1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
use std::io::BufRead;
use std::ops::Deref;
use anyhow::{anyhow, bail, Context};
use rustls::cipher_suite::{
TLS13_AES_128_GCM_SHA256, TLS13_AES_256_GCM_SHA384, TLS13_CHACHA20_POLY1305_SHA256,
};
use rustls::kx_group::{SECP256R1, SECP384R1, X25519};
use rustls::server::AllowAnyAnonymousOrAuthenticatedClient;
use rustls::version::TLS13;
use rustls::{Certificate, PrivateKey, RootCertStore, ServerConfig};
use rustls_pemfile::Item::{ECKey, PKCS8Key, RSAKey, X509Certificate};
#[derive(Clone, Copy, Debug)]
#[repr(transparent)]
pub struct TrustedCertificate;
#[repr(transparent)]
pub struct Config(ServerConfig);
impl Deref for Config {
type Target = ServerConfig;
fn deref(&self) -> &Self::Target {
&self.0
}
}
impl From<Config> for ServerConfig {
fn from(conf: Config) -> Self {
conf.0
}
}
fn read_certificates(mut rd: impl BufRead) -> anyhow::Result<Vec<Certificate>> {
rustls_pemfile::read_all(&mut rd)?
.into_iter()
.map(|item| match item {
X509Certificate(buf) => Ok(Certificate(buf)),
_ => bail!("unsupported certificate type"),
})
.collect()
}
impl Config {
pub fn read(
mut certs: impl BufRead,
mut key: impl BufRead,
mut cas: impl BufRead,
) -> anyhow::Result<Self> {
let certs =
read_certificates(&mut certs).context("failed to read server certificate chain")?;
let key = {
let mut items = rustls_pemfile::read_all(&mut key)
.context("failed to read server certificate key")?;
let key = items
.pop()
.ok_or_else(|| anyhow!("server certificate key missing"))
.and_then(|item| match item {
RSAKey(buf) | PKCS8Key(buf) | ECKey(buf) => Ok(PrivateKey(buf)),
_ => bail!("unsupported key type"),
})?;
if !items.is_empty() {
bail!("more than one server certificate key specified")
}
key
};
let client_verifier = {
let mut roots = RootCertStore::empty();
read_certificates(&mut cas)
.context("failed to read CA certificates")?
.into_iter()
.try_for_each(|ref cert| roots.add(cert))
.context("failed to construct root certificate store")?;
AllowAnyAnonymousOrAuthenticatedClient::new(roots)
};
ServerConfig::builder()
.with_cipher_suites(&[
TLS13_AES_256_GCM_SHA384,
TLS13_AES_128_GCM_SHA256,
TLS13_CHACHA20_POLY1305_SHA256,
])
.with_kx_groups(&[&X25519, &SECP384R1, &SECP256R1])
.with_protocol_versions(&[&TLS13])?
.with_client_cert_verifier(client_verifier)
.with_single_cert(certs, key)
.context("invalid server certificate key")
.map(Self)
}
}
