From 6ef1c7548fd7ae01e759601922bcff84b3a5819e Mon Sep 17 00:00:00 2001 From: Arnaud Gourlay Date: Thu, 7 Mar 2024 14:38:17 +0100 Subject: [PATCH] Update Rustls 0.22 (#3780) * Update Rustls 0.22 * happy clippy --- Cargo.lock | 71 +++++++++++++++++++++++++------- Cargo.toml | 5 ++- src/actix/certificate_helpers.rs | 44 +++++++++++--------- src/actix/mod.rs | 2 +- 4 files changed, 86 insertions(+), 36 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index f05f721223..187d8b03ee 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -209,11 +209,11 @@ dependencies = [ "futures-core", "impl-more", "pin-project-lite", + "rustls-pki-types", "tokio", - "tokio-rustls", + "tokio-rustls 0.25.0", "tokio-util", "tracing", - "webpki-roots 0.25.2", ] [[package]] @@ -2362,9 +2362,9 @@ checksum = "0646026eb1b3eea4cd9ba47912ea5ce9cc07713d105b1a14698f4e6433d348b7" dependencies = [ "http 0.2.9", "hyper", - "rustls", + "rustls 0.21.10", "tokio", - "tokio-rustls", + "tokio-rustls 0.24.1", ] [[package]] @@ -4019,8 +4019,9 @@ dependencies = [ "rand 0.8.5", "reqwest", "rstack-self", - "rustls", + "rustls 0.22.2", "rustls-pemfile 2.1.1", + "rustls-pki-types", "rusty-hook", "schemars", "sealed_test", @@ -4324,14 +4325,14 @@ dependencies = [ "once_cell", "percent-encoding", "pin-project-lite", - "rustls", + "rustls 0.21.10", "rustls-pemfile 1.0.3", "serde", "serde_json", "serde_urlencoded", "system-configuration", "tokio", - "tokio-rustls", + "tokio-rustls 0.24.1", "tokio-util", "tower-service", "url", @@ -4574,6 +4575,20 @@ dependencies = [ "sct", ] +[[package]] +name = "rustls" +version = "0.22.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e87c9956bd9807afa1f77e0f7594af32566e830e088a5576d27c5b6f30f49d41" +dependencies = [ + "log", + "ring 0.17.5", + "rustls-pki-types", + "rustls-webpki 0.102.2", + "subtle", + "zeroize", +] + [[package]] name = "rustls-pemfile" version = "1.0.3" @@ -4595,9 +4610,9 @@ dependencies = [ [[package]] name = "rustls-pki-types" -version = "1.3.0" +version = "1.3.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "048a63e5b3ac996d78d402940b5fa47973d2d080c6c6fffa1d0f19c4445310b7" +checksum = "5ede67b28608b4c60685c7d54122d4400d90f62b40caee7700e700380a390fa8" [[package]] name = "rustls-webpki" @@ -4619,6 +4634,17 @@ dependencies = [ "untrusted 0.9.0", ] +[[package]] +name = "rustls-webpki" +version = "0.102.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "faaa0a62740bedb9b2ef5afa303da42764c012f743917351dc9a237ea1663610" +dependencies = [ + "ring 0.17.5", + "rustls-pki-types", + "untrusted 0.9.0", +] + [[package]] name = "rustversion" version = "1.0.11" @@ -5224,9 +5250,9 @@ checksum = "5ee073c9e4cd00e28217186dbe12796d692868f432bf2e97ee73bed0c56dfa01" [[package]] name = "subtle" -version = "2.4.1" +version = "2.5.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6bdef32e8150c2a081110b42772ffe7d7c9032b606bc226c8260fd97e0976601" +checksum = "81cdd64d312baedb58e21336b31bc043b77e01cc99033ce76ef539f78e965ebc" [[package]] name = "symbolic-common" @@ -5557,7 +5583,18 @@ version = "0.24.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081" dependencies = [ - "rustls", + "rustls 0.21.10", + "tokio", +] + +[[package]] +name = "tokio-rustls" +version = "0.25.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "775e0c0f0adb3a2f22a00c4745d728b479985fc15ee7ca6a2608388c5569860f" +dependencies = [ + "rustls 0.22.2", + "rustls-pki-types", "tokio", ] @@ -5652,7 +5689,7 @@ dependencies = [ "prost 0.11.9", "rustls-pemfile 1.0.3", "tokio", - "tokio-rustls", + "tokio-rustls 0.24.1", "tokio-stream", "tower", "tower-layer", @@ -5944,7 +5981,7 @@ dependencies = [ "base64 0.21.0", "log", "once_cell", - "rustls", + "rustls 0.21.10", "rustls-webpki 0.100.2", "url", "webpki-roots 0.23.1", @@ -6598,6 +6635,12 @@ version = "0.1.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "655b0814c5c0b19ade497851070c640773304939a6c0fd5f5fb43da0696d05b7" +[[package]] +name = "zeroize" +version = "1.7.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "525b4ec142c6b68a2d10f01f7bbf6755599ca3f81ea53b8431b7dd348f5fdb2d" + [[package]] name = "zerovec" version = "0.10.1" diff --git a/Cargo.toml b/Cargo.toml index 9372337547..3701e7c8db 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -68,7 +68,7 @@ tokio = { workspace = true } actix-cors = "0.7.0" actix-files = "0.6.5" -actix-web = { version = "4.5.1", optional = true, features = ["rustls-0_21", "actix-tls"] } +actix-web = { version = "4.5.1", optional = true, features = ["rustls-0_22", "actix-tls"] } actix-web-httpauth = "0.8.1" actix-web-validator = "5.0.1" tonic = { workspace = true } @@ -77,7 +77,8 @@ tower = "0.4.13" tower-layer = "0.3.2" tar = "0.4.40" reqwest = { version = "0.11", default-features = false, features = ["stream", "rustls-tls", "blocking"] } -rustls = "0.21.10" +rustls = "0.22.2" +rustls-pki-types = "1.3.1" rustls-pemfile = "2.1.1" prometheus = { version = "0.13.3", default-features = false } validator = { version = "0.16", features = ["derive"] } diff --git a/src/actix/certificate_helpers.rs b/src/actix/certificate_helpers.rs index d06aef96a6..0a8e60c9ea 100644 --- a/src/actix/certificate_helpers.rs +++ b/src/actix/certificate_helpers.rs @@ -1,13 +1,15 @@ +use std::fmt::Debug; use std::fs::File; use std::io::{self, BufRead, BufReader}; use std::sync::Arc; use std::time::{Duration, Instant}; -use itertools::Itertools; use parking_lot::RwLock; -use rustls::server::{AllowAnyAuthenticatedClient, ClientHello, ResolvesServerCert}; +use rustls::client::VerifierBuilderError; +use rustls::pki_types::CertificateDer; +use rustls::server::{ClientHello, ResolvesServerCert, WebPkiClientVerifier}; use rustls::sign::CertifiedKey; -use rustls::{Certificate, RootCertStore, ServerConfig}; +use rustls::{crypto, RootCertStore, ServerConfig}; use rustls_pemfile::Item; use crate::settings::{Settings, TlsConfig}; @@ -15,6 +17,7 @@ use crate::settings::{Settings, TlsConfig}; type Result = std::result::Result; /// A TTL based rotating server certificate resolver +#[derive(Debug)] struct RotatingCertificateResolver { /// TLS configuration used for loading/refreshing certified key tls_config: TlsConfig, @@ -71,6 +74,7 @@ impl ResolvesServerCert for RotatingCertificateResolver { } } +#[derive(Debug)] struct CertifiedKeyWithAge { /// Last time the certificate was updated/replaced last_update: Instant, @@ -104,12 +108,12 @@ impl CertifiedKeyWithAge { /// Load TLS configuration and construct certified key. fn load_certified_key(tls_config: &TlsConfig) -> Result> { // Load certificates - let certs: Vec = with_buf_read(&tls_config.cert, |rd| { + let certs: Vec = with_buf_read(&tls_config.cert, |rd| { rustls_pemfile::read_all(rd).collect::>>() })? .into_iter() .filter_map(|item| match item { - Item::X509Certificate(data) => Some(Certificate(data.to_vec())), + Item::X509Certificate(data) => Some(data), _ => None, }) .collect(); @@ -120,14 +124,13 @@ fn load_certified_key(tls_config: &TlsConfig) -> Result> { // Load private key let private_key_item = with_buf_read(&tls_config.key, rustls_pemfile::read_one)?.ok_or(Error::NoPrivateKey)?; - let pkey = match private_key_item { - Item::Pkcs1Key(pkey) => pkey.secret_pkcs1_der().to_vec(), - Item::Pkcs8Key(pkey) => pkey.secret_pkcs8_der().to_vec(), - Item::Sec1Key(pkey) => pkey.secret_sec1_der().to_vec(), + let private_key = match private_key_item { + Item::Pkcs1Key(pkey) => rustls_pki_types::PrivateKeyDer::from(pkey), + Item::Pkcs8Key(pkey) => rustls_pki_types::PrivateKeyDer::from(pkey), + Item::Sec1Key(pkey) => rustls_pki_types::PrivateKeyDer::from(pkey), _ => return Err(Error::InvalidPrivateKey), }; - let private_key = rustls::PrivateKey(pkey); - let signing_key = rustls::sign::any_supported_type(&private_key).map_err(Error::Sign)?; + let signing_key = crypto::ring::sign::any_supported_type(&private_key).map_err(Error::Sign)?; // Construct certified key let certified_key = CertifiedKey::new(certs, signing_key); @@ -138,7 +141,7 @@ fn load_certified_key(tls_config: &TlsConfig) -> Result> { /// /// Uses TLS settings as configured in configuration by user. pub fn actix_tls_server_config(settings: &Settings) -> Result { - let config = ServerConfig::builder().with_safe_defaults(); + let config = ServerConfig::builder(); let tls_config = settings .tls .clone() @@ -148,13 +151,14 @@ pub fn actix_tls_server_config(settings: &Settings) -> Result { // Verify client CA or not let config = if settings.service.verify_https_client_certificate { let mut root_cert_store = RootCertStore::empty(); - let ca_certs: Vec> = with_buf_read(&tls_config.ca_cert, |rd| { - rustls_pemfile::certs(rd) - .map_ok(|cert| cert.to_vec()) - .collect() + let ca_certs: Vec = with_buf_read(&tls_config.ca_cert, |rd| { + rustls_pemfile::certs(rd).collect() })?; - root_cert_store.add_parsable_certificates(&ca_certs[..]); - config.with_client_cert_verifier(AllowAnyAuthenticatedClient::new(root_cert_store).boxed()) + root_cert_store.add_parsable_certificates(ca_certs); + let client_cert_verifier = WebPkiClientVerifier::builder(root_cert_store.into()) + .build() + .map_err(Error::ClientCertVerifier)?; + config.with_client_cert_verifier(client_cert_verifier) } else { config.with_no_client_auth() }; @@ -193,5 +197,7 @@ pub enum Error { #[error("invalid private key")] InvalidPrivateKey, #[error("TLS signing error")] - Sign(#[source] rustls::sign::SignError), + Sign(#[source] rustls::Error), + #[error("client certificate verification")] + ClientCertVerifier(#[source] VerifierBuilderError), } diff --git a/src/actix/mod.rs b/src/actix/mod.rs index 84a071a8ec..8936607161 100644 --- a/src/actix/mod.rs +++ b/src/actix/mod.rs @@ -190,7 +190,7 @@ pub fn init( let config = certificate_helpers::actix_tls_server_config(&settings) .map_err(|err| io::Error::new(io::ErrorKind::Other, err))?; - server.bind_rustls_021(bind_addr, config)? + server.bind_rustls_0_22(bind_addr, config)? } else { log::info!("TLS disabled for REST API");