vicarian 0.3.3

Vicarian is a TLS-first reverse-proxy server with ACME support
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53

use std::sync::Arc;

use async_trait::async_trait;
use pingora_boringssl::ssl::NameType;
use pingora_core::{listeners::TlsAccept, protocols::tls::TlsRef};
use tracing_log::log::debug;

use crate::certificates::store::CertStore;


pub struct CertHandler {
    certstore: Arc<CertStore>,
}

impl CertHandler {
    pub fn new(certstore: Arc<CertStore>) -> Self {
        Self {
            certstore
        }
    }
}

#[async_trait]
impl TlsAccept for CertHandler {

    // NOTE:This is all boringssl specific as pingora doesn't
    // currently support dynamic certs with rustls.
    async fn certificate_callback(&self, ssl: &mut TlsRef) {
        let host = ssl.servername(NameType::HOST_NAME)
            .map(str::to_string)
            .expect("No servername in TLS handshake");

        debug!("TLS Host is {host}; loading certs");

        let cert = self.certstore.by_host(&host)
            .or_else(|| self.certstore.by_wildcard(&host))
            .expect("Certificate for host not found");
        debug!("Found certificate for {host}");

        ssl.set_private_key(cert.key())
            .expect("Failed to set private key");
        ssl.set_certificate(&cert.certs()[0])
            .expect("Failed to set certificate");

        if cert.certs().len() > 1 {
            for c in cert.certs().iter().skip(1) {
                ssl.add_chain_cert(c)
                    .expect("Failed to add chain certificate");
            }
        }
    }

}