rustfs_tls_runtime/
outbound.rs

1// Copyright 2024 RustFS Team
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7//     http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15use crate::material::OutboundTlsMaterial;
16use crate::metrics::record_outbound_tls_publication;
17use crate::state::TlsGeneration;
18use rustfs_common::{
19    MtlsIdentityPem, clear_global_root_cert, get_global_mtls_identity, get_global_outbound_tls_generation, get_global_root_cert,
20    set_global_mtls_identity, set_global_outbound_tls_generation, set_global_root_cert,
21};
22
23#[derive(Debug, Clone)]
24pub struct GlobalPublishedOutboundTlsState {
25    pub generation: TlsGeneration,
26    pub root_ca_pem: Option<Vec<u8>>,
27    pub mtls_identity: Option<MtlsIdentityPem>,
28}
29
30#[derive(Debug, Clone, Copy, PartialEq, Eq)]
31pub struct GlobalOutboundTlsStateSummary {
32    pub generation: TlsGeneration,
33    pub has_root_ca: bool,
34    pub has_mtls_identity: bool,
35}
36
37pub async fn publish_global_outbound_tls_state(generation: TlsGeneration, material: &OutboundTlsMaterial) {
38    if !material.root_ca_pem.is_empty() {
39        set_global_root_cert(material.root_ca_pem.clone()).await;
40    } else {
41        clear_global_root_cert().await;
42    }
43    set_global_mtls_identity(material.mtls_identity.clone()).await;
44    set_global_outbound_tls_generation(generation.0);
45    record_outbound_tls_publication(generation.0, !material.root_ca_pem.is_empty(), material.mtls_identity.is_some());
46}
47
48pub async fn load_global_outbound_tls_state() -> GlobalPublishedOutboundTlsState {
49    GlobalPublishedOutboundTlsState {
50        generation: TlsGeneration(get_global_outbound_tls_generation()),
51        root_ca_pem: get_global_root_cert().await,
52        mtls_identity: get_global_mtls_identity().await,
53    }
54}
55
56pub fn load_global_outbound_tls_generation() -> TlsGeneration {
57    TlsGeneration(get_global_outbound_tls_generation())
58}
59
60pub async fn summarize_global_outbound_tls_state() -> GlobalOutboundTlsStateSummary {
61    let state = load_global_outbound_tls_state().await;
62    GlobalOutboundTlsStateSummary {
63        generation: state.generation,
64        has_root_ca: state.root_ca_pem.as_ref().is_some_and(|pem| !pem.is_empty()),
65        has_mtls_identity: state.mtls_identity.is_some(),
66    }
67}
rustfs_tls_runtime/outbound.rs

rustfs_tls_runtime/
outbound.rs
