mirror of
https://github.com/chatmail/relay.git
synced 2026-08-10 10:30:51 +00:00
Jagoda Estera Ślązak
d3f5412420
Switches crypto provider to keep chatmail codebase consistent, analogous to https://github.com/chatmail/core/pull/8313 Signed-off-by: Jagoda Ślązak <jslazak@jslazak.com>
58 lines
2.0 KiB
Rust
58 lines
2.0 KiB
Rust
//! TLS support.
|
|
use std::sync::Arc;
|
|
use tokio::io::{AsyncRead, AsyncWrite};
|
|
use tokio_rustls::rustls::client::ClientSessionMemoryCache;
|
|
use tokio_rustls::{TlsStream, rustls};
|
|
|
|
mod danger;
|
|
use danger::NoCertificateVerification;
|
|
|
|
pub async fn wrap_rustls<IO>(
|
|
hostname: &str,
|
|
stream: IO,
|
|
resumption_store: Arc<ClientSessionMemoryCache>,
|
|
dangerous_no_cert_verification: bool,
|
|
) -> Result<TlsStream<IO>, crate::error::Error>
|
|
where
|
|
IO: AsyncRead + AsyncWrite + Unpin,
|
|
{
|
|
let config = configure_rustls(resumption_store, dangerous_no_cert_verification)?;
|
|
let tls = tokio_rustls::TlsConnector::from(Arc::new(config));
|
|
let name = rustls::pki_types::ServerName::try_from(hostname)?.to_owned();
|
|
let tls_stream = tls.connect(name, stream).await?;
|
|
Ok(tls_stream.into())
|
|
}
|
|
|
|
pub fn configure_rustls(
|
|
resumption_store: Arc<ClientSessionMemoryCache>,
|
|
dangerous_no_cert_verification: bool,
|
|
) -> Result<rustls::ClientConfig, crate::error::Error> {
|
|
let root_cert_store =
|
|
rustls::RootCertStore::from_iter(webpki_roots::TLS_SERVER_ROOTS.iter().cloned());
|
|
|
|
let mut config = rustls::ClientConfig::builder_with_provider(Arc::new(
|
|
rustls::crypto::aws_lc_rs::default_provider(),
|
|
))
|
|
.with_safe_default_protocol_versions()?
|
|
.with_root_certificates(root_cert_store)
|
|
.with_no_client_auth();
|
|
|
|
// Enable TLS 1.3 session resumption
|
|
// as defined in <https://www.rfc-editor.org/rfc/rfc8446#section-2.2>.
|
|
//
|
|
// Obsolete TLS 1.2 mechanisms defined in RFC 5246
|
|
// and RFC 5077 have worse security
|
|
// and are not worth increasing
|
|
// attack surface: <https://words.filippo.io/we-need-to-talk-about-session-tickets/>.
|
|
config.resumption = rustls::client::Resumption::store(resumption_store)
|
|
.tls12_resumption(rustls::client::Tls12Resumption::Disabled);
|
|
|
|
if dangerous_no_cert_verification {
|
|
config
|
|
.dangerous()
|
|
.set_certificate_verifier(Arc::new(NoCertificateVerification::default()));
|
|
}
|
|
|
|
Ok(config)
|
|
}
|