diff --git a/Cargo.lock b/Cargo.lock index 3480f120e0..ef289776e1 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1050,7 +1050,7 @@ checksum = "d87c48c02e0dc5e3b849a2041db3029fd066650f8f717c07bf8ed78ccb895cac" dependencies = [ "http", "hyper", - "rustls 0.20.2", + "rustls", "tokio", "tokio-rustls", ] @@ -1868,7 +1868,7 @@ dependencies = [ "reqwest", "routerify 2.2.0", "rstest", - "rustls 0.20.2", + "rustls", "rustls-pemfile", "scopeguard", "serde", @@ -2048,7 +2048,7 @@ dependencies = [ "mime", "percent-encoding", "pin-project-lite", - "rustls 0.20.2", + "rustls", "rustls-pemfile", "serde", "serde_json", @@ -2222,26 +2222,13 @@ dependencies = [ [[package]] name = "rustls" -version = "0.19.1" +version = "0.20.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "35edb675feee39aec9c99fa5ff985081995a06d594114ae14cbe797ad7b7a6d7" -dependencies = [ - "base64 0.13.0", - "log", - "ring", - "sct 0.6.1", - "webpki 0.21.4", -] - -[[package]] -name = "rustls" -version = "0.20.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d37e5e2290f3e040b594b1a9e04377c2c671f1a1cfd9bfdef82106ac1c113f84" +checksum = "4fbfeb8d0ddb84706bc597a5574ab8912817c52a397f819e5b614e2265206921" dependencies = [ "log", "ring", - "sct 0.7.0", + "sct", "webpki 0.22.0", ] @@ -2256,11 +2243,11 @@ dependencies = [ [[package]] name = "rustls-split" -version = "0.2.2" +version = "0.3.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7fb079b52cfdb005752b7c3c646048e702003576a8321058e4c8b38227c11aa6" +checksum = "78802c9612b4689d207acff746f38132ca1b12dadb55d471aa5f10fd580f47d3" dependencies = [ - "rustls 0.19.1", + "rustls", ] [[package]] @@ -2339,16 +2326,6 @@ version = "1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd" -[[package]] -name = "sct" -version = "0.6.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b362b83898e0e69f38515b82ee15aa80636befe47c3b6d3d89a911e78fc228ce" -dependencies = [ - "ring", - "untrusted", -] - [[package]] name = "sct" version = "0.7.0" @@ -2789,7 +2766,7 @@ checksum = "606f2b73660439474394432239c82249c0d45eb5f23d91f401be1e33590444a7" dependencies = [ "futures", "ring", - "rustls 0.20.2", + "rustls", "tokio", "tokio-postgres", "tokio-rustls", @@ -2801,7 +2778,7 @@ version = "0.23.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "4151fda0cf2798550ad0b34bcfc9b9dcc2a9d2471c895c68f3a8818e54f2389e" dependencies = [ - "rustls 0.20.2", + "rustls", "tokio", "webpki 0.22.0", ] @@ -3392,7 +3369,8 @@ dependencies = [ "postgres-protocol", "rand", "routerify 3.0.0", - "rustls 0.19.1", + "rustls", + "rustls-pemfile", "rustls-split", "serde", "serde_json", diff --git a/zenith_utils/Cargo.toml b/zenith_utils/Cargo.toml index cf864b3a54..2b1caa9be2 100644 --- a/zenith_utils/Cargo.toml +++ b/zenith_utils/Cargo.toml @@ -24,8 +24,8 @@ signal-hook = "0.3.10" rand = "0.8.3" jsonwebtoken = "7" hex = { version = "0.4.3", features = ["serde"] } -rustls = "0.19.1" -rustls-split = "0.2.1" +rustls = "0.20.2" +rustls-split = "0.3.0" git-version = "0.3.5" serde_with = "1.12.0" @@ -39,6 +39,7 @@ hex-literal = "0.3" tempfile = "3.2" webpki = "0.21" criterion = "0.3" +rustls-pemfile = "0.2.1" [[bench]] name = "benchmarks" diff --git a/zenith_utils/src/postgres_backend.rs b/zenith_utils/src/postgres_backend.rs index f984fb4417..fab3c388b1 100644 --- a/zenith_utils/src/postgres_backend.rs +++ b/zenith_utils/src/postgres_backend.rs @@ -304,8 +304,8 @@ impl PostgresBackend { pub fn start_tls(&mut self) -> anyhow::Result<()> { match self.stream.take() { Some(Stream::Bidirectional(bidi_stream)) => { - let session = rustls::ServerSession::new(&self.tls_config.clone().unwrap()); - self.stream = Some(Stream::Bidirectional(bidi_stream.start_tls(session)?)); + let conn = rustls::ServerConnection::new(self.tls_config.clone().unwrap())?; + self.stream = Some(Stream::Bidirectional(bidi_stream.start_tls(conn)?)); Ok(()) } stream => { diff --git a/zenith_utils/src/sock_split.rs b/zenith_utils/src/sock_split.rs index c62963e113..5e4598daf1 100644 --- a/zenith_utils/src/sock_split.rs +++ b/zenith_utils/src/sock_split.rs @@ -4,7 +4,7 @@ use std::{ sync::Arc, }; -use rustls::Session; +use rustls::Connection; /// Wrapper supporting reads of a shared TcpStream. pub struct ArcTcpRead(Arc); @@ -56,7 +56,7 @@ impl BufStream { pub enum ReadStream { Tcp(BufReader), - Tls(rustls_split::ReadHalf), + Tls(rustls_split::ReadHalf), } impl io::Read for ReadStream { @@ -79,7 +79,7 @@ impl ReadStream { pub enum WriteStream { Tcp(Arc), - Tls(rustls_split::WriteHalf), + Tls(rustls_split::WriteHalf), } impl WriteStream { @@ -107,11 +107,11 @@ impl io::Write for WriteStream { } } -type TlsStream = rustls::StreamOwned; +type TlsStream = rustls::StreamOwned; pub enum BidiStream { Tcp(BufStream), - /// This variant is boxed, because [`rustls::ServerSession`] is quite larger than [`BufStream`]. + /// This variant is boxed, because [`rustls::ServerConnection`] is quite larger than [`BufStream`]. Tls(Box>), } @@ -127,7 +127,7 @@ impl BidiStream { if how == Shutdown::Read { tls_boxed.sock.get_ref().shutdown(how) } else { - tls_boxed.sess.send_close_notify(); + tls_boxed.conn.send_close_notify(); let res = tls_boxed.flush(); tls_boxed.sock.get_ref().shutdown(how)?; res @@ -154,19 +154,23 @@ impl BidiStream { // TODO would be nice to avoid the Arc here let socket = Arc::try_unwrap(reader.into_inner().0).unwrap(); - let (read_half, write_half) = - rustls_split::split(socket, tls_boxed.sess, read_buf_cfg, write_buf_cfg); + let (read_half, write_half) = rustls_split::split( + socket, + Connection::Server(tls_boxed.conn), + read_buf_cfg, + write_buf_cfg, + ); (ReadStream::Tls(read_half), WriteStream::Tls(write_half)) } } } - pub fn start_tls(self, mut session: rustls::ServerSession) -> io::Result { + pub fn start_tls(self, mut conn: rustls::ServerConnection) -> io::Result { match self { Self::Tcp(mut stream) => { - session.complete_io(&mut stream)?; - assert!(!session.is_handshaking()); - Ok(Self::Tls(Box::new(TlsStream::new(session, stream)))) + conn.complete_io(&mut stream)?; + assert!(!conn.is_handshaking()); + Ok(Self::Tls(Box::new(TlsStream::new(conn, stream)))) } Self::Tls { .. } => Err(io::Error::new( io::ErrorKind::InvalidInput, diff --git a/zenith_utils/tests/ssl_test.rs b/zenith_utils/tests/ssl_test.rs index ef2bf1ed4a..0e330c44f8 100644 --- a/zenith_utils/tests/ssl_test.rs +++ b/zenith_utils/tests/ssl_test.rs @@ -8,7 +8,6 @@ use std::{ use byteorder::{BigEndian, ReadBytesExt, WriteBytesExt}; use bytes::{Buf, BufMut, Bytes, BytesMut}; use lazy_static::lazy_static; -use rustls::Session; use zenith_utils::postgres_backend::{AuthType, Handler, PostgresBackend}; @@ -23,11 +22,11 @@ fn make_tcp_pair() -> (TcpStream, TcpStream) { lazy_static! { static ref KEY: rustls::PrivateKey = { let mut cursor = Cursor::new(include_bytes!("key.pem")); - rustls::internal::pemfile::rsa_private_keys(&mut cursor).unwrap()[0].clone() + rustls::PrivateKey(rustls_pemfile::rsa_private_keys(&mut cursor).unwrap()[0].clone()) }; static ref CERT: rustls::Certificate = { let mut cursor = Cursor::new(include_bytes!("cert.pem")); - rustls::internal::pemfile::certs(&mut cursor).unwrap()[0].clone() + rustls::Certificate(rustls_pemfile::certs(&mut cursor).unwrap()[0].clone()) }; } @@ -45,17 +44,23 @@ fn ssl() { let ssl_response = client_sock.read_u8().unwrap(); assert_eq!(b'S', ssl_response); - let mut cfg = rustls::ClientConfig::new(); - cfg.root_store.add(&CERT).unwrap(); + let cfg = rustls::ClientConfig::builder() + .with_safe_defaults() + .with_root_certificates({ + let mut store = rustls::RootCertStore::empty(); + store.add(&CERT).unwrap(); + store + }) + .with_no_client_auth(); let client_config = Arc::new(cfg); - let dns_name = webpki::DNSNameRef::try_from_ascii_str("localhost").unwrap(); - let mut session = rustls::ClientSession::new(&client_config, dns_name); + let dns_name = "localhost".try_into().unwrap(); + let mut conn = rustls::ClientConnection::new(client_config, dns_name).unwrap(); - session.complete_io(&mut client_sock).unwrap(); - assert!(!session.is_handshaking()); + conn.complete_io(&mut client_sock).unwrap(); + assert!(!conn.is_handshaking()); - let mut stream = rustls::Stream::new(&mut session, &mut client_sock); + let mut stream = rustls::Stream::new(&mut conn, &mut client_sock); // StartupMessage stream.write_u32::(9).unwrap(); @@ -105,8 +110,10 @@ fn ssl() { } let mut handler = TestHandler { got_query: false }; - let mut cfg = rustls::ServerConfig::new(rustls::NoClientAuth::new()); - cfg.set_single_cert(vec![CERT.clone()], KEY.clone()) + let cfg = rustls::ServerConfig::builder() + .with_safe_defaults() + .with_no_client_auth() + .with_single_cert(vec![CERT.clone()], KEY.clone()) .unwrap(); let tls_config = Some(Arc::new(cfg)); @@ -209,8 +216,10 @@ fn server_forces_ssl() { } let mut handler = TestHandler; - let mut cfg = rustls::ServerConfig::new(rustls::NoClientAuth::new()); - cfg.set_single_cert(vec![CERT.clone()], KEY.clone()) + let cfg = rustls::ServerConfig::builder() + .with_safe_defaults() + .with_no_client_auth() + .with_single_cert(vec![CERT.clone()], KEY.clone()) .unwrap(); let tls_config = Some(Arc::new(cfg));