use rustls::{ClientConfig, Error, OwnedTrustAnchor, RootCertStore};
pub(super) fn get_client_config() -> Result<ClientConfig, Error> {
let cipher_suites = lookup_suites(&[
"TLS13_CHACHA20_POLY1305_SHA256".to_string(),
"TLS13_AES_256_GCM_SHA384".to_string(),
"TLS13_AES_128_GCM_SHA256".to_string(),
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256".to_string(),
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256".to_string(),
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384".to_string(),
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384".to_string(),
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256".to_string(),
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256".to_string(),
]);
let roots = &webpki_roots::TLS_SERVER_ROOTS;
let owned_trust_anchors = roots
.0
.iter()
.map(|ta| {
OwnedTrustAnchor::from_subject_spki_name_constraints(
ta.subject,
ta.spki,
ta.name_constraints,
)
})
.collect::<Vec<_>>();
let mut store = RootCertStore::empty();
store.add_trust_anchors(owned_trust_anchors.into_iter());
let config = ClientConfig::builder()
.with_cipher_suites(&cipher_suites)
.with_safe_default_kx_groups()
.with_safe_default_protocol_versions()?
.with_root_certificates(store)
.with_no_client_auth();
Ok(config)
}
fn find_suite(name: &str) -> Option<rustls::SupportedCipherSuite> {
rustls::ALL_CIPHER_SUITES
.iter()
.find(|suite| name.to_lowercase() == format!("{:?}", suite.suite()).to_lowercase())
.copied()
}
fn lookup_suites(suites: &[String]) -> Vec<rustls::SupportedCipherSuite> {
suites
.iter()
.filter_map(|cs_name| find_suite(cs_name))
.collect()
}