@@ -3,10 +3,6 @@ use std::error::Error;
33#[ cfg( feature = "fips" ) ]
44use tracing:: debug;
55
6- // TODO: once we confirm that this does what we think it does we'll move it to a separate crate.
7- // for now going to copy the this code to bottlecap and make sure that all the clients we build do
8- // in fact do the fips thing right.
9-
106/// Creates a reqwest client builder with TLS configuration.
117/// When the "fips" feature is enabled, it uses a FIPS-compliant TLS configuration.
128/// Otherwise, it uses reqwest's default rustls TLS implementation.
@@ -20,60 +16,44 @@ pub fn create_reqwest_client_builder() -> Result<ClientBuilder, Box<dyn Error>>
2016/// This version loads native root certificates and verifies FIPS compliance.
2117#[ cfg( feature = "fips" ) ]
2218pub fn create_reqwest_client_builder ( ) -> Result < ClientBuilder , Box < dyn Error > > {
23- // Get the runtime crypto provider that should have been configured elsewhere in the application
19+ // Get the runtime crypto provider that should have been configured at the start of the
20+ // application using something like rustls::crypto::default_fips_provider().install_default()
2421 let provider =
2522 rustls:: crypto:: CryptoProvider :: get_default ( ) . ok_or ( "No crypto provider configured" ) ?;
2623
27- // Verify the provider is FIPS-compliant
2824 if !provider. fips ( ) {
2925 return Err ( "Crypto provider is not FIPS-compliant" . into ( ) ) ;
3026 }
3127
32- // Create an empty root cert store
3328 let mut root_cert_store = rustls:: RootCertStore :: empty ( ) ;
34-
35- // Load native certificates
3629 let native_certs = rustls_native_certs:: load_native_certs ( ) ;
37-
38- // Add the certificates to the store
3930 let mut valid_count = 0 ;
40-
4131 for cert in native_certs. certs {
4232 match root_cert_store. add ( cert) {
4333 Ok ( ( ) ) => valid_count += 1 ,
4434 Err ( err) => {
45- // Optionally log errors
4635 debug ! ( "Failed to parse certificate: {:?}" , err) ;
4736 }
4837 }
4938 }
50-
51- // Verify we have at least some valid certificates
5239 if valid_count == 0 {
5340 return Err ( "No valid certificates found in native root store" . into ( ) ) ;
5441 }
5542
56- // Configure TLS versions ( FIPS typically requires TLS 1.2 or higher)
43+ // FIPS typically requires TLS 1.2 or higher
5744 let versions = rustls:: ALL_VERSIONS . to_vec ( ) ;
58-
59- // Build the client config
6045 let config_builder = rustls:: ClientConfig :: builder_with_provider ( provider. clone ( ) )
6146 . with_protocol_versions ( & versions)
6247 . map_err ( |_| "Failed to set protocol versions" ) ?;
6348
64- // Complete the configuration without client authentication
6549 let config = config_builder
6650 . with_root_certificates ( root_cert_store)
6751 . with_no_client_auth ( ) ;
6852
69- // Verify the final config is FIPS-compliant
7053 if !config. fips ( ) {
7154 return Err ( "The final TLS configuration is not FIPS-compliant" . into ( ) ) ;
7255 }
73- debug ! ( "Client Builder is in FIPS mode" ) ;
74-
75- // Create the reqwest client builder with our FIPS-compliant TLS configuration
76- let client_builder = reqwest:: Client :: builder ( ) . use_preconfigured_tls ( config) ;
56+ debug ! ( "Client builder is configured with FIPS." ) ;
7757
78- Ok ( client_builder )
58+ Ok ( reqwest :: Client :: builder ( ) . use_preconfigured_tls ( config ) )
7959}
0 commit comments