rust-web-server 18.23.1

Single-binary web server and reverse proxy: automatic HTTPS (Let's Encrypt), HTTP/1.1, HTTP/2 and HTTP/3, load balancing, auth and rate limiting, configured in one TOML file. Also a Rust library: routing, middleware, MCP server, ORM, background jobs. No hyper, no Tower; HTTP/2 and HTTP/3 framing via h2 and quinn.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44

use super::*;

#[test]
fn uris_parse() {
    let u = Pkcs11Uri::parse("pkcs11:token=rws%20prod;object=web-key;type=private?module-path=/usr/lib/softhsm/libsofthsm2.so&pin-source=env:HSM_PIN").unwrap();
    assert_eq!(u.token.as_deref(), Some("rws prod"));
    assert_eq!(u.object.as_deref(), Some("web-key"));
    assert_eq!(u.module_path, "/usr/lib/softhsm/libsofthsm2.so");
    assert_eq!(u.pin, Some(PinSource::Env("HSM_PIN".into())));
    let u = Pkcs11Uri::parse("PKCS11:id=%01%02?module-path=/m.so&pin-source=file:///run/secrets/pin").unwrap();
    assert_eq!((u.id, u.pin), (Some(vec![1, 2]), Some(PinSource::File("/run/secrets/pin".into()))));
    assert!(Pkcs11Uri::parse("pkcs11:object=k").unwrap_err().contains("module-path"));
    assert!(Pkcs11Uri::parse("pkcs11:token=t?module-path=/m.so").unwrap_err().contains("object="));
    assert!(Pkcs11Uri::parse("pkcs11:color=red;object=k?module-path=/m.so").unwrap_err().contains("unknown attribute"));
    assert!(!Pkcs11Uri::is_uri("/etc/rws/key.pem"));
}

#[test]
fn raw_ecdsa_signatures_become_der() {
    // r has its top bit set (needs a 0 pad), s has leading zeros (trimmed).
    let mut raw = vec![0x80u8; 32];
    raw.extend(std::iter::repeat_n(0u8, 30).chain([0x01, 0x02]));
    let der = ecdsa_der(&raw);
    assert_eq!(&der[..4], &[0x30, 2 + 33 + 2 + 2, 0x02, 33]);
    assert_eq!(der[4], 0);
    assert_eq!(&der[der.len() - 4..], &[0x02, 2, 0x01, 0x02]);
}

#[test]
fn a_missing_module_is_a_clear_error() {
    let e = signing_key("pkcs11:object=k?module-path=/nonexistent/libnothing.so").unwrap_err();
    assert!(e.contains("/nonexistent/libnothing.so"), "{e}");
}

/// Against SoftHSM2 when the test environment provides one (CI's `pkcs11`
/// job sets these after creating a token and a key).
#[test]
fn signs_with_a_softhsm_key_when_available() {
    let Ok(uri) = std::env::var("RWS_TEST_PKCS11_URI") else { return };
    let key = signing_key(&uri).expect("opens the key");
    let signer = key.choose_scheme(&[SignatureScheme::ECDSA_NISTP256_SHA256, SignatureScheme::RSA_PSS_SHA256]).expect("a scheme");
    let sig = signer.sign(b"hello").expect("signs");
    assert!(!sig.is_empty());
}