|
| 1 | +use reqwest::ClientBuilder; |
| 2 | +use std::error::Error; |
| 3 | +#[cfg(feature = "fips")] |
| 4 | +use tracing::debug; |
| 5 | + |
| 6 | +/// Creates a reqwest client builder with TLS configuration. |
| 7 | +/// When the "fips" feature is enabled, it uses a FIPS-compliant TLS configuration. |
| 8 | +/// Otherwise, it uses reqwest's default rustls TLS implementation. |
| 9 | +#[cfg(not(feature = "fips"))] |
| 10 | +pub fn create_reqwest_client_builder() -> Result<ClientBuilder, Box<dyn Error>> { |
| 11 | + // Just return the default builder with rustls TLS. This is the one place we should be okay |
| 12 | + // to call reqwest::Client::builder(). |
| 13 | + #[allow(clippy::disallowed_methods)] |
| 14 | + Ok(reqwest::Client::builder().use_rustls_tls()) |
| 15 | +} |
| 16 | + |
| 17 | +/// Creates a reqwest client builder with FIPS-compliant TLS configuration. |
| 18 | +/// This version loads native root certificates and verifies FIPS compliance. |
| 19 | +#[cfg(feature = "fips")] |
| 20 | +pub fn create_reqwest_client_builder() -> Result<ClientBuilder, Box<dyn Error>> { |
| 21 | + // Get the runtime crypto provider that should have been configured at the start of the |
| 22 | + // application using something like rustls::crypto::default_fips_provider().install_default() |
| 23 | + let provider = |
| 24 | + rustls::crypto::CryptoProvider::get_default().ok_or("No crypto provider configured")?; |
| 25 | + |
| 26 | + if !provider.fips() { |
| 27 | + return Err("Crypto provider is not FIPS-compliant".into()); |
| 28 | + } |
| 29 | + |
| 30 | + let mut root_cert_store = rustls::RootCertStore::empty(); |
| 31 | + let native_certs = rustls_native_certs::load_native_certs(); |
| 32 | + let mut valid_count = 0; |
| 33 | + for cert in native_certs.certs { |
| 34 | + match root_cert_store.add(cert) { |
| 35 | + Ok(()) => valid_count += 1, |
| 36 | + Err(err) => { |
| 37 | + debug!("Failed to parse certificate: {:?}", err); |
| 38 | + } |
| 39 | + } |
| 40 | + } |
| 41 | + if valid_count == 0 { |
| 42 | + return Err("No valid certificates found in native root store".into()); |
| 43 | + } |
| 44 | + |
| 45 | + // FIPS typically requires TLS 1.2 or higher |
| 46 | + let versions = rustls::ALL_VERSIONS.to_vec(); |
| 47 | + let config_builder = rustls::ClientConfig::builder_with_provider(provider.clone()) |
| 48 | + .with_protocol_versions(&versions) |
| 49 | + .map_err(|_| "Failed to set protocol versions")?; |
| 50 | + |
| 51 | + let config = config_builder |
| 52 | + .with_root_certificates(root_cert_store) |
| 53 | + .with_no_client_auth(); |
| 54 | + |
| 55 | + if !config.fips() { |
| 56 | + return Err("The final TLS configuration is not FIPS-compliant".into()); |
| 57 | + } |
| 58 | + debug!("Client builder is configured with FIPS."); |
| 59 | + |
| 60 | + // This is the one place that it is okay to call reqwest::Client::builder(). |
| 61 | + #[allow(clippy::disallowed_methods)] |
| 62 | + Ok(reqwest::Client::builder().use_preconfigured_tls(config)) |
| 63 | +} |
0 commit comments