spiffe-rs 0.1.0

Rust port of spiffe-go with SPIFFE IDs, bundles, SVIDs, Workload API client, federation helpers, and rustls-based SPIFFE TLS utilities.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55

use hyper::service::service_fn;
use hyper::{Body, Request, Response};
use spiffe_rs::spiffeid;
use spiffe_rs::spiffetls;
use spiffe_rs::workloadapi;
use std::sync::Arc;
use tokio::net::TcpListener;
use tokio_rustls::TlsAcceptor;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    ensure_socket_env();
    let ctx = workloadapi::background();

    let source = Arc::new(workloadapi::X509Source::new(&ctx, Vec::new()).await?);
    let client_id = spiffeid::require_from_string("spiffe://example.org/client");
    let authorizer = spiffetls::tlsconfig::authorize_id(client_id);
    let tls_config = spiffetls::tlsconfig::mtls_server_config(source.as_ref(), source.clone(), authorizer)?;
    let acceptor = TlsAcceptor::from(Arc::new(tls_config));

    let listener = TcpListener::bind("127.0.0.1:8443").await?;
    println!("HTTP server listening on 127.0.0.1:8443");

    loop {
        let (stream, _) = listener.accept().await?;
        let acceptor = acceptor.clone();
        tokio::spawn(async move {
            let tls = match acceptor.accept(stream).await {
                Ok(tls) => tls,
                Err(err) => {
                    eprintln!("tls error: {}", err);
                    return;
                }
            };
            let service = service_fn(handle_request);
            if let Err(err) = hyper::server::conn::Http::new()
                .serve_connection(tls, service)
                .await
            {
                eprintln!("http error: {}", err);
            }
        });
    }
}

async fn handle_request(_req: Request<Body>) -> Result<Response<Body>, hyper::Error> {
    println!("Request received");
    Ok(Response::new(Body::from("Success!!!")))
}

fn ensure_socket_env() {
    if std::env::var("SPIFFE_ENDPOINT_SOCKET").is_err() {
        std::env::set_var("SPIFFE_ENDPOINT_SOCKET", "unix:///tmp/agent.sock");
    }
}