Skip to content

Commit 003f727

Browse files
s-arashArash SahebolamriTaowyoo
authored
Upgrade to rustls v0.22 (#15)
* Upgrade to rustls v0.22 * Apply suggestions from code review Co-authored-by: YX Cao <[email protected]> --------- Co-authored-by: Arash Sahebolamri <[email protected]> Co-authored-by: YX Cao <[email protected]>
1 parent a04c185 commit 003f727

File tree

17 files changed

+225
-733
lines changed

17 files changed

+225
-733
lines changed

‎Cargo.lock

Lines changed: 14 additions & 12 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎examples/Cargo.toml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,10 @@ description = "rustls-mbedtls-provider example code."
77
publish = false
88

99
[dependencies]
10-
rustls-mbedcrypto-provider = { path = "../rustls-mbedcrypto-provider" }
10+
rustls-mbedcrypto-provider = { path = "../rustls-mbedcrypto-provider", features = ["tls12"] }
1111
rustls-mbedpki-provider = { path = "../rustls-mbedpki-provider" }
1212
env_logger = "0.10"
13-
rustls = { version = "0.22.0-alpha.4", default-features = false }
13+
rustls = { version = "0.22.0", default-features = false }
1414
rustls-native-certs = "0.6.3"
15+
rustls-pki-types = "1"
16+
rustls-pemfile = "2"

‎examples/src/main.rs

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ use std::io::{stderr, stdout, Read, Write};
99
use std::net::TcpStream;
1010
use std::sync::Arc;
1111

12-
use rustls_mbedcrypto_provider::MBEDTLS;
12+
use rustls_mbedcrypto_provider::mbedtls_crypto_provider;
1313
use rustls_mbedpki_provider::MbedTlsServerCertVerifier;
1414

1515
fn main() {
@@ -21,9 +21,7 @@ fn main() {
2121
.map(|cert| cert.0.into())
2222
.collect();
2323
let server_cert_verifier = MbedTlsServerCertVerifier::new(&root_certs).unwrap();
24-
let config = rustls::ClientConfig::builder_with_provider(MBEDTLS)
25-
.with_safe_default_cipher_suites()
26-
.with_safe_default_kx_groups()
24+
let config = rustls::ClientConfig::builder_with_provider(mbedtls_crypto_provider().into())
2725
.with_safe_default_protocol_versions()
2826
.unwrap()
2927
.dangerous()

‎rustls-mbedcrypto-provider/Cargo.toml

Lines changed: 6 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -12,15 +12,15 @@ categories = ["network-programming", "cryptography"]
1212
resolver = "2"
1313

1414
[dependencies]
15-
rustls = { version = "0.22.0-alpha.4", default-features = false }
15+
rustls = { version = "0.22.0", default-features = false }
1616
mbedtls = { version = "0.12.0-alpha.2", default-features = false, features = [
1717
"std",
1818
] }
1919
log = { version = "0.4.4", optional = true }
20-
pki-types = { package = "rustls-pki-types", version = "0.2.1", features = [
20+
pki-types = { package = "rustls-pki-types", version = "1", features = [
2121
"std",
2222
] }
23-
webpki = { package = "rustls-webpki", version = "0.102.0-alpha.6", features = [
23+
webpki = { package = "rustls-webpki", version = "0.102.0", features = [
2424
"alloc",
2525
"std",
2626
], default-features = false }
@@ -36,16 +36,11 @@ mbedtls = { version = "0.12.0-alpha.2", default-features = false, features = [
3636
] }
3737

3838
[dev-dependencies]
39-
rustls = { version = "0.22.0-alpha.4", default-features = false, features = [
39+
rustls = { version = "0.22.0", default-features = false, features = [
4040
"ring",
4141
] }
42-
webpki = { package = "rustls-webpki", version = "0.102.0-alpha.1", default-features = false, features = [
43-
"alloc",
44-
"std",
45-
] }
46-
pki-types = { package = "rustls-pki-types", version = "0.2.0" }
47-
webpki-roots = "0.26.0-alpha.2"
48-
rustls-pemfile = "=2.0.0-alpha.2"
42+
webpki-roots = "0.26.0"
43+
rustls-pemfile = "2"
4944
env_logger = "0.10"
5045
log = { version = "0.4.4" }
5146

‎rustls-mbedcrypto-provider/examples/client.rs

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ use std::io::{stdout, Read, Write};
99
use std::net::TcpStream;
1010
use std::sync::Arc;
1111

12-
use rustls_mbedcrypto_provider::MBEDTLS;
12+
use rustls_mbedcrypto_provider::mbedtls_crypto_provider;
1313

1414
fn main() {
1515
env_logger::init();
@@ -21,8 +21,9 @@ fn main() {
2121
.cloned(),
2222
);
2323

24-
let config = rustls::ClientConfig::builder_with_provider(MBEDTLS)
25-
.with_safe_defaults()
24+
let config = rustls::ClientConfig::builder_with_provider(mbedtls_crypto_provider().into())
25+
.with_safe_default_protocol_versions()
26+
.unwrap()
2627
.with_root_certificates(root_store)
2728
.with_no_client_auth();
2829

‎rustls-mbedcrypto-provider/examples/internal/bench.rs

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ use pki_types::{CertificateDer, PrivateKeyDer};
2222

2323
use rustls::client::Resumption;
2424
use rustls::crypto::ring::{cipher_suite, Ticketer};
25+
use rustls::crypto::CryptoProvider;
2526
use rustls::server::{NoServerSessionStorage, ServerSessionMemoryCache, WebPkiClientVerifier};
2627
use rustls::RootCertStore;
2728
use rustls::{ClientConfig, ClientConnection};
@@ -298,9 +299,7 @@ fn make_server_config(
298299
ClientAuth::No => WebPkiClientVerifier::no_client_auth(),
299300
};
300301

301-
let mut cfg = ServerConfig::builder_with_provider(rustls_mbedcrypto_provider::MBEDTLS)
302-
.with_safe_default_cipher_suites()
303-
.with_safe_default_kx_groups()
302+
let mut cfg = ServerConfig::builder_with_provider(rustls_mbedcrypto_provider::mbedtls_crypto_provider().into())
304303
.with_protocol_versions(&[params.version])
305304
.unwrap()
306305
.with_client_cert_verifier(client_auth)
@@ -324,12 +323,16 @@ fn make_client_config(params: &BenchmarkParam, clientauth: ClientAuth, resume: R
324323
let mut rootbuf = io::BufReader::new(fs::File::open(params.key_type.path_for("ca.cert")).unwrap());
325324
root_store.add_parsable_certificates(rustls_pemfile::certs(&mut rootbuf).map(|result| result.unwrap()));
326325

327-
let cfg = ClientConfig::builder_with_provider(rustls_mbedcrypto_provider::MBEDTLS)
328-
.with_cipher_suites(&[params.ciphersuite])
329-
.with_safe_default_kx_groups()
330-
.with_protocol_versions(&[params.version])
331-
.unwrap()
332-
.with_root_certificates(root_store);
326+
let cfg = ClientConfig::builder_with_provider(
327+
CryptoProvider {
328+
cipher_suites: vec![params.ciphersuite],
329+
..rustls_mbedcrypto_provider::mbedtls_crypto_provider()
330+
}
331+
.into(),
332+
)
333+
.with_protocol_versions(&[params.version])
334+
.unwrap()
335+
.with_root_certificates(root_store);
333336

334337
let mut cfg = if clientauth == ClientAuth::Yes {
335338
cfg.with_client_auth_cert(params.key_type.get_client_chain(), params.key_type.get_client_key())

‎rustls-mbedcrypto-provider/src/lib.rs

Lines changed: 25 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,10 @@ pub(crate) mod tls12;
9191
pub(crate) mod tls13;
9292

9393
use mbedtls::rng::Random;
94-
use rustls::{SignatureScheme, SupportedCipherSuite, WebPkiSupportedAlgorithms};
94+
use rustls::{
95+
crypto::{CryptoProvider, KeyProvider, SecureRandom, WebPkiSupportedAlgorithms},
96+
SignatureScheme, SupportedCipherSuite,
97+
};
9598

9699
/// RNG supported by *mbedtls*
97100
pub mod rng {
@@ -115,43 +118,43 @@ pub mod rng {
115118
}
116119
}
117120

118-
/// A `CryptoProvider` backed by the [*mbedtls*] crate.
121+
/// returns a `CryptoProvider` backed by the [*mbedtls*] crate.
119122
///
120123
/// [*mbedtls*]: https://github.com/fortanix/rust-mbedtls
121-
pub static MBEDTLS: &'static dyn rustls::crypto::CryptoProvider = &Mbedtls;
124+
pub fn mbedtls_crypto_provider() -> CryptoProvider {
125+
CryptoProvider {
126+
cipher_suites: ALL_CIPHER_SUITES.to_vec(),
127+
kx_groups: ALL_KX_GROUPS.to_vec(),
128+
signature_verification_algorithms: SUPPORTED_SIG_ALGS,
129+
secure_random: &MbedtlsSecureRandom,
130+
key_provider: &MbedtlsKeyProvider,
131+
}
132+
}
122133

123-
/// Crypto provider based on the [*mbedtls*] crate.
124-
///
125-
/// [*mbedtls*]: https://github.com/fortanix/rust-mbedtls
126134
#[derive(Debug)]
127-
struct Mbedtls;
135+
/// Implements `SecureRandom` using `mbedtls`
136+
pub struct MbedtlsSecureRandom;
128137

129-
impl rustls::crypto::CryptoProvider for Mbedtls {
130-
fn fill_random(&self, bytes: &mut [u8]) -> Result<(), rustls::crypto::GetRandomFailed> {
138+
impl SecureRandom for MbedtlsSecureRandom {
139+
fn fill(&self, buf: &mut [u8]) -> Result<(), rustls::crypto::GetRandomFailed> {
131140
rng::rng_new()
132141
.ok_or(rustls::crypto::GetRandomFailed)?
133-
.random(bytes)
142+
.random(buf)
134143
.map_err(|_| rustls::crypto::GetRandomFailed)
135144
}
145+
}
136146

137-
fn default_cipher_suites(&self) -> &'static [SupportedCipherSuite] {
138-
ALL_CIPHER_SUITES
139-
}
140-
141-
fn default_kx_groups(&self) -> &'static [&'static dyn rustls::crypto::SupportedKxGroup] {
142-
ALL_KX_GROUPS
143-
}
147+
#[derive(Debug)]
148+
/// Implements `KeyProvider` using `mbedtls`
149+
pub struct MbedtlsKeyProvider;
144150

151+
impl KeyProvider for MbedtlsKeyProvider {
145152
fn load_private_key(
146153
&self,
147-
key_der: pki_types::PrivateKeyDer<'static>,
154+
key_der: webpki::types::PrivateKeyDer<'static>,
148155
) -> Result<alloc::sync::Arc<dyn rustls::sign::SigningKey>, rustls::Error> {
149156
Ok(alloc::sync::Arc::new(sign::MbedTlsPkSigningKey::new(&key_der)?))
150157
}
151-
152-
fn signature_verification_algorithms(&self) -> WebPkiSupportedAlgorithms {
153-
SUPPORTED_SIG_ALGS
154-
}
155158
}
156159

157160
/// The cipher suite configuration that an application should use by default.

0 commit comments

Comments
 (0)