actix_tls/connect/
rustls_0_21.rs

1//! Rustls based connector service.
2//!
3//! See [`TlsConnector`] for main connector service factory docs.
4
5use std::{
6    future::Future,
7    io,
8    pin::Pin,
9    sync::Arc,
10    task::{Context, Poll},
11};
12
13use actix_rt::net::ActixStream;
14use actix_service::{Service, ServiceFactory};
15use actix_utils::future::{ok, Ready};
16use futures_core::ready;
17use tokio_rustls::{
18    client::TlsStream as AsyncTlsStream,
19    rustls::{client::ServerName, ClientConfig, RootCertStore},
20    Connect as RustlsConnect, TlsConnector as RustlsTlsConnector,
21};
22use tokio_rustls_024 as tokio_rustls;
23
24use crate::connect::{Connection, Host};
25
26pub mod reexports {
27    //! Re-exports from the `rustls` v0.21 ecosystem that are useful for connectors.
28
29    pub use tokio_rustls_024::{client::TlsStream as AsyncTlsStream, rustls::ClientConfig};
30    #[cfg(feature = "rustls-0_21-webpki-roots")]
31    pub use webpki_roots_025::TLS_SERVER_ROOTS;
32}
33
34/// Returns root certificates via `rustls-native-certs` crate as a rustls certificate store.
35///
36/// See [`rustls_native_certs::load_native_certs()`] for more info on behavior and errors.
37///
38/// [`rustls_native_certs::load_native_certs()`]: rustls_native_certs_06::load_native_certs()
39#[cfg(feature = "rustls-0_21-native-roots")]
40pub fn native_roots_cert_store() -> io::Result<RootCertStore> {
41    let mut root_certs = RootCertStore::empty();
42
43    for cert in rustls_native_certs_06::load_native_certs()? {
44        root_certs
45            .add(&tokio_rustls_024::rustls::Certificate(cert.0))
46            .unwrap();
47    }
48
49    Ok(root_certs)
50}
51
52/// Returns standard root certificates from `webpki-roots` crate as a rustls certificate store.
53#[cfg(feature = "rustls-0_21-webpki-roots")]
54pub fn webpki_roots_cert_store() -> RootCertStore {
55    use tokio_rustls_024::rustls;
56
57    let mut root_certs = RootCertStore::empty();
58
59    for cert in webpki_roots_025::TLS_SERVER_ROOTS {
60        let cert = rustls::OwnedTrustAnchor::from_subject_spki_name_constraints(
61            cert.subject,
62            cert.spki,
63            cert.name_constraints,
64        );
65        let certs = vec![cert].into_iter();
66        root_certs.add_trust_anchors(certs);
67    }
68
69    root_certs
70}
71
72/// Connector service factory using `rustls`.
73#[derive(Clone)]
74pub struct TlsConnector {
75    connector: Arc<ClientConfig>,
76}
77
78impl TlsConnector {
79    /// Constructs new connector service factory from a `rustls` client configuration.
80    pub fn new(connector: Arc<ClientConfig>) -> Self {
81        TlsConnector { connector }
82    }
83
84    /// Constructs new connector service from a `rustls` client configuration.
85    pub fn service(connector: Arc<ClientConfig>) -> TlsConnectorService {
86        TlsConnectorService { connector }
87    }
88}
89
90impl<R, IO> ServiceFactory<Connection<R, IO>> for TlsConnector
91where
92    R: Host,
93    IO: ActixStream + 'static,
94{
95    type Response = Connection<R, AsyncTlsStream<IO>>;
96    type Error = io::Error;
97    type Config = ();
98    type Service = TlsConnectorService;
99    type InitError = ();
100    type Future = Ready<Result<Self::Service, Self::InitError>>;
101
102    fn new_service(&self, _: ()) -> Self::Future {
103        ok(TlsConnectorService {
104            connector: self.connector.clone(),
105        })
106    }
107}
108
109/// Connector service using `rustls`.
110#[derive(Clone)]
111pub struct TlsConnectorService {
112    connector: Arc<ClientConfig>,
113}
114
115impl<R, IO> Service<Connection<R, IO>> for TlsConnectorService
116where
117    R: Host,
118    IO: ActixStream,
119{
120    type Response = Connection<R, AsyncTlsStream<IO>>;
121    type Error = io::Error;
122    type Future = ConnectFut<R, IO>;
123
124    actix_service::always_ready!();
125
126    fn call(&self, connection: Connection<R, IO>) -> Self::Future {
127        tracing::trace!("TLS handshake start for: {:?}", connection.hostname());
128        let (stream, connection) = connection.replace_io(());
129
130        match ServerName::try_from(connection.hostname()) {
131            Ok(host) => ConnectFut::Future {
132                connect: RustlsTlsConnector::from(Arc::clone(&self.connector))
133                    .connect(host, stream),
134                connection: Some(connection),
135            },
136            Err(_) => ConnectFut::InvalidServerName,
137        }
138    }
139}
140
141/// Connect future for Rustls service.
142#[doc(hidden)]
143#[allow(clippy::large_enum_variant)]
144pub enum ConnectFut<R, IO> {
145    InvalidServerName,
146    Future {
147        connect: RustlsConnect<IO>,
148        connection: Option<Connection<R, ()>>,
149    },
150}
151
152impl<R, IO> Future for ConnectFut<R, IO>
153where
154    R: Host,
155    IO: ActixStream,
156{
157    type Output = io::Result<Connection<R, AsyncTlsStream<IO>>>;
158
159    fn poll(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Self::Output> {
160        match self.get_mut() {
161            Self::InvalidServerName => Poll::Ready(Err(io::Error::new(
162                io::ErrorKind::InvalidInput,
163                "connection parameters specified invalid server name",
164            ))),
165
166            Self::Future {
167                connect,
168                connection,
169            } => {
170                let stream = ready!(Pin::new(connect).poll(cx))?;
171                let connection = connection.take().unwrap();
172                tracing::trace!("TLS handshake success: {:?}", connection.hostname());
173                Poll::Ready(Ok(connection.replace_io(stream).1))
174            }
175        }
176    }
177}
actix_tls/connect/rustls_0_21.rs

actix_tls/connect/
rustls_0_21.rs
