leyline/tls/trust/
config.rs

1use std::path::PathBuf;
2
3use crate::tls::builder::TlsMinVersion;
4
5#[derive(Debug, Clone)]
6#[non_exhaustive]
7pub struct TlsTrustConfig {
8    pub(crate) use_env_roots: bool,
9    pub(crate) use_system_roots: bool,
10    pub(crate) ca_files: Vec<PathBuf>,
11    pub(crate) ca_der: Vec<Vec<u8>>,
12    pub(crate) client_identity: Option<ClientIdentity>,
13    pub(crate) pinned_leaf_sha256: Vec<[u8; 32]>,
14    pub(crate) accept_invalid_certs: bool,
15    pub(crate) min_tls_version: TlsMinVersion,
16}
17
18impl Default for TlsTrustConfig {
19    fn default() -> Self {
20        Self {
21            use_env_roots: true,
22            use_system_roots: true,
23            ca_files: Vec::new(),
24            ca_der: Vec::new(),
25            client_identity: None,
26            pinned_leaf_sha256: Vec::new(),
27            accept_invalid_certs: false,
28            min_tls_version: TlsMinVersion::Tls10,
29        }
30    }
31}
32
33impl TlsTrustConfig {
34    pub fn new() -> Self {
35        Self::default()
36    }
37
38    pub fn env_roots(mut self, on: bool) -> Self {
39        self.use_env_roots = on;
40        self
41    }
42
43    pub fn system_roots(mut self, on: bool) -> Self {
44        self.use_system_roots = on;
45        self
46    }
47
48    pub fn add_ca_file(mut self, path: impl Into<PathBuf>) -> Self {
49        self.ca_files.push(path.into());
50        self
51    }
52
53    pub fn add_ca_der(mut self, der: impl Into<Vec<u8>>) -> Self {
54        self.ca_der.push(der.into());
55        self
56    }
57
58    pub fn add_pinned_leaf_sha256(mut self, sha256: [u8; 32]) -> Self {
59        self.pinned_leaf_sha256.push(sha256);
60        self
61    }
62
63    pub fn client_identity(
64        mut self,
65        certificate_chain_file: impl Into<PathBuf>,
66        private_key_file: impl Into<PathBuf>,
67    ) -> Self {
68        self.client_identity = Some(ClientIdentity {
69            certificate_chain_file: certificate_chain_file.into(),
70            private_key_file: private_key_file.into(),
71        });
72        self
73    }
74
75    pub fn danger_accept_invalid_certs(mut self, accept: bool) -> Self {
76        self.accept_invalid_certs = accept;
77        self
78    }
79
80    pub fn min_tls_version(mut self, version: TlsMinVersion) -> Self {
81        self.min_tls_version = version;
82        self
83    }
84
85    pub(crate) fn accepts_invalid_certs(&self) -> bool {
86        self.accept_invalid_certs
87    }
88
89    pub(crate) fn uses_system_roots(&self) -> bool {
90        self.use_system_roots
91    }
92
93    pub(crate) fn has_client_identity(&self) -> bool {
94        self.client_identity.is_some()
95    }
96
97    pub(crate) fn pinned_leaf_sha256(&self) -> &[[u8; 32]] {
98        &self.pinned_leaf_sha256
99    }
100}
101
102#[derive(Debug, Clone)]
103pub(crate) struct ClientIdentity {
104    pub(crate) certificate_chain_file: PathBuf,
105    pub(crate) private_key_file: PathBuf,
106}
leyline/tls/trust/config.rs

leyline/tls/trust/
config.rs
