrivatePkcs8KeyDer :: pem_reader_iter ( & mut reader) ;
248- let pkcs8_keys_peek = pkcs8_keys. next ( ) ;
249-
250- assert ! ( pkcs8_keys_peek. is_some( ) ) ;
251- PrivateKeyDer :: Pkcs8 ( pkcs8_keys_peek. unwrap ( ) . unwrap ( ) . clone_key ( ) )
252- }
253-
254- /// Build a `ServerConfig` from our NetConfig
255- pub fn make_server_config ( config : & NetConfig ) -> ServerConfig {
256- let mut cryp = default_provider ( ) ;
257-
258- if config. cypher_suits . is_some ( ) {
259- cryp. cipher_suites = lookup_suites ( config. cypher_suits . as_ref ( ) . unwrap ( ) )
260- } ;
261-
262- let server_config = ServerConfig :: builder_with_provider ( Arc :: new ( cryp) ) ;
263-
264- let server_config = if config. protocols . is_some ( ) {
265- server_config
266- . with_protocol_versions ( lookup_versions ( config. protocols . as_ref ( ) . unwrap ( ) ) . as_slice ( ) )
267- . unwrap ( )
268- } else {
269- server_config. with_safe_default_protocol_versions ( ) . unwrap ( )
270- } ;
271-
272- let cacerts = load_certs ( config. ca_cert . as_ref ( ) . unwrap ( ) ) ;
273-
274- let mut client_auth_roots = RootCertStore :: empty ( ) ;
275- for cacert in & cacerts {
276- client_auth_roots. add ( cacert. clone ( ) ) . unwrap ( ) ;
277- }
278- let client_auth = WebPkiClientVerifier :: builder ( client_auth_roots. into ( ) )
279- . build ( )
280- . unwrap ( ) ;
281-
282- let server_config = server_config. with_client_cert_verifier ( client_auth) ;
283-
284- let mut certs = load_certs (
285- config
286- . server_cert_chain
287- . as_ref ( )
288- . expect ( "server_cert_chain option missing" ) ,
289- ) ;
290- let privkey = load_private_key (
291- config
292- . server_key
293- . as_ref ( )
294- . expect ( "server_key option missing" ) ,
295- ) ;
296-
297- // Specially for server.crt not a cert-chain only one server certificate, so manually make
298- // a cert-chain.
299- if certs. len ( ) == 1 && !cacerts. is_empty ( ) {
300- certs. extend ( cacerts) ;
301- }
302-
303- server_config. with_single_cert ( certs, privkey) . unwrap ( )
304- }
305-
306- /// Build a `ClientConfig` from our NetConfig
307- pub fn make_client_config ( config : & NetConfig ) -> ClientConfig {
308- let mut cryp = default_provider ( ) ;
309-
310- if config. cypher_suits . is_some ( ) {
311- cryp. cipher_suites = lookup_suites ( config. cypher_suits . as_ref ( ) . unwrap ( ) ) ;
312- } ;
313-
314- let client_config = ClientConfig :: builder_with_provider ( Arc :: new ( cryp) ) ;
315-
316- let client_config = if config. protocols . is_some ( ) {
317- client_config
318- . with_protocol_versions ( lookup_versions ( config. protocols . as_ref ( ) . unwrap ( ) ) . as_slice ( ) )
319- . unwrap ( )
320- } else {
321- client_config. with_safe_default_protocol_versions ( ) . unwrap ( )
322- } ;
323-
324- let cafile = config. ca_cert . as_ref ( ) . unwrap ( ) ;
325-
326- let mut client_root_cert_store = RootCertStore :: empty ( ) ;
327- client_root_cert_store. add_parsable_certificates ( load_certs ( cafile) ) ;
328-
329- let client_config = client_config. with_root_certificates ( client_root_cert_store) ;
330-
331- if config. server_key . is_some ( ) || config. server_cert_chain . is_some ( ) {
332- let certsfile = config
333- . server_cert_chain
334- . as_ref ( )
335- . expect ( "must provide client_cert with client_key" ) ;
336-
337- let keyfile = config
338- . server_key
339- . as_ref ( )
340- . expect ( "must provide client_key with client_cert" ) ;
341-
342- let mut certs = load_certs ( certsfile) ;
343- let cacerts = load_certs ( cafile) ;
344- let privkey = load_private_key ( keyfile) ;
345-
346- // Specially for server.crt not a cert-chain only one server certificate, so manually make
347- // a cert-chain.
348- if certs. len ( ) == 1 && !cacerts. is_empty ( ) {
349- certs. extend ( cacerts) ;
350- }
351-
352- client_config. with_client_auth_cert ( certs, privkey) . unwrap ( )
353- } else {
354- client_config. with_no_client_auth ( )
355- }
356- }
357-
358149fn test_tls_dial ( ) {
359150 let ( meta_1, receiver_1) = create_meta ( 1 . into ( ) ) ;
360151 let ( meta_2, receiver_2) = create_meta ( 1 . into ( ) ) ;
0 commit comments