Update pki provider

.github/workflows/build.yml

@@ -12,7 +12,7 @@ on:
       - master
   merge_group:
   schedule:
-    - cron: '30 13 * * 1,5'
+    - cron: '30 13 * * *'
 
 env:
   CARGO_TERM_COLOR: always
@@ -62,6 +62,9 @@ jobs:
         env:
           RUST_BACKTRACE: 1
 
+      - name: cargo build (debug; rustls-mbedtls-provider-examples)
+        run: cargo build --locked -p rustls-mbedtls-provider-examples
+
   features:
     name: Features
     runs-on: ubuntu-latest
@@ -86,7 +89,7 @@ jobs:
           RUST_BACKTRACE: 1
 
       - name: cargo test (debug; no default features)
-        run: cargo test --locked --no-default-features
+        run: cargo test --locked --no-default-features --workspace
 
       - name: cargo test (rustls_mbedcrypto_provider; debug; no default features; tls12)
         run: cargo test --locked --no-default-features --features tls12 --package rustls-mbedcrypto-provider
@@ -95,7 +98,7 @@ jobs:
         run: cargo test --locked --no-default-features --features tls12,rdrand --package rustls-mbedcrypto-provider
 
       - name: cargo test (release; no run)
-        run: cargo test --locked --release --no-run
+        run: cargo test --locked --release --no-run --workspace
 
 # TODO: add fuzz tests
 # TODO: add benchmarks

Cargo.toml

@@ -1,7 +1,4 @@
 [workspace]
-members = ["rustls-mbedcrypto-provider", "rustls-mbedpki-provider"]
+members = ["examples","rustls-mbedcrypto-provider", "rustls-mbedpki-provider"]
 default-members = ["rustls-mbedcrypto-provider", "rustls-mbedpki-provider"]
 resolver = "2"
-
-[workspace.dependencies]
-mbedtls = { version = "0.12.0-alpha.2", default_features = false }

examples/Cargo.toml

@@ -0,0 +1,16 @@
+[package]
+name = "rustls-mbedtls-provider-examples"
+version = "0.1.0"
+edition = "2021"
+license = "MPL-2.0"
+description = "rustls-mbedtls-provider example code."
+publish = false
+
+[dependencies]
+rustls-mbedcrypto-provider = { path = "../rustls-mbedcrypto-provider" }
+rustls-mbedpki-provider = { path = "../rustls-mbedpki-provider" }
+env_logger = "0.10"
+# TODO: upgrade to use formal 0.22.0 or 0.22.0-* versions when availabe
+rustls = { git = "https://github.com/rustls/rustls", rev = "b776a5778ad333653670c34ff9125d8ae59b6047", version = "0.22.0-alpha.4", default-features = false }
+rustls-native-certs = "0.6.3"
+

examples/src/main.rs

@@ -0,0 +1,56 @@
+/* Copyright (c) Fortanix, Inc.
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+**/
+
+use std::io::{stderr, stdout, Read, Write};
+use std::net::TcpStream;
+use std::sync::Arc;
+
+use rustls_mbedcrypto_provider::MBEDTLS;
+use rustls_mbedpki_provider::MbedTlsServerCertVerifier;
+
+fn main() {
+    env_logger::init();
+
+    let root_certs: Vec<_> = rustls_native_certs::load_native_certs()
+        .expect("could not load platform certs")
+        .into_iter()
+        .map(|cert| cert.0.into())
+        .collect();
+    let server_cert_verifier = MbedTlsServerCertVerifier::new(&root_certs).unwrap();
+    let config = rustls::ClientConfig::builder_with_provider(MBEDTLS)
+        .with_safe_default_cipher_suites()
+        .with_safe_default_kx_groups()
+        .with_safe_default_protocol_versions()
+        .unwrap()
+        .dangerous()
+        .with_custom_certificate_verifier(Arc::new(server_cert_verifier))
+        .with_no_client_auth();
+
+    let server_name = "www.rust-lang.org".try_into().unwrap();
+    let mut conn = rustls::ClientConnection::new(Arc::new(config), server_name).unwrap();
+    let mut sock = TcpStream::connect("www.rust-lang.org:443").unwrap();
+    let mut tls = rustls::Stream::new(&mut conn, &mut sock);
+    tls.write_all(
+        concat!(
+            "GET / HTTP/1.1\r\n",
+            "Host: www.rust-lang.org\r\n",
+            "Connection: close\r\n",
+            "Accept-Encoding: identity\r\n",
+            "\r\n"
+        )
+        .as_bytes(),
+    )
+    .unwrap();
+    let ciphersuite = tls
+        .conn
+        .negotiated_cipher_suite()
+        .unwrap();
+    writeln!(&mut stderr(), "Current ciphersuite: {:?}", ciphersuite.suite()).unwrap();
+    let mut plaintext = Vec::new();
+    tls.read_to_end(&mut plaintext).unwrap();
+    stdout().write_all(&plaintext).unwrap();
+}

rustls-mbedcrypto-provider/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "rustls-mbedcrypto-provider"
-version = "0.0.1"
+version = "0.0.1-alpha.1"
 edition = "2021"
 license = "MPL-2.0"
 description = "Mbedtls based crypto provider for rustls."

rustls-mbedpki-provider/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "rustls-mbedpki-provider"
-version = "0.1.0"
+version = "0.1.0-alpha.1"
 edition = "2021"
 license = "MPL-2.0"
 description = "Implements rustls PKI traits using mbedtls"
@@ -11,7 +11,7 @@ categories = ["network-programming", "cryptography"]
 resolver = "2"
 
 [dependencies]
-rustls = { version = "0.21", features = ["dangerous_configuration"] }
+rustls = { git = "https://github.com/rustls/rustls", rev = "b776a5778ad333653670c34ff9125d8ae59b6047", version = "0.22.0-alpha.4", default_features = false }
 mbedtls = { version = "0.12.0-alpha.2", features = [
     "x509",
     "chrono",
@@ -20,6 +20,9 @@ mbedtls = { version = "0.12.0-alpha.2", features = [
 
 x509-parser = "0.15"
 chrono = "0.4"
+pki-types = { package = "rustls-pki-types", version = "0.2.1", features = [
+    "std",
+] }
 
 [target.'cfg(target_env = "msvc")'.dependencies]
 # mbedtls need feature `time` to build when targeting msvc
@@ -32,3 +35,4 @@ mbedtls = { version = "0.12.0-alpha.2", default-features = false, features = [
 
 [dev-dependencies]
 rustls-pemfile = "1.0"
+rustls = { git = "https://github.com/rustls/rustls", rev = "b776a5778ad333653670c34ff9125d8ae59b6047", version = "0.22.0-alpha.4" }