Port tokio-rustls to rustls 0.24

Author: iadev09

Cargo.lock

@@ -9,29 +9,32 @@ readme = "README.md"
 description = "Asynchronous TLS/SSL streams for Tokio using Rustls."
 categories = ["asynchronous", "cryptography", "network-programming"]
 edition = "2021"
-rust-version = "1.71"
+rust-version = "1.85"
 exclude = ["/.github", "/examples", "/scripts", "/tests/"]
 
 [dependencies]
-rustls = { version = "0.23.27", default-features = false, features = ["std"] }
+rustls = { git = "https://github.com/rustls/rustls.git", branch = "main", package = "rustls", version = "0.24.0-dev.0", default-features = false, features = ["webpki"] }
+rustls-aws-lc-rs = { git = "https://github.com/rustls/rustls.git", branch = "main", package = "rustls-aws-lc-rs", version = "0.1.0-dev.0", default-features = false, features = ["aws-lc-sys", "std"], optional = true }
+rustls-ring = { git = "https://github.com/rustls/rustls.git", branch = "main", package = "rustls-ring", version = "0.1.0-dev.0", default-features = false, features = ["std"], optional = true }
 tokio = "1.0"
 
 [features]
 default = ["logging", "tls12", "aws_lc_rs"]
-aws_lc_rs = ["rustls/aws_lc_rs"]
+aws_lc_rs = ["dep:rustls-aws-lc-rs"]
 aws-lc-rs = ["aws_lc_rs"] # Alias because Cargo features commonly use `-`
 brotli = ["rustls/brotli"]
 early-data = []
-fips = ["rustls/fips"]
-logging = ["rustls/logging"]
-ring = ["rustls/ring"]
-tls12 = ["rustls/tls12"]
+fips = ["aws_lc_rs", "rustls-aws-lc-rs/fips"]
+logging = ["rustls/log"]
+ring = ["dep:rustls-ring"]
+tls12 = []
 zlib = ["rustls/zlib"]
 
 [dev-dependencies]
 argh = "0.1.1"
 futures-util = "0.3.1"
 lazy_static = "1.1"
 rcgen = { version = "0.14", features = ["pem"] }
+rustls-util = { git = "https://github.com/rustls/rustls.git", branch = "main", package = "rustls-util", version = "0.1.0", default-features = false }
 tokio = { version = "1.0", features = ["full"] }
 webpki-roots = "1"

Cargo.toml

@@ -51,9 +51,9 @@ async fn main() -> Result<(), Box<dyn StdError + Send + Sync + 'static>> {
         root_cert_store.extend(webpki_roots::TLS_SERVER_ROOTS.iter().cloned());
     }
 
-    let config = rustls::ClientConfig::builder()
+    let config = rustls::ClientConfig::builder(provider())
         .with_root_certificates(root_cert_store)
-        .with_no_client_auth(); // i guess this was previously the default?
+        .with_no_client_auth()?; // i guess this was previously the default?
     let connector = TlsConnector::from(Arc::new(config));
 
     let stream = TcpStream::connect(&addr).await?;
@@ -78,3 +78,15 @@ async fn main() -> Result<(), Box<dyn StdError + Send + Sync + 'static>> {
 
     Ok(())
 }
+
+fn provider() -> Arc<rustls::crypto::CryptoProvider> {
+    #[cfg(feature = "aws_lc_rs")]
+    {
+        return Arc::new(rustls_aws_lc_rs::DEFAULT_PROVIDER.clone());
+    }
+
+    #[cfg(all(not(feature = "aws_lc_rs"), feature = "ring"))]
+    {
+        return Arc::new(rustls_ring::DEFAULT_PROVIDER.clone());
+    }
+}

examples/client.rs

@@ -6,6 +6,7 @@ use std::error::Error as StdError;
 use std::sync::Arc;
 
 use argh::FromArgs;
+use rustls::crypto::Identity;
 use rustls::pki_types::pem::PemObject;
 use rustls::pki_types::{CertificateDer, PrivateKeyDer};
 use tokio::io::{copy, sink, split, AsyncWriteExt};
@@ -45,9 +46,10 @@ async fn main() -> Result<(), Box<dyn StdError + Send + Sync + 'static>> {
     let key = PrivateKeyDer::from_pem_file(&options.key)?;
     let flag_echo = options.echo_mode;
 
-    let config = rustls::ServerConfig::builder()
+    let identity = Arc::new(Identity::from_cert_chain(certs)?);
+    let config = rustls::ServerConfig::builder(provider())
         .with_no_client_auth()
-        .with_single_cert(certs, key)?;
+        .with_single_cert(identity, key)?;
     let acceptor = TlsAcceptor::from(Arc::new(config));
 
     let listener = TcpListener::bind(&addr).await?;
@@ -90,3 +92,15 @@ async fn main() -> Result<(), Box<dyn StdError + Send + Sync + 'static>> {
         });
     }
 }
+
+fn provider() -> Arc<rustls::crypto::CryptoProvider> {
+    #[cfg(feature = "aws_lc_rs")]
+    {
+        return Arc::new(rustls_aws_lc_rs::DEFAULT_PROVIDER.clone());
+    }
+
+    #[cfg(all(not(feature = "aws_lc_rs"), feature = "ring"))]
+    {
+        return Arc::new(rustls_ring::DEFAULT_PROVIDER.clone());
+    }
+}

examples/server.rs

@@ -12,7 +12,10 @@ use std::{
     sync::Arc,
 };
 
-use rustls::{pki_types::ServerName, ClientConfig, ClientConnection};
+use rustls::{
+    enums::ApplicationProtocol, pki_types::ServerName, ClientConfig, ClientConnection,
+    Connection as _,
+};
 use tokio::io::{AsyncBufRead, AsyncRead, AsyncWrite, ReadBuf};
 
 use crate::common::{IoSession, MidHandshake, Stream, TlsState};
@@ -64,15 +67,25 @@ impl TlsConnector {
         IO: AsyncRead + AsyncWrite + Unpin,
         F: FnOnce(&mut ClientConnection),
     {
-        let alpn = alpn_protocols.unwrap_or_else(|| self.inner.alpn_protocols.clone());
-        let mut session = match ClientConnection::new_with_alpn(self.inner.clone(), domain, alpn) {
+        let builder = self.inner.connect(domain);
+        let builder = if let Some(alpn_protocols) = alpn_protocols {
+            builder.with_alpn(
+                alpn_protocols
+                    .into_iter()
+                    .map(ApplicationProtocol::from)
+                    .collect(),
+            )
+        } else {
+            builder
+        };
+        let mut session = match builder.build() {
             Ok(session) => session,
             Err(error) => {
                 return Connect(MidHandshake::Error {
                     io: stream,
                     // TODO(eliza): should this really return an `io::Error`?
                     // Probably not...
-                    error: io::Error::new(io::ErrorKind::Other, error),
+                    error: io::Error::other(error),
                 });
             }
         };

src/client.rs

@@ -1,11 +1,10 @@
 use std::future::Future;
-use std::ops::{Deref, DerefMut};
 use std::pin::Pin;
 use std::task::{Context, Poll};
 use std::{io, mem};
 
 use rustls::server::AcceptedAlert;
-use rustls::{ConnectionCommon, SideData};
+use rustls::Connection as RustlsConnection;
 use tokio::io::{AsyncRead, AsyncWrite};
 
 use crate::common::{Stream, SyncWriteAdapter, TlsState};
@@ -33,12 +32,11 @@ pub(crate) enum MidHandshake<IS: IoSession> {
     },
 }
 
-impl<IS, SD> Future for MidHandshake<IS>
+impl<IS> Future for MidHandshake<IS>
 where
     IS: IoSession + Unpin,
     IS::Io: AsyncRead + AsyncWrite + Unpin,
-    IS::Session: DerefMut + Deref<Target = ConnectionCommon<SD>> + Unpin,
-    SD: SideData,
+    IS::Session: RustlsConnection + Unpin,
 {
     type Output = Result<IS, (io::Error, IS::Io)>;
 

src/common/handshake.rs

@@ -1,9 +1,8 @@
 use std::io::{self, BufRead as _, IoSlice, Read, Write};
-use std::ops::{Deref, DerefMut};
 use std::pin::Pin;
 use std::task::{Context, Poll};
 
-use rustls::{ConnectionCommon, SideData};
+use rustls::Connection as RustlsConnection;
 use tokio::io::{AsyncBufRead, AsyncRead, AsyncWrite, ReadBuf};
 
 mod handshake;
@@ -66,10 +65,9 @@ pub(crate) struct Stream<'a, IO, C> {
     pub(crate) need_flush: bool,
 }
 
-impl<'a, IO: AsyncRead + AsyncWrite + Unpin, C, SD> Stream<'a, IO, C>
+impl<'a, IO: AsyncRead + AsyncWrite + Unpin, C> Stream<'a, IO, C>
 where
-    C: DerefMut + Deref<Target = ConnectionCommon<SD>>,
-    SD: SideData,
+    C: RustlsConnection,
 {
     pub(crate) fn new(io: &'a mut IO, session: &'a mut C) -> Self {
         Stream {
@@ -188,10 +186,7 @@ where
         }
     }
 
-    pub(crate) fn poll_fill_buf(mut self, cx: &mut Context<'_>) -> Poll<io::Result<&'a [u8]>>
-    where
-        SD: 'a,
-    {
+    pub(crate) fn poll_fill_buf(mut self, cx: &mut Context<'_>) -> Poll<io::Result<&'a [u8]>> {
         let mut io_pending = false;
 
         // read a packet
@@ -231,10 +226,9 @@ where
     }
 }
 
-impl<'a, IO: AsyncRead + AsyncWrite + Unpin, C, SD> AsyncRead for Stream<'a, IO, C>
+impl<'a, IO: AsyncRead + AsyncWrite + Unpin, C> AsyncRead for Stream<'a, IO, C>
 where
-    C: DerefMut + Deref<Target = ConnectionCommon<SD>>,
-    SD: SideData + 'a,
+    C: RustlsConnection + 'a,
 {
     fn poll_read(
         mut self: Pin<&mut Self>,
@@ -249,10 +243,9 @@ where
     }
 }
 
-impl<'a, IO: AsyncRead + AsyncWrite + Unpin, C, SD> AsyncBufRead for Stream<'a, IO, C>
+impl<'a, IO: AsyncRead + AsyncWrite + Unpin, C> AsyncBufRead for Stream<'a, IO, C>
 where
-    C: DerefMut + Deref<Target = ConnectionCommon<SD>>,
-    SD: SideData + 'a,
+    C: RustlsConnection + 'a,
 {
     fn poll_fill_buf(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<io::Result<&[u8]>> {
         let this = self.get_mut();
@@ -270,10 +263,9 @@ where
     }
 }
 
-impl<IO: AsyncRead + AsyncWrite + Unpin, C, SD> AsyncWrite for Stream<'_, IO, C>
+impl<IO: AsyncRead + AsyncWrite + Unpin, C> AsyncWrite for Stream<'_, IO, C>
 where
-    C: DerefMut + Deref<Target = ConnectionCommon<SD>>,
-    SD: SideData,
+    C: RustlsConnection,
 {
     fn poll_write(
         mut self: Pin<&mut Self>,

src/common/mod.rs

@@ -8,12 +8,12 @@ use std::task::{Context, Poll};
 use futures_util::future::poll_fn;
 use futures_util::task::noop_waker_ref;
 use rustls::pki_types::ServerName;
-use rustls::{ClientConnection, Connection, ServerConnection};
+use rustls::{ClientConnection, Connection as _, ServerConnection};
 use tokio::io::{AsyncRead, AsyncReadExt, AsyncWrite, AsyncWriteExt, ReadBuf};
 
 use super::Stream;
 
-struct Good<'a>(&'a mut Connection);
+struct Good<'a>(&'a mut ServerConnection);
 
 impl AsyncRead for Good<'_> {
     fn poll_read(
@@ -172,8 +172,7 @@ async fn stream_good_bufread() -> io::Result<()> {
 async fn stream_good_impl(vectored: bool, bufread: bool) -> io::Result<()> {
     const FILE: &[u8] = include_bytes!("../../README.md");
 
-    let (server, mut client) = make_pair();
-    let mut server = Connection::from(server);
+    let (mut server, mut client) = make_pair();
     poll_fn(|cx| do_handshake(&mut client, &mut server, cx)).await?;
 
     io::copy(&mut Cursor::new(FILE), &mut server.writer())?;
@@ -207,8 +206,7 @@ async fn stream_good_impl(vectored: bool, bufread: bool) -> io::Result<()> {
 
 #[tokio::test]
 async fn stream_bad() -> io::Result<()> {
-    let (server, mut client) = make_pair();
-    let mut server = Connection::from(server);
+    let (mut server, mut client) = make_pair();
     poll_fn(|cx| do_handshake(&mut client, &mut server, cx)).await?;
     client.set_buffer_limit(Some(1024));
 
@@ -234,8 +232,7 @@ async fn stream_bad() -> io::Result<()> {
 
 #[tokio::test]
 async fn stream_handshake() -> io::Result<()> {
-    let (server, mut client) = make_pair();
-    let mut server = Connection::from(server);
+    let (mut server, mut client) = make_pair();
 
     {
         let mut good = Good(&mut server);
@@ -258,8 +255,7 @@ async fn stream_handshake() -> io::Result<()> {
 async fn stream_buffered_handshake() -> io::Result<()> {
     use tokio::io::BufWriter;
 
-    let (server, mut client) = make_pair();
-    let mut server = Connection::from(server);
+    let (mut server, mut client) = make_pair();
 
     {
         let mut good = BufWriter::new(Good(&mut server));
@@ -332,8 +328,7 @@ async fn stream_handshake_regression_issues_77() -> io::Result<()> {
 
 #[tokio::test]
 async fn stream_eof() -> io::Result<()> {
-    let (server, mut client) = make_pair();
-    let mut server = Connection::from(server);
+    let (mut server, mut client) = make_pair();
     poll_fn(|cx| do_handshake(&mut client, &mut server, cx)).await?;
 
     let mut bad = Expected(Cursor::new(Vec::new()));
@@ -351,8 +346,7 @@ async fn stream_eof() -> io::Result<()> {
 
 #[tokio::test]
 async fn stream_write_zero() -> io::Result<()> {
-    let (server, mut client) = make_pair();
-    let mut server = Connection::from(server);
+    let (mut server, mut client) = make_pair();
     poll_fn(|cx| do_handshake(&mut client, &mut server, cx)).await?;
 
     let mut io = Eof;
@@ -372,15 +366,15 @@ fn make_pair() -> (ServerConnection, ClientConnection) {
     let (sconfig, cconfig) = utils::make_configs();
     let server = ServerConnection::new(Arc::new(sconfig)).unwrap();
 
-    let domain = ServerName::try_from("foobar.com").unwrap();
-    let client = ClientConnection::new(Arc::new(cconfig), domain).unwrap();
+    let domain = ServerName::try_from("foobar.com").unwrap().to_owned();
+    let client = Arc::new(cconfig).connect(domain).build().unwrap();
 
     (server, client)
 }
 
 fn do_handshake(
     client: &mut ClientConnection,
-    server: &mut Connection,
+    server: &mut ServerConnection,
     cx: &mut Context<'_>,
 ) -> Poll<io::Result<()>> {
     let mut good = Good(server);

src/common/test_stream.rs

@@ -48,7 +48,7 @@ use std::task::{Context, Poll};
 
 pub use rustls;
 
-use rustls::CommonState;
+use rustls::ConnectionOutputs;
 use tokio::io::{AsyncBufRead, AsyncRead, AsyncWrite, ReadBuf};
 
 macro_rules! ready {
@@ -78,7 +78,7 @@ pub enum TlsStream<T> {
 }
 
 impl<T> TlsStream<T> {
-    pub fn get_ref(&self) -> (&T, &CommonState) {
+    pub fn get_ref(&self) -> (&T, &ConnectionOutputs) {
         use TlsStream::*;
         match self {
             Client(io) => {
@@ -92,21 +92,28 @@ impl<T> TlsStream<T> {
         }
     }
 
-    pub fn get_mut(&mut self) -> (&mut T, &mut CommonState) {
+    pub fn get_mut(&mut self) -> (&mut T, TlsConnectionMut<'_>) {
         use TlsStream::*;
         match self {
             Client(io) => {
                 let (io, session) = io.get_mut();
-                (io, &mut *session)
+                (io, TlsConnectionMut::Client(session))
             }
             Server(io) => {
                 let (io, session) = io.get_mut();
-                (io, &mut *session)
+                (io, TlsConnectionMut::Server(session))
             }
         }
     }
 }
 
+/// Mutable access to either side's rustls connection.
+#[derive(Debug)]
+pub enum TlsConnectionMut<'a> {
+    Client(&'a mut rustls::ClientConnection),
+    Server(&'a mut rustls::ServerConnection),
+}
+
 impl<T> From<client::TlsStream<T>> for TlsStream<T> {
     fn from(s: client::TlsStream<T>) -> Self {
         Self::Client(s)