feat: switch to aws-lc-rs cryptography provider (#178)

Switches crypto provider to keep
chatmail codebase consistent,
analogous to https://github.com/chatmail/core/pull/8313

Signed-off-by: Jagoda Ślązak <jslazak@jslazak.com>

filtermail/src/main.rs

@@ -81,7 +81,7 @@ async fn main() -> Result<(), error::Error> {
         .format_timestamp(None)
         .init();
 
-    tokio_rustls::rustls::crypto::ring::default_provider()
+    tokio_rustls::rustls::crypto::aws_lc_rs::default_provider()
         .install_default()
         .expect("Failed to set up rustls crypto provider.");
 

filtermail/src/tls.rs

@@ -16,7 +16,7 @@ pub async fn wrap_rustls<IO>(
 where
     IO: AsyncRead + AsyncWrite + Unpin,
 {
-    let config = configure_rustls(resumption_store, dangerous_no_cert_verification);
+    let config = configure_rustls(resumption_store, dangerous_no_cert_verification)?;
     let tls = tokio_rustls::TlsConnector::from(Arc::new(config));
     let name = rustls::pki_types::ServerName::try_from(hostname)?.to_owned();
     let tls_stream = tls.connect(name, stream).await?;
@@ -26,13 +26,16 @@ where
 pub fn configure_rustls(
     resumption_store: Arc<ClientSessionMemoryCache>,
     dangerous_no_cert_verification: bool,
-) -> rustls::ClientConfig {
+) -> Result<rustls::ClientConfig, crate::error::Error> {
     let root_cert_store =
         rustls::RootCertStore::from_iter(webpki_roots::TLS_SERVER_ROOTS.iter().cloned());
 
-    let mut config = rustls::ClientConfig::builder()
-        .with_root_certificates(root_cert_store)
-        .with_no_client_auth();
+    let mut config = rustls::ClientConfig::builder_with_provider(Arc::new(
+        rustls::crypto::aws_lc_rs::default_provider(),
+    ))
+    .with_safe_default_protocol_versions()?
+    .with_root_certificates(root_cert_store)
+    .with_no_client_auth();
 
     // Enable TLS 1.3 session resumption
     // as defined in <https://www.rfc-editor.org/rfc/rfc8446#section-2.2>.
@@ -50,5 +53,5 @@ pub fn configure_rustls(
             .set_certificate_verifier(Arc::new(NoCertificateVerification::default()));
     }
 
-    config
+    Ok(config)
 }

filtermail/src/tls/danger.rs

@@ -24,7 +24,7 @@ impl rustls::client::danger::ServerCertVerifier for NoCertificateVerification {
         cert: &CertificateDer<'_>,
         dss: &rustls::DigitallySignedStruct,
     ) -> Result<rustls::client::danger::HandshakeSignatureValid, rustls::Error> {
-        let provider = rustls::crypto::ring::default_provider();
+        let provider = rustls::crypto::aws_lc_rs::default_provider();
         let supported_schemes = &provider.signature_verification_algorithms;
         rustls::crypto::verify_tls12_signature(message, cert, dss, supported_schemes)
     }
@@ -35,13 +35,13 @@ impl rustls::client::danger::ServerCertVerifier for NoCertificateVerification {
         cert: &CertificateDer<'_>,
         dss: &rustls::DigitallySignedStruct,
     ) -> Result<rustls::client::danger::HandshakeSignatureValid, rustls::Error> {
-        let provider = rustls::crypto::ring::default_provider();
+        let provider = rustls::crypto::aws_lc_rs::default_provider();
         let supported_schemes = &provider.signature_verification_algorithms;
         rustls::crypto::verify_tls13_signature(message, cert, dss, supported_schemes)
     }
 
     fn supported_verify_schemes(&self) -> Vec<rustls::SignatureScheme> {
-        let provider = rustls::crypto::ring::default_provider();
+        let provider = rustls::crypto::aws_lc_rs::default_provider();
         provider
             .signature_verification_algorithms
             .supported_schemes()

filtermail/src/transport.rs

@@ -38,8 +38,10 @@ struct HttpsClient {
 
 impl HttpsClient {
     /// Creates a new `[HttpsClient]`.
-    pub fn new(tls_resumption_store: Arc<rustls::client::ClientSessionMemoryCache>) -> Self {
-        let tls_client_config = tls::configure_rustls(tls_resumption_store.clone(), false);
+    pub fn new(
+        tls_resumption_store: Arc<rustls::client::ClientSessionMemoryCache>,
+    ) -> Result<Self, crate::error::Error> {
+        let tls_client_config = tls::configure_rustls(tls_resumption_store.clone(), false)?;
         let https_connector = hyper_rustls::HttpsConnectorBuilder::new()
             .with_tls_config(tls_client_config)
             .https_only()
@@ -50,7 +52,7 @@ impl HttpsClient {
             hyper_util::client::legacy::Client::builder(hyper_util::rt::TokioExecutor::new())
                 .build(https_connector);
 
-        let tls_client_config_relaxed = tls::configure_rustls(tls_resumption_store, true);
+        let tls_client_config_relaxed = tls::configure_rustls(tls_resumption_store, true)?;
         let https_connector_relaxed = hyper_rustls::HttpsConnectorBuilder::new()
             .with_tls_config(tls_client_config_relaxed)
             .https_only()
@@ -61,10 +63,10 @@ impl HttpsClient {
             hyper_util::client::legacy::Client::builder(hyper_util::rt::TokioExecutor::new())
                 .build(https_connector_relaxed);
 
-        Self {
+        Ok(Self {
             secure: https_client,
             relaxed: https_client_relaxed,
-        }
+        })
     }
 }
 
@@ -82,7 +84,7 @@ impl TransportHandler {
     pub fn new(config: Config) -> Result<Self, crate::error::Error> {
         let dns_resolver = Arc::new(build_resolver()?);
         let tls_resumption_store = Arc::new(rustls::client::ClientSessionMemoryCache::new(256));
-        let https_client = HttpsClient::new(tls_resumption_store.clone());
+        let https_client = HttpsClient::new(tls_resumption_store.clone())?;
 
         let mxdeliv_cache = Arc::new(retainer::Cache::new());
         let mxdeliv_cache_clone = mxdeliv_cache.clone();

filtermail/src/utils.rs

@@ -1,4 +1,3 @@
-use hickory_resolver::config::ResolverOpts;
 use hickory_resolver::{TokioResolver, proto::dnssec::TrustAnchors};
 use mailparse::MailAddr;
 use std::path::PathBuf;