diff --git a/Cargo-minimal.lock b/Cargo-minimal.lock index 6794a3ae5..23633d4c3 100644 --- a/Cargo-minimal.lock +++ b/Cargo-minimal.lock @@ -159,9 +159,9 @@ dependencies = [ [[package]] name = "bitflags" -version = "2.10.0" +version = "2.11.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "812e12b5285cc515a9c72a5c1d3b6d46a19dac5acfef5265968c166106e31dd3" +checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3" [[package]] name = "bitreq" @@ -248,6 +248,16 @@ dependencies = [ "libc", ] +[[package]] +name = "core-foundation" +version = "0.10.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6" +dependencies = [ + "core-foundation-sys", + "libc", +] + [[package]] name = "core-foundation-sys" version = "0.8.7" @@ -567,10 +577,10 @@ dependencies = [ "libc", "log", "openssl", - "openssl-probe", + "openssl-probe 0.1.6", "openssl-sys", "schannel", - "security-framework", + "security-framework 2.11.1", "security-framework-sys", "tempfile", ] @@ -631,6 +641,12 @@ version = "0.1.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d05e27ee213611ffe7d6348b942e8f942b37114c00cc03cec254295a4a17852e" +[[package]] +name = "openssl-probe" +version = "0.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe" + [[package]] name = "openssl-sys" version = "0.9.111" @@ -808,43 +824,47 @@ dependencies = [ [[package]] name = "rustls" -version = "0.21.12" +version = "0.23.38" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3f56a14d1f48b391359b22f731fd4bd7e43c97f3c50eee276f3aa09c94784d3e" +checksum = "69f9466fb2c14ea04357e91413efb882e2a6d4a406e625449bc0a5d360d53a21" dependencies = [ + "once_cell", "ring", + "rustls-pki-types", "rustls-webpki", - "sct", + "subtle", + "zeroize", ] [[package]] name = "rustls-native-certs" -version = "0.6.3" +version = "0.8.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a9aace74cb666635c918e9c12bc0d348266037aa8eb599b5cba565709a8dff00" +checksum = "612460d5f7bea540c490b2b6395d8e34a953e52b491accd6c86c8164c5932a63" dependencies = [ - "openssl-probe", - "rustls-pemfile", + "openssl-probe 0.2.1", + "rustls-pki-types", "schannel", - "security-framework", + "security-framework 3.7.0", ] [[package]] -name = "rustls-pemfile" -version = "1.0.4" +name = "rustls-pki-types" +version = "1.14.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1c74cae0a4cf6ccbbf5f359f08efdf8ee7e1dc532573bf0db71968cb56b1448c" +checksum = "be040f8b0a225e40375822a563fa9524378b9d63112f53e19ffff34df5d33fdd" dependencies = [ - "base64 0.21.7", + "zeroize", ] [[package]] name = "rustls-webpki" -version = "0.101.7" +version = "0.103.12" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8b6275d1ee7a1cd780b64aca7726599a1dbc893b1e64144529e55c3c2f745765" +checksum = "8279bb85272c9f10811ae6a6c547ff594d6a7f3c6c6b02ee9726d1d0dcfcdd06" dependencies = [ "ring", + "rustls-pki-types", "untrusted", ] @@ -863,16 +883,6 @@ dependencies = [ "windows-sys 0.61.2", ] -[[package]] -name = "sct" -version = "0.7.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "da046153aa2352493d6cb7da4b6e5c0c057d8a1d0a9aa8560baffdd945acd414" -dependencies = [ - "ring", - "untrusted", -] - [[package]] name = "secp256k1" version = "0.29.0" @@ -900,7 +910,20 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02" dependencies = [ "bitflags", - "core-foundation", + "core-foundation 0.9.4", + "core-foundation-sys", + "libc", + "security-framework-sys", +] + +[[package]] +name = "security-framework" +version = "3.7.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d" +dependencies = [ + "bitflags", + "core-foundation 0.10.1", "core-foundation-sys", "libc", "security-framework-sys", @@ -908,9 +931,9 @@ dependencies = [ [[package]] name = "security-framework-sys" -version = "2.15.0" +version = "2.17.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cc1f0cbffaac4852523ce30d8bd3c5cdc873501d96ff467ca09b6767bb8cd5c0" +checksum = "6ce2691df843ecc5d231c0b14ece2acc3efb62c0a398c7e1d875f3983ce020e3" dependencies = [ "core-foundation-sys", "libc", @@ -992,6 +1015,12 @@ version = "0.9.8" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67" +[[package]] +name = "subtle" +version = "2.6.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292" + [[package]] name = "syn" version = "2.0.56" @@ -1093,9 +1122,9 @@ dependencies = [ [[package]] name = "tokio-rustls" -version = "0.24.1" +version = "0.26.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081" +checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61" dependencies = [ "rustls", "tokio", @@ -1181,9 +1210,12 @@ dependencies = [ [[package]] name = "webpki-roots" -version = "0.25.4" +version = "1.0.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5f20c57d8d7db6d3b86154206ae5d8fba62dd39573114de97c2cb0578251f8e1" +checksum = "52f5ee44c96cf55f1b349600768e3ece3a8f26010c05265ab73f945bb1a2eb9d" +dependencies = [ + "rustls-pki-types", +] [[package]] name = "which" @@ -1350,6 +1382,12 @@ dependencies = [ "syn", ] +[[package]] +name = "zeroize" +version = "1.8.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0" + [[package]] name = "zip" version = "0.6.6" diff --git a/Cargo-recent.lock b/Cargo-recent.lock index 6794a3ae5..23633d4c3 100644 --- a/Cargo-recent.lock +++ b/Cargo-recent.lock @@ -159,9 +159,9 @@ dependencies = [ [[package]] name = "bitflags" -version = "2.10.0" +version = "2.11.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "812e12b5285cc515a9c72a5c1d3b6d46a19dac5acfef5265968c166106e31dd3" +checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3" [[package]] name = "bitreq" @@ -248,6 +248,16 @@ dependencies = [ "libc", ] +[[package]] +name = "core-foundation" +version = "0.10.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6" +dependencies = [ + "core-foundation-sys", + "libc", +] + [[package]] name = "core-foundation-sys" version = "0.8.7" @@ -567,10 +577,10 @@ dependencies = [ "libc", "log", "openssl", - "openssl-probe", + "openssl-probe 0.1.6", "openssl-sys", "schannel", - "security-framework", + "security-framework 2.11.1", "security-framework-sys", "tempfile", ] @@ -631,6 +641,12 @@ version = "0.1.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d05e27ee213611ffe7d6348b942e8f942b37114c00cc03cec254295a4a17852e" +[[package]] +name = "openssl-probe" +version = "0.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe" + [[package]] name = "openssl-sys" version = "0.9.111" @@ -808,43 +824,47 @@ dependencies = [ [[package]] name = "rustls" -version = "0.21.12" +version = "0.23.38" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3f56a14d1f48b391359b22f731fd4bd7e43c97f3c50eee276f3aa09c94784d3e" +checksum = "69f9466fb2c14ea04357e91413efb882e2a6d4a406e625449bc0a5d360d53a21" dependencies = [ + "once_cell", "ring", + "rustls-pki-types", "rustls-webpki", - "sct", + "subtle", + "zeroize", ] [[package]] name = "rustls-native-certs" -version = "0.6.3" +version = "0.8.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a9aace74cb666635c918e9c12bc0d348266037aa8eb599b5cba565709a8dff00" +checksum = "612460d5f7bea540c490b2b6395d8e34a953e52b491accd6c86c8164c5932a63" dependencies = [ - "openssl-probe", - "rustls-pemfile", + "openssl-probe 0.2.1", + "rustls-pki-types", "schannel", - "security-framework", + "security-framework 3.7.0", ] [[package]] -name = "rustls-pemfile" -version = "1.0.4" +name = "rustls-pki-types" +version = "1.14.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1c74cae0a4cf6ccbbf5f359f08efdf8ee7e1dc532573bf0db71968cb56b1448c" +checksum = "be040f8b0a225e40375822a563fa9524378b9d63112f53e19ffff34df5d33fdd" dependencies = [ - "base64 0.21.7", + "zeroize", ] [[package]] name = "rustls-webpki" -version = "0.101.7" +version = "0.103.12" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8b6275d1ee7a1cd780b64aca7726599a1dbc893b1e64144529e55c3c2f745765" +checksum = "8279bb85272c9f10811ae6a6c547ff594d6a7f3c6c6b02ee9726d1d0dcfcdd06" dependencies = [ "ring", + "rustls-pki-types", "untrusted", ] @@ -863,16 +883,6 @@ dependencies = [ "windows-sys 0.61.2", ] -[[package]] -name = "sct" -version = "0.7.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "da046153aa2352493d6cb7da4b6e5c0c057d8a1d0a9aa8560baffdd945acd414" -dependencies = [ - "ring", - "untrusted", -] - [[package]] name = "secp256k1" version = "0.29.0" @@ -900,7 +910,20 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02" dependencies = [ "bitflags", - "core-foundation", + "core-foundation 0.9.4", + "core-foundation-sys", + "libc", + "security-framework-sys", +] + +[[package]] +name = "security-framework" +version = "3.7.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d" +dependencies = [ + "bitflags", + "core-foundation 0.10.1", "core-foundation-sys", "libc", "security-framework-sys", @@ -908,9 +931,9 @@ dependencies = [ [[package]] name = "security-framework-sys" -version = "2.15.0" +version = "2.17.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cc1f0cbffaac4852523ce30d8bd3c5cdc873501d96ff467ca09b6767bb8cd5c0" +checksum = "6ce2691df843ecc5d231c0b14ece2acc3efb62c0a398c7e1d875f3983ce020e3" dependencies = [ "core-foundation-sys", "libc", @@ -992,6 +1015,12 @@ version = "0.9.8" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67" +[[package]] +name = "subtle" +version = "2.6.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292" + [[package]] name = "syn" version = "2.0.56" @@ -1093,9 +1122,9 @@ dependencies = [ [[package]] name = "tokio-rustls" -version = "0.24.1" +version = "0.26.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081" +checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61" dependencies = [ "rustls", "tokio", @@ -1181,9 +1210,12 @@ dependencies = [ [[package]] name = "webpki-roots" -version = "0.25.4" +version = "1.0.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5f20c57d8d7db6d3b86154206ae5d8fba62dd39573114de97c2cb0578251f8e1" +checksum = "52f5ee44c96cf55f1b349600768e3ece3a8f26010c05265ab73f945bb1a2eb9d" +dependencies = [ + "rustls-pki-types", +] [[package]] name = "which" @@ -1350,6 +1382,12 @@ dependencies = [ "syn", ] +[[package]] +name = "zeroize" +version = "1.8.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0" + [[package]] name = "zip" version = "0.6.6" diff --git a/bitreq/Cargo.toml b/bitreq/Cargo.toml index c6dbe1c30..c70cb84c1 100644 --- a/bitreq/Cargo.toml +++ b/bitreq/Cargo.toml @@ -21,17 +21,17 @@ serde_json = { version = "1.0.0", default-features = false, features = ["std"], base64 = { version = "0.22", default-features = false, features = ["alloc"], optional = true } # For rustls-based TLS: -rustls = { version = "0.21.1", default-features = false, optional = true } -rustls-native-certs = { version = "0.6.1", default-features = false, optional = true } -webpki-roots = { version = "0.25.2", default-features = false, optional = true } -rustls-webpki = { version = "0.101.0", default-features = false, optional = true } +rustls = { version = "0.23.38", default-features = false, features = ["ring", "std", "tls12"], optional = true } +rustls-native-certs = { version = "0.8.3", default-features = false, optional = true } +webpki-roots = { version = "1.0.7", default-features = false, optional = true } +rustls-webpki = { version = "0.103.12", default-features = false, optional = true } # For native-tls-based TLS: native-tls = { version = "0.2", default-features = false, optional = true } # For the async feature: tokio = { version = "1.0", default-features = false, features = ["rt", "net", "io-util", "time", "sync"], optional = true } -tokio-rustls = { version = "0.24", default-features = false, optional = true } +tokio-rustls = { version = "0.26.4", default-features = false, optional = true } tokio-native-tls = { version = "0.3", default-features = false, optional = true } log = { version = "0.4.0", default-features = false, optional = true } @@ -47,7 +47,7 @@ all-features = true [package.metadata.rbmt.lint] # Unavoidable TLS/crypto dep-graph version conflicts. -allowed_duplicates = ["base64", "windows-sys"] +allowed_duplicates = ["base64", "core-foundation", "getrandom", "openssl-probe", "security-framework", "windows-sys"] [features] default = ["std"] diff --git a/bitreq/src/connection/rustls_stream.rs b/bitreq/src/connection/rustls_stream.rs index 01a3c417f..c21db715b 100644 --- a/bitreq/src/connection/rustls_stream.rs +++ b/bitreq/src/connection/rustls_stream.rs @@ -3,8 +3,6 @@ #[cfg(feature = "rustls")] use alloc::sync::Arc; -#[cfg(feature = "rustls")] -use core::convert::TryFrom; use std::io; use std::net::TcpStream; use std::sync::OnceLock; @@ -12,7 +10,9 @@ use std::sync::OnceLock; #[cfg(all(feature = "native-tls", not(feature = "rustls")))] use native_tls::{HandshakeError, TlsConnector, TlsStream}; #[cfg(feature = "rustls")] -use rustls::{self, ClientConfig, ClientConnection, RootCertStore, ServerName, StreamOwned}; +use rustls::pki_types::ServerName; +#[cfg(feature = "rustls")] +use rustls::{self, ClientConfig, ClientConnection, RootCertStore, StreamOwned}; #[cfg(all(feature = "native-tls", not(feature = "rustls"), feature = "tokio-native-tls"))] use tokio_native_tls::TlsConnector as AsyncTlsConnector; #[cfg(feature = "tokio-rustls")] @@ -36,30 +36,16 @@ static CONFIG: OnceLock> = OnceLock::new(); fn build_client_config() -> Arc { let mut root_certificates = RootCertStore::empty(); - // Try to load native certs #[cfg(feature = "https-rustls-probe")] - if let Ok(os_roots) = rustls_native_certs::load_native_certs() { - for root_cert in os_roots { - // Ignore erroneous OS certificates, there's nothing - // to do differently in that situation anyways. - let _ = root_certificates.add(&rustls::Certificate(root_cert.0)); - } + for cert in rustls_native_certs::load_native_certs().certs { + let _ = root_certificates.add(cert); } #[cfg(feature = "rustls-webpki")] - #[allow(deprecated)] // Need to use add_server_trust_anchors to compile with rustls 0.21.1 - root_certificates.add_server_trust_anchors(TLS_SERVER_ROOTS.iter().map(|ta| { - rustls::OwnedTrustAnchor::from_subject_spki_name_constraints( - ta.subject, - ta.spki, - ta.name_constraints, - ) - })); - - let config = ClientConfig::builder() - .with_safe_defaults() - .with_root_certificates(root_certificates) - .with_no_client_auth(); + root_certificates.extend(TLS_SERVER_ROOTS.iter().cloned()); + + let config = + ClientConfig::builder().with_root_certificates(root_certificates).with_no_client_auth(); Arc::new(config) } @@ -67,10 +53,9 @@ fn build_client_config() -> Arc { pub(super) fn wrap_stream(tcp: TcpStream, host: &str) -> Result { #[cfg(feature = "log")] log::trace!("Setting up TLS parameters for {host}."); - let dns_name = match ServerName::try_from(host) { - Ok(result) => result, - Err(err) => return Err(Error::IoError(io::Error::new(io::ErrorKind::Other, err))), - }; + let dns_name = ServerName::try_from(host) + .map(|name| name.to_owned()) + .map_err(|err| Error::IoError(io::Error::new(io::ErrorKind::Other, err)))?; let sess = ClientConnection::new(CONFIG.get_or_init(build_client_config).clone(), dns_name) .map_err(Error::RustlsCreateConnection)?; @@ -91,10 +76,9 @@ pub(super) async fn wrap_async_stream( ) -> Result { #[cfg(feature = "log")] log::trace!("Setting up TLS parameters for {host}."); - let dns_name = match ServerName::try_from(host) { - Ok(result) => result, - Err(err) => return Err(Error::IoError(io::Error::new(io::ErrorKind::Other, err))), - }; + let dns_name = ServerName::try_from(host) + .map(|name| name.to_owned()) + .map_err(|err| Error::IoError(io::Error::new(io::ErrorKind::Other, err)))?; let connector = TlsConnector::from(CONFIG.get_or_init(build_client_config).clone());