microsandbox_network/tls/
config.rs

1//! TLS interception configuration types.
2//!
3//! These types configure inline TLS MITM for the smoltcp networking stack.
4//! All TCP connections terminate at smoltcp, so TLS interception is handled
5//! directly by proxy tasks — no kernel redirect rules needed.
6
7use std::path::PathBuf;
8
9use serde::{Deserialize, Serialize};
10
11//--------------------------------------------------------------------------------------------------
12// Types
13//--------------------------------------------------------------------------------------------------
14
15/// TLS interception configuration.
16#[derive(Debug, Clone, Serialize, Deserialize)]
17pub struct TlsConfig {
18    /// Whether TLS interception is enabled.
19    #[serde(default)]
20    pub enabled: bool,
21
22    /// TCP ports subject to TLS interception (default: `[443]`).
23    #[serde(default = "default_intercepted_ports")]
24    pub intercepted_ports: Vec<u16>,
25
26    /// Domains to bypass (no MITM). Supports exact match and `*.suffix` wildcards.
27    #[serde(default)]
28    pub bypass: Vec<String>,
29
30    /// Whether to verify the upstream server's TLS certificate.
31    #[serde(default = "default_true")]
32    pub verify_upstream: bool,
33
34    /// Drop UDP to intercepted ports when TLS interception is active,
35    /// forcing QUIC traffic to fall back to TCP/TLS.
36    #[serde(default = "default_true")]
37    pub block_quic_on_intercept: bool,
38
39    /// Certificate authority configuration.
40    #[serde(default)]
41    pub ca: CaConfig,
42
43    /// Per-domain certificate cache configuration.
44    #[serde(default)]
45    pub cache: CertCacheConfig,
46}
47
48/// Certificate authority configuration for TLS interception.
49#[derive(Debug, Clone, Default, Serialize, Deserialize)]
50pub struct CaConfig {
51    /// Path to an existing CA certificate PEM file.
52    /// If `None`, a CA is auto-generated and persisted.
53    #[serde(default)]
54    pub cert_path: Option<PathBuf>,
55
56    /// Path to an existing CA private key PEM file.
57    /// If `None`, a key is auto-generated and persisted.
58    #[serde(default)]
59    pub key_path: Option<PathBuf>,
60}
61
62/// Per-domain certificate cache configuration.
63#[derive(Debug, Clone, Serialize, Deserialize)]
64pub struct CertCacheConfig {
65    /// Maximum number of cached certificates. Default: 1000.
66    #[serde(default = "default_cache_capacity")]
67    pub capacity: usize,
68
69    /// Certificate validity duration in hours. Default: 24.
70    #[serde(default = "default_cert_validity_hours")]
71    pub validity_hours: u64,
72}
73
74//--------------------------------------------------------------------------------------------------
75// Trait Implementations
76//--------------------------------------------------------------------------------------------------
77
78impl Default for TlsConfig {
79    fn default() -> Self {
80        Self {
81            enabled: false,
82            intercepted_ports: default_intercepted_ports(),
83            bypass: Vec::new(),
84            verify_upstream: true,
85            block_quic_on_intercept: true,
86            ca: CaConfig::default(),
87            cache: CertCacheConfig::default(),
88        }
89    }
90}
91
92impl Default for CertCacheConfig {
93    fn default() -> Self {
94        Self {
95            capacity: default_cache_capacity(),
96            validity_hours: default_cert_validity_hours(),
97        }
98    }
99}
100
101//--------------------------------------------------------------------------------------------------
102// Functions
103//--------------------------------------------------------------------------------------------------
104
105fn default_true() -> bool {
106    true
107}
108
109fn default_intercepted_ports() -> Vec<u16> {
110    vec![443]
111}
112
113fn default_cache_capacity() -> usize {
114    1000
115}
116
117fn default_cert_validity_hours() -> u64 {
118    24
119}
microsandbox_network/tls/config.rs

microsandbox_network/tls/
config.rs
