Skip to content

Provide template configurations and helpers for TcpTls transport #126

Description

@mempirate

Description

Right now, the TLS transport doesn't provide a lot of "template" configuration, and consumers have to specify the openSSL config themselves. In the tests, we can see what this looks like:

mod helpers {
use std::{path::PathBuf, str::FromStr as _};
use openssl::ssl::{
SslAcceptor, SslAcceptorBuilder, SslConnector, SslConnectorBuilder, SslFiletype, SslMethod,
};
/// Creates a default SSL acceptor builder for testing, with a trusted CA.
pub fn default_acceptor_builder() -> SslAcceptorBuilder {
let certificate_path =
PathBuf::from_str("../testdata/certificates/server-cert.pem").unwrap();
let private_key_path =
PathBuf::from_str("../testdata/certificates/server-key.pem").unwrap();
let ca_certificate_path =
PathBuf::from_str("../testdata/certificates/ca-cert.pem").unwrap();
assert!(certificate_path.exists(), "Certificate file does not exist");
assert!(private_key_path.exists(), "Private key file does not exist");
assert!(ca_certificate_path.exists(), "CA Certificate file does not exist");
let mut acceptor_builder = SslAcceptor::mozilla_intermediate(SslMethod::tls()).unwrap();
acceptor_builder.set_certificate_file(certificate_path, SslFiletype::PEM).unwrap();
acceptor_builder.set_private_key_file(private_key_path, SslFiletype::PEM).unwrap();
acceptor_builder.set_ca_file(ca_certificate_path).unwrap();
acceptor_builder
}
/// Creates a default SSL connector builder for testing, with a trusted CA.
/// It also has client certificate and private key set for mTLS testing.
pub fn default_connector_builder() -> SslConnectorBuilder {
let certificate_path =
PathBuf::from_str("../testdata/certificates/client-cert.pem").unwrap();
let private_key_path =
PathBuf::from_str("../testdata/certificates/client-key.pem").unwrap();
let ca_certificate_path =
PathBuf::from_str("../testdata/certificates/ca-cert.pem").unwrap();
assert!(certificate_path.exists(), "Certificate file does not exist");
assert!(private_key_path.exists(), "Private key file does not exist");
assert!(ca_certificate_path.exists(), "CA Certificate file does not exist");
let mut connector_builder = SslConnector::builder(SslMethod::tls()).unwrap();
connector_builder.set_certificate_file(certificate_path, SslFiletype::PEM).unwrap();
connector_builder.set_private_key_file(private_key_path, SslFiletype::PEM).unwrap();
connector_builder.set_ca_file(ca_certificate_path).unwrap();
connector_builder
}
}

For ease of use, it would be nice to have some opinionated template configurations that are easy to use. So consumers do not have to even import openSSL configuration types, but can use whatever we provide. Stuff like:

  • server: quick server setup that just requires certs to get started, nothing additional required
  • client: dangerous authentication for self-signed certificates
  • client: client auth wrappers?

For power users, we may want to preserve lower level configuration though.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions