tcp_stream/
openssl_impl.rs

1use crate::{
2    HandshakeError, HandshakeResult, Identity, MidHandshakeTlsStream, TLSConfig, TcpStream,
3};
4
5use openssl::x509::X509;
6use std::io;
7
8/// Reexport openssl's `TlsConnector`
9pub use openssl::ssl::{SslConnector as OpenSslConnector, SslMethod as OpenSslMethod};
10
11/// A `TcpStream` wrapped by openssl
12pub type OpenSslStream = openssl::ssl::SslStream<TcpStream>;
13
14/// A `MidHandshakeTlsStream` from openssl
15pub type OpenSslMidHandshakeTlsStream = openssl::ssl::MidHandshakeSslStream<TcpStream>;
16
17/// A `HandshakeError` from openssl
18pub type OpenSslHandshakeError = openssl::ssl::HandshakeError<TcpStream>;
19
20/// An `ErrorStack` from openssl
21pub type OpenSslErrorStack = openssl::error::ErrorStack;
22
23fn openssl_connector(
24    config: TLSConfig<'_, '_, '_>,
25) -> io::Result<OpenSslConnector> {
26    let mut builder = OpenSslConnector::builder(OpenSslMethod::tls())?;
27    if let Some(identity) = config.identity {
28        let (cert, pkey, chain) = match identity {
29            Identity::PKCS8 { pem, key } => {
30                let pkey = openssl::pkey::PKey::private_key_from_pem(key)?;
31                let mut chain = openssl::x509::X509::stack_from_pem(pem)?.into_iter();
32                let cert = chain.next();
33                (cert, Some(pkey), Some(chain.collect()))
34            }
35            Identity::PKCS12 { der, password } => {
36                let mut openssl_identity =
37                    openssl::pkcs12::Pkcs12::from_der(der)?.parse2(password)?;
38                (
39                    openssl_identity.cert,
40                    openssl_identity.pkey,
41                    openssl_identity
42                        .ca
43                        .take()
44                        .map(|stack| stack.into_iter().collect::<Vec<_>>()),
45                )
46            }
47        };
48        if let Some(cert) = cert.as_ref() {
49            builder.set_certificate(cert)?;
50        }
51        if let Some(pkey) = pkey.as_ref() {
52            builder.set_private_key(pkey)?;
53        }
54        if let Some(chain) = chain.as_ref() {
55            for cert in chain.iter().rev() {
56                builder.add_extra_chain_cert(cert.to_owned())?;
57            }
58        }
59    }
60    if let Some(cert_chain) = config.cert_chain.as_ref() {
61        for cert in X509::stack_from_pem(cert_chain.as_bytes())?.drain(..).rev() {
62            builder.cert_store_mut().add_cert(cert)?;
63        }
64    }
65    Ok(builder.build())
66}
67
68pub(crate) fn into_openssl_impl(
69    s: TcpStream,
70    domain: &str,
71    config: TLSConfig<'_, '_, '_>,
72) -> HandshakeResult {
73    s.into_openssl(&openssl_connector(config)?, domain)
74}
75
76impl From<OpenSslStream> for TcpStream {
77    fn from(s: OpenSslStream) -> Self {
78        TcpStream::OpenSsl(Box::new(s))
79    }
80}
81
82impl From<OpenSslMidHandshakeTlsStream> for MidHandshakeTlsStream {
83    fn from(mid: OpenSslMidHandshakeTlsStream) -> Self {
84        MidHandshakeTlsStream::Openssl(mid)
85    }
86}
87
88impl From<OpenSslHandshakeError> for HandshakeError {
89    fn from(error: OpenSslHandshakeError) -> Self {
90        match error {
91            openssl::ssl::HandshakeError::WouldBlock(mid) => HandshakeError::WouldBlock(mid.into()),
92            openssl::ssl::HandshakeError::Failure(failure) => {
93                HandshakeError::Failure(io::Error::other(failure.into_error()))
94            }
95            openssl::ssl::HandshakeError::SetupFailure(failure) => failure.into(),
96        }
97    }
98}
99
100impl From<OpenSslErrorStack> for HandshakeError {
101    fn from(error: OpenSslErrorStack) -> Self {
102        Self::Failure(error.into())
103    }
104}
tcp_stream/openssl_impl.rs

tcp_stream/
openssl_impl.rs
