Add hyper-boring
This commit is contained in:
Ivan Nikulin
parent
548771adb1
commit
f4096d8afd
|
|
@ -143,7 +143,10 @@ jobs:
|
|||
if: startsWith(matrix.os, 'windows')
|
||||
run: choco install nasm
|
||||
shell: cmd
|
||||
- run: cargo test
|
||||
if: startsWith(matrix.os, 'windows')
|
||||
- if: startsWith(matrix.os, 'windows')
|
||||
# CI's Windows doesn't have require root certs
|
||||
run: cargo test --workspace --exclude tokio-boring --exclude hyper-boring
|
||||
name: Run tests (Windows)
|
||||
shell: cmd
|
||||
- if: "!startsWith(matrix.os, 'windows')"
|
||||
run: cargo test
|
||||
name: Run tests (not Windows)
|
||||
|
|
@ -3,5 +3,6 @@ members = [
|
|||
"boring",
|
||||
"boring-sys",
|
||||
"systest",
|
||||
"tokio-boring"
|
||||
"tokio-boring",
|
||||
"hyper-boring"
|
||||
]
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# boring
|
||||
|
||||
[](https://crates.io/crates/boring)
|
||||
[](https://crates.io/crates/boring)
|
||||
|
||||
BoringSSL bindings for the Rust programming language and TLS adapters for [tokio](https://github.com/tokio-rs/tokio)
|
||||
and [hyper](https://github.com/hyperium/hyper) built on top of it.
|
||||
|
|
|
|||
|
|
@ -9,6 +9,18 @@ description = "FFI bindings to BoringSSL"
|
|||
repository = "https://github.com/inikulin/boring"
|
||||
readme = "README.md"
|
||||
categories = ["cryptography", "external-ffi-bindings"]
|
||||
include = [
|
||||
"/*.md",
|
||||
"/*.toml",
|
||||
"/LICENSE-MIT",
|
||||
"/deps/boringssl/**/*.[chS]",
|
||||
"/deps/boringssl/src/**/*.cc",
|
||||
"/deps/boringssl/**/CMakeLists.txt",
|
||||
"/deps/boringssl/**/sources.cmake",
|
||||
"/deps/boringssl/LICENSE",
|
||||
"/buid.rs",
|
||||
"/src",
|
||||
]
|
||||
|
||||
[dependencies]
|
||||
libc = "0.2"
|
||||
|
|
|
|||
|
|
@ -0,0 +1,5 @@
|
|||
target/
|
||||
Cargo.lock
|
||||
.vscode/
|
||||
.idea/
|
||||
*.iml
|
||||
|
|
@ -0,0 +1,103 @@
|
|||
# Change Log
|
||||
|
||||
## [Unreleased]
|
||||
|
||||
## [v0.8.0] - 2019-12-10
|
||||
|
||||
### Changed
|
||||
|
||||
* Upgraded to hyper 0.13
|
||||
|
||||
## [v0.8.0-alpha.4] - 2019-09-04
|
||||
|
||||
### Changed
|
||||
|
||||
* Upgraded to hyper 0.13-alpha.4.
|
||||
|
||||
## [v0.8.0-alpha.1] - 2019-09-04
|
||||
|
||||
### Changed
|
||||
|
||||
* Upgraded to hyper 0.13-alpha.1.
|
||||
|
||||
## [v0.7.1] - 2019-03-01
|
||||
|
||||
### Changed
|
||||
|
||||
* TLSv1.3 sessions are now only used once, in accordance with the RFC's recommendation.
|
||||
|
||||
## [v0.7.0] - 2018-11-13
|
||||
|
||||
### Changed
|
||||
|
||||
* Upgraded `tokio-openssl` to 0.3. Handshake errors now return `openssl::ssl::HandshakeError`
|
||||
rather than `openssl::ssl::Error`.
|
||||
|
||||
## [v0.6.2] - 2018-11-07
|
||||
|
||||
### Added
|
||||
|
||||
* Added ALPN support. If the `h2` protocol is selected during the handshake via ALPN, the connector
|
||||
will automatically indicate that to Hyper via the `Connected::negotiated_h2` method. The
|
||||
`HttpsConnector::new` method configures ALPN to support both the `h2` and `http/1.1` protocols.
|
||||
Code using `HttpsConnector::with_connector` will need to configure ALPN manually.
|
||||
|
||||
## [v0.6.1] - 2018-06-13
|
||||
|
||||
### Changed
|
||||
|
||||
* `MaybeHttpsStream` now delegates `AsyncRead::read_buf` and `AsyncWrite::write_buf` to support
|
||||
readv/writev over HTTP connections.
|
||||
|
||||
## [v0.6.0] - 2018-06-04
|
||||
|
||||
### Changed
|
||||
|
||||
* Upgraded to hyper 0.12.
|
||||
* The callback closure now takes a `&Destination` rather than a `&URI` to match what Hyper provides
|
||||
to connectors.
|
||||
|
||||
## [v0.5.0] - 2018-02-18
|
||||
|
||||
### Changed
|
||||
|
||||
* The `HttpsConnector::with_connector` function now takes an `SslConnectorBuilder` rather than an
|
||||
`SslConnector` due to a change in the session caching implementation. This is requried to
|
||||
properly support TLSv1.3.
|
||||
|
||||
## [v0.4.1] - 2018-01-11
|
||||
|
||||
### Changed
|
||||
|
||||
* Stopped enabling default features for `hyper`.
|
||||
|
||||
## [v0.4.0] - 2018-01-11
|
||||
|
||||
### Removed
|
||||
|
||||
* The `HttpsConnector::danger_disable_hostname_verification` method has been removed. Instead, use
|
||||
a callback which configures the `ConnectConfiguration` directly.
|
||||
|
||||
### Changed
|
||||
|
||||
* Upgraded to openssl 0.10.
|
||||
* The `HttpsConnector::ssl_callback` method has been renamed to `HttpsConnector::set_callback`,
|
||||
and is passed a reference to the `ConnectConfiguration` rather than just the `SslRef`.
|
||||
|
||||
## Older
|
||||
|
||||
Look at the [release tags] for information about older releases.
|
||||
|
||||
[Unreleased]: https://github.com/sfackler/hyper-openssl/compare/0.8.0...master
|
||||
[v0.8.0]: https://github.com/sfackler/hyper-openssl/compare/0.8.0-alpha.4...0.8.0
|
||||
[v0.8.0-alpha.4]: https://github.com/sfackler/hyper-openssl/compare/0.8.0-alpha.1...0.8.0-alpha.4
|
||||
[v0.8.0-alpha.1]: https://github.com/sfackler/hyper-openssl/compare/0.7.1...0.8.0-alpha.1
|
||||
[v0.7.1]: https://github.com/sfackler/hyper-openssl/compare/0.7.0...0.7.1
|
||||
[v0.7.0]: https://github.com/sfackler/hyper-openssl/compare/0.6.2...0.7.0
|
||||
[v0.6.2]: https://github.com/sfackler/hyper-openssl/compare/0.6.1...0.6.2
|
||||
[v0.6.1]: https://github.com/sfackler/hyper-openssl/compare/0.6.0...0.6.1
|
||||
[v0.6.0]: https://github.com/sfackler/hyper-openssl/compare/0.5.0...0.6.0
|
||||
[v0.5.0]: https://github.com/sfackler/hyper-openssl/compare/0.4.1...0.5.0
|
||||
[v0.4.1]: https://github.com/sfackler/hyper-openssl/compare/0.4.0...0.4.1
|
||||
[v0.4.0]: https://github.com/sfackler/hyper-openssl/compare/0.3.1...0.4.0
|
||||
[release tags]: https://github.com/sfackler/hyper-openssl/releases
|
||||
|
|
@ -0,0 +1,33 @@
|
|||
[package]
|
||||
name = "hyper-boring"
|
||||
version = "1.0.0"
|
||||
authors = ["Steven Fackler <sfackler@gmail.com>", "Ivan Nikulin <ifaaan@gmail.com>"]
|
||||
edition = "2018"
|
||||
description = "Hyper TLS support via BoringSSL"
|
||||
license = "MIT/Apache-2.0"
|
||||
repository = "https://github.com/sfackler/hyper-boring"
|
||||
readme = "README.md"
|
||||
exclude = ["test/*"]
|
||||
|
||||
[features]
|
||||
default = ["runtime"]
|
||||
|
||||
runtime = ["hyper/runtime"]
|
||||
|
||||
[dependencies]
|
||||
antidote = "1.0.0"
|
||||
bytes = "0.5"
|
||||
http = "0.2"
|
||||
hyper = { version = "0.13", default-features = false }
|
||||
linked_hash_set = "0.1"
|
||||
once_cell = "1.0"
|
||||
boring = { version = "1.0.0", path = "../boring" }
|
||||
boring-sys = { version = "1.0.0", path = "../boring-sys" }
|
||||
tokio = "0.2"
|
||||
tokio-boring = { version = "1.0.0", path = "../tokio-boring" }
|
||||
tower-layer = "0.3"
|
||||
|
||||
[dev-dependencies]
|
||||
hyper = "0.13"
|
||||
tokio = { version = "0.2", features = ["full"] }
|
||||
futures = "0.3"
|
||||
|
|
@ -0,0 +1,201 @@
|
|||
Apache License
|
||||
Version 2.0, January 2004
|
||||
http://www.apache.org/licenses/
|
||||
|
||||
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
||||
|
||||
1. Definitions.
|
||||
|
||||
"License" shall mean the terms and conditions for use, reproduction,
|
||||
and distribution as defined by Sections 1 through 9 of this document.
|
||||
|
||||
"Licensor" shall mean the copyright owner or entity authorized by
|
||||
the copyright owner that is granting the License.
|
||||
|
||||
"Legal Entity" shall mean the union of the acting entity and all
|
||||
other entities that control, are controlled by, or are under common
|
||||
control with that entity. For the purposes of this definition,
|
||||
"control" means (i) the power, direct or indirect, to cause the
|
||||
direction or management of such entity, whether by contract or
|
||||
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
||||
outstanding shares, or (iii) beneficial ownership of such entity.
|
||||
|
||||
"You" (or "Your") shall mean an individual or Legal Entity
|
||||
exercising permissions granted by this License.
|
||||
|
||||
"Source" form shall mean the preferred form for making modifications,
|
||||
including but not limited to software source code, documentation
|
||||
source, and configuration files.
|
||||
|
||||
"Object" form shall mean any form resulting from mechanical
|
||||
transformation or translation of a Source form, including but
|
||||
not limited to compiled object code, generated documentation,
|
||||
and conversions to other media types.
|
||||
|
||||
"Work" shall mean the work of authorship, whether in Source or
|
||||
Object form, made available under the License, as indicated by a
|
||||
copyright notice that is included in or attached to the work
|
||||
(an example is provided in the Appendix below).
|
||||
|
||||
"Derivative Works" shall mean any work, whether in Source or Object
|
||||
form, that is based on (or derived from) the Work and for which the
|
||||
editorial revisions, annotations, elaborations, or other modifications
|
||||
represent, as a whole, an original work of authorship. For the purposes
|
||||
of this License, Derivative Works shall not include works that remain
|
||||
separable from, or merely link (or bind by name) to the interfaces of,
|
||||
the Work and Derivative Works thereof.
|
||||
|
||||
"Contribution" shall mean any work of authorship, including
|
||||
the original version of the Work and any modifications or additions
|
||||
to that Work or Derivative Works thereof, that is intentionally
|
||||
submitted to Licensor for inclusion in the Work by the copyright owner
|
||||
or by an individual or Legal Entity authorized to submit on behalf of
|
||||
the copyright owner. For the purposes of this definition, "submitted"
|
||||
means any form of electronic, verbal, or written communication sent
|
||||
to the Licensor or its representatives, including but not limited to
|
||||
communication on electronic mailing lists, source code control systems,
|
||||
and issue tracking systems that are managed by, or on behalf of, the
|
||||
Licensor for the purpose of discussing and improving the Work, but
|
||||
excluding communication that is conspicuously marked or otherwise
|
||||
designated in writing by the copyright owner as "Not a Contribution."
|
||||
|
||||
"Contributor" shall mean Licensor and any individual or Legal Entity
|
||||
on behalf of whom a Contribution has been received by Licensor and
|
||||
subsequently incorporated within the Work.
|
||||
|
||||
2. Grant of Copyright License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
copyright license to reproduce, prepare Derivative Works of,
|
||||
publicly display, publicly perform, sublicense, and distribute the
|
||||
Work and such Derivative Works in Source or Object form.
|
||||
|
||||
3. Grant of Patent License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
(except as stated in this section) patent license to make, have made,
|
||||
use, offer to sell, sell, import, and otherwise transfer the Work,
|
||||
where such license applies only to those patent claims licensable
|
||||
by such Contributor that are necessarily infringed by their
|
||||
Contribution(s) alone or by combination of their Contribution(s)
|
||||
with the Work to which such Contribution(s) was submitted. If You
|
||||
institute patent litigation against any entity (including a
|
||||
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
||||
or a Contribution incorporated within the Work constitutes direct
|
||||
or contributory patent infringement, then any patent licenses
|
||||
granted to You under this License for that Work shall terminate
|
||||
as of the date such litigation is filed.
|
||||
|
||||
4. Redistribution. You may reproduce and distribute copies of the
|
||||
Work or Derivative Works thereof in any medium, with or without
|
||||
modifications, and in Source or Object form, provided that You
|
||||
meet the following conditions:
|
||||
|
||||
(a) You must give any other recipients of the Work or
|
||||
Derivative Works a copy of this License; and
|
||||
|
||||
(b) You must cause any modified files to carry prominent notices
|
||||
stating that You changed the files; and
|
||||
|
||||
(c) You must retain, in the Source form of any Derivative Works
|
||||
that You distribute, all copyright, patent, trademark, and
|
||||
attribution notices from the Source form of the Work,
|
||||
excluding those notices that do not pertain to any part of
|
||||
the Derivative Works; and
|
||||
|
||||
(d) If the Work includes a "NOTICE" text file as part of its
|
||||
distribution, then any Derivative Works that You distribute must
|
||||
include a readable copy of the attribution notices contained
|
||||
within such NOTICE file, excluding those notices that do not
|
||||
pertain to any part of the Derivative Works, in at least one
|
||||
of the following places: within a NOTICE text file distributed
|
||||
as part of the Derivative Works; within the Source form or
|
||||
documentation, if provided along with the Derivative Works; or,
|
||||
within a display generated by the Derivative Works, if and
|
||||
wherever such third-party notices normally appear. The contents
|
||||
of the NOTICE file are for informational purposes only and
|
||||
do not modify the License. You may add Your own attribution
|
||||
notices within Derivative Works that You distribute, alongside
|
||||
or as an addendum to the NOTICE text from the Work, provided
|
||||
that such additional attribution notices cannot be construed
|
||||
as modifying the License.
|
||||
|
||||
You may add Your own copyright statement to Your modifications and
|
||||
may provide additional or different license terms and conditions
|
||||
for use, reproduction, or distribution of Your modifications, or
|
||||
for any such Derivative Works as a whole, provided Your use,
|
||||
reproduction, and distribution of the Work otherwise complies with
|
||||
the conditions stated in this License.
|
||||
|
||||
5. Submission of Contributions. Unless You explicitly state otherwise,
|
||||
any Contribution intentionally submitted for inclusion in the Work
|
||||
by You to the Licensor shall be under the terms and conditions of
|
||||
this License, without any additional terms or conditions.
|
||||
Notwithstanding the above, nothing herein shall supersede or modify
|
||||
the terms of any separate license agreement you may have executed
|
||||
with Licensor regarding such Contributions.
|
||||
|
||||
6. Trademarks. This License does not grant permission to use the trade
|
||||
names, trademarks, service marks, or product names of the Licensor,
|
||||
except as required for reasonable and customary use in describing the
|
||||
origin of the Work and reproducing the content of the NOTICE file.
|
||||
|
||||
7. Disclaimer of Warranty. Unless required by applicable law or
|
||||
agreed to in writing, Licensor provides the Work (and each
|
||||
Contributor provides its Contributions) on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
||||
implied, including, without limitation, any warranties or conditions
|
||||
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
||||
PARTICULAR PURPOSE. You are solely responsible for determining the
|
||||
appropriateness of using or redistributing the Work and assume any
|
||||
risks associated with Your exercise of permissions under this License.
|
||||
|
||||
8. Limitation of Liability. In no event and under no legal theory,
|
||||
whether in tort (including negligence), contract, or otherwise,
|
||||
unless required by applicable law (such as deliberate and grossly
|
||||
negligent acts) or agreed to in writing, shall any Contributor be
|
||||
liable to You for damages, including any direct, indirect, special,
|
||||
incidental, or consequential damages of any character arising as a
|
||||
result of this License or out of the use or inability to use the
|
||||
Work (including but not limited to damages for loss of goodwill,
|
||||
work stoppage, computer failure or malfunction, or any and all
|
||||
other commercial damages or losses), even if such Contributor
|
||||
has been advised of the possibility of such damages.
|
||||
|
||||
9. Accepting Warranty or Additional Liability. While redistributing
|
||||
the Work or Derivative Works thereof, You may choose to offer,
|
||||
and charge a fee for, acceptance of support, warranty, indemnity,
|
||||
or other liability obligations and/or rights consistent with this
|
||||
License. However, in accepting such obligations, You may act only
|
||||
on Your own behalf and on Your sole responsibility, not on behalf
|
||||
of any other Contributor, and only if You agree to indemnify,
|
||||
defend, and hold each Contributor harmless for any liability
|
||||
incurred by, or claims asserted against, such Contributor by reason
|
||||
of your accepting any such warranty or additional liability.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
APPENDIX: How to apply the Apache License to your work.
|
||||
|
||||
To apply the Apache License to your work, attach the following
|
||||
boilerplate notice, with the fields enclosed by brackets "[]"
|
||||
replaced with your own identifying information. (Don't include
|
||||
the brackets!) The text should be enclosed in the appropriate
|
||||
comment syntax for the file format. We also recommend that a
|
||||
file or class name and description of purpose be included on the
|
||||
same "printed page" as the copyright notice for easier
|
||||
identification within third-party archives.
|
||||
|
||||
Copyright [yyyy] [name of copyright owner]
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
The MIT License (MIT)
|
||||
|
||||
Copyright (c) 2015-2016 Steven Fackler
|
||||
Copyright (c) 2020 Ivan Nikulin <ifaaan@gmail.com>
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
|
||||
|
|
@ -0,0 +1,25 @@
|
|||
# hyper-boring
|
||||
|
||||
[Documentation](https://docs.rs/hyper-boring)
|
||||
|
||||
Hyper SSL support via BoringSSL.
|
||||
|
||||
## License
|
||||
|
||||
Licensed under either of
|
||||
|
||||
* Apache License, Version 2.0, ([LICENSE-APACHE](LICENSE-APACHE) or http://www.apache.org/licenses/LICENSE-2.0)
|
||||
* MIT license ([LICENSE-MIT](LICENSE-MIT) or http://opensource.org/licenses/MIT)
|
||||
|
||||
at your option.
|
||||
|
||||
### Contribution
|
||||
|
||||
Unless you explicitly state otherwise, any contribution intentionally
|
||||
submitted for inclusion in the work by you, as defined in the Apache-2.0
|
||||
license, shall be dual licensed as above, without any additional terms or
|
||||
conditions.
|
||||
|
||||
## Accolades
|
||||
|
||||
The project is based on a fork of [hyper-openssl](https://github.com/sfackler/hyper-openssl).
|
||||
|
|
@ -0,0 +1,92 @@
|
|||
use boring::ssl::SslVersion;
|
||||
use boring::ssl::{SslSession, SslSessionRef};
|
||||
use linked_hash_set::LinkedHashSet;
|
||||
use std::borrow::Borrow;
|
||||
use std::collections::hash_map::{Entry, HashMap};
|
||||
use std::hash::{Hash, Hasher};
|
||||
|
||||
#[derive(Hash, PartialEq, Eq, Clone)]
|
||||
pub struct SessionKey {
|
||||
pub host: String,
|
||||
pub port: u16,
|
||||
}
|
||||
|
||||
#[derive(Clone)]
|
||||
struct HashSession(SslSession);
|
||||
|
||||
impl PartialEq for HashSession {
|
||||
fn eq(&self, other: &HashSession) -> bool {
|
||||
self.0.id() == other.0.id()
|
||||
}
|
||||
}
|
||||
|
||||
impl Eq for HashSession {}
|
||||
|
||||
impl Hash for HashSession {
|
||||
fn hash<H>(&self, state: &mut H)
|
||||
where
|
||||
H: Hasher,
|
||||
{
|
||||
self.0.id().hash(state);
|
||||
}
|
||||
}
|
||||
|
||||
impl Borrow<[u8]> for HashSession {
|
||||
fn borrow(&self) -> &[u8] {
|
||||
self.0.id()
|
||||
}
|
||||
}
|
||||
|
||||
pub struct SessionCache {
|
||||
sessions: HashMap<SessionKey, LinkedHashSet<HashSession>>,
|
||||
reverse: HashMap<HashSession, SessionKey>,
|
||||
}
|
||||
|
||||
impl SessionCache {
|
||||
pub fn new() -> SessionCache {
|
||||
SessionCache {
|
||||
sessions: HashMap::new(),
|
||||
reverse: HashMap::new(),
|
||||
}
|
||||
}
|
||||
|
||||
pub fn insert(&mut self, key: SessionKey, session: SslSession) {
|
||||
let session = HashSession(session);
|
||||
|
||||
self.sessions
|
||||
.entry(key.clone())
|
||||
.or_insert_with(LinkedHashSet::new)
|
||||
.insert(session.clone());
|
||||
self.reverse.insert(session, key);
|
||||
}
|
||||
|
||||
pub fn get(&mut self, key: &SessionKey) -> Option<SslSession> {
|
||||
let session = {
|
||||
let sessions = self.sessions.get_mut(key)?;
|
||||
sessions.front().cloned()?.0
|
||||
};
|
||||
|
||||
// https://tools.ietf.org/html/rfc8446#appendix-C.4
|
||||
// OpenSSL will remove the session from its cache after the handshake completes anyway, but this ensures
|
||||
// that concurrent handshakes don't end up with the same session.
|
||||
if session.protocol_version() == SslVersion::TLS1_3 {
|
||||
self.remove(&session);
|
||||
}
|
||||
|
||||
Some(session)
|
||||
}
|
||||
|
||||
pub fn remove(&mut self, session: &SslSessionRef) {
|
||||
let key = match self.reverse.remove(session.id()) {
|
||||
Some(key) => key,
|
||||
None => return,
|
||||
};
|
||||
|
||||
if let Entry::Occupied(mut sessions) = self.sessions.entry(key) {
|
||||
sessions.get_mut().remove(session.id());
|
||||
if sessions.get().is_empty() {
|
||||
sessions.remove();
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,350 @@
|
|||
//! Hyper SSL support via OpenSSL.
|
||||
#![warn(missing_docs)]
|
||||
#![doc(html_root_url = "https://docs.rs/hyper-boring")]
|
||||
|
||||
use crate::cache::{SessionCache, SessionKey};
|
||||
use antidote::Mutex;
|
||||
use boring::error::ErrorStack;
|
||||
use boring::ex_data::Index;
|
||||
use boring::ssl::{
|
||||
ConnectConfiguration, Ssl, SslConnector, SslConnectorBuilder, SslMethod, SslSessionCacheMode,
|
||||
};
|
||||
use bytes::{Buf, BufMut};
|
||||
use http::uri::Scheme;
|
||||
use hyper::client::connect::{Connected, Connection};
|
||||
#[cfg(feature = "runtime")]
|
||||
use hyper::client::HttpConnector;
|
||||
use hyper::service::Service;
|
||||
use hyper::Uri;
|
||||
use once_cell::sync::OnceCell;
|
||||
use std::error::Error;
|
||||
use std::fmt::Debug;
|
||||
use std::future::Future;
|
||||
use std::io;
|
||||
use std::mem::MaybeUninit;
|
||||
use std::pin::Pin;
|
||||
use std::sync::Arc;
|
||||
use std::task::{Context, Poll};
|
||||
use tokio::io::{AsyncRead, AsyncWrite};
|
||||
use tokio_boring::SslStream;
|
||||
use tower_layer::Layer;
|
||||
|
||||
mod cache;
|
||||
#[cfg(test)]
|
||||
mod test;
|
||||
|
||||
fn key_index() -> Result<Index<Ssl, SessionKey>, ErrorStack> {
|
||||
static IDX: OnceCell<Index<Ssl, SessionKey>> = OnceCell::new();
|
||||
IDX.get_or_try_init(Ssl::new_ex_index).map(|v| *v)
|
||||
}
|
||||
|
||||
#[derive(Clone)]
|
||||
struct Inner {
|
||||
ssl: SslConnector,
|
||||
cache: Arc<Mutex<SessionCache>>,
|
||||
#[allow(clippy::type_complexity)]
|
||||
callback: Option<
|
||||
Arc<dyn Fn(&mut ConnectConfiguration, &Uri) -> Result<(), ErrorStack> + Sync + Send>,
|
||||
>,
|
||||
}
|
||||
|
||||
impl Inner {
|
||||
fn setup_ssl(&self, uri: &Uri, host: &str) -> Result<ConnectConfiguration, ErrorStack> {
|
||||
let mut conf = self.ssl.configure()?;
|
||||
|
||||
if let Some(ref callback) = self.callback {
|
||||
callback(&mut conf, uri)?;
|
||||
}
|
||||
|
||||
let key = SessionKey {
|
||||
host: host.to_string(),
|
||||
port: uri.port_u16().unwrap_or(443),
|
||||
};
|
||||
|
||||
if let Some(session) = self.cache.lock().get(&key) {
|
||||
unsafe {
|
||||
conf.set_session(&session)?;
|
||||
}
|
||||
}
|
||||
|
||||
let idx = key_index()?;
|
||||
conf.set_ex_data(idx, key);
|
||||
|
||||
Ok(conf)
|
||||
}
|
||||
}
|
||||
|
||||
/// A layer which wraps services in an `HttpsConnector`.
|
||||
pub struct HttpsLayer {
|
||||
inner: Inner,
|
||||
}
|
||||
|
||||
impl HttpsLayer {
|
||||
/// Creates a new `HttpsLayer` with default settings.
|
||||
///
|
||||
/// ALPN is configured to support both HTTP/1 and HTTP/1.1.
|
||||
pub fn new() -> Result<HttpsLayer, ErrorStack> {
|
||||
let mut ssl = SslConnector::builder(SslMethod::tls())?;
|
||||
// avoid unused_mut warnings when building against OpenSSL 1.0.1
|
||||
ssl = ssl;
|
||||
|
||||
ssl.set_alpn_protos(b"\x02h2\x08http/1.1")?;
|
||||
|
||||
Self::with_connector(ssl)
|
||||
}
|
||||
|
||||
/// Creates a new `HttpsLayer`.
|
||||
///
|
||||
/// The session cache configuration of `ssl` will be overwritten.
|
||||
pub fn with_connector(mut ssl: SslConnectorBuilder) -> Result<HttpsLayer, ErrorStack> {
|
||||
let cache = Arc::new(Mutex::new(SessionCache::new()));
|
||||
|
||||
ssl.set_session_cache_mode(SslSessionCacheMode::CLIENT);
|
||||
|
||||
ssl.set_new_session_callback({
|
||||
let cache = cache.clone();
|
||||
move |ssl, session| {
|
||||
if let Some(key) = key_index().ok().and_then(|idx| ssl.ex_data(idx)) {
|
||||
cache.lock().insert(key.clone(), session);
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
ssl.set_remove_session_callback({
|
||||
let cache = cache.clone();
|
||||
move |_, session| cache.lock().remove(session)
|
||||
});
|
||||
|
||||
Ok(HttpsLayer {
|
||||
inner: Inner {
|
||||
ssl: ssl.build(),
|
||||
cache,
|
||||
callback: None,
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
/// Registers a callback which can customize the configuration of each connection.
|
||||
pub fn set_callback<F>(&mut self, callback: F)
|
||||
where
|
||||
F: Fn(&mut ConnectConfiguration, &Uri) -> Result<(), ErrorStack> + 'static + Sync + Send,
|
||||
{
|
||||
self.inner.callback = Some(Arc::new(callback));
|
||||
}
|
||||
}
|
||||
|
||||
impl<S> Layer<S> for HttpsLayer {
|
||||
type Service = HttpsConnector<S>;
|
||||
|
||||
fn layer(&self, inner: S) -> HttpsConnector<S> {
|
||||
HttpsConnector {
|
||||
http: inner,
|
||||
inner: self.inner.clone(),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// A Connector using OpenSSL to support `http` and `https` schemes.
|
||||
#[derive(Clone)]
|
||||
pub struct HttpsConnector<T> {
|
||||
http: T,
|
||||
inner: Inner,
|
||||
}
|
||||
|
||||
#[cfg(feature = "runtime")]
|
||||
impl HttpsConnector<HttpConnector> {
|
||||
/// Creates a a new `HttpsConnector` using default settings.
|
||||
///
|
||||
/// The Hyper `HttpConnector` is used to perform the TCP socket connection. ALPN is configured to support both
|
||||
/// HTTP/2 and HTTP/1.1.
|
||||
///
|
||||
/// Requires the `runtime` Cargo feature.
|
||||
pub fn new() -> Result<HttpsConnector<HttpConnector>, ErrorStack> {
|
||||
let mut http = HttpConnector::new();
|
||||
http.enforce_http(false);
|
||||
|
||||
HttpsLayer::new().map(|l| l.layer(http))
|
||||
}
|
||||
}
|
||||
|
||||
impl<S, T> HttpsConnector<S>
|
||||
where
|
||||
S: Service<Uri, Response = T> + Send,
|
||||
S::Error: Into<Box<dyn Error + Send + Sync>>,
|
||||
S::Future: Unpin + Send + 'static,
|
||||
T: AsyncRead + AsyncWrite + Connection + Unpin + Debug + Sync + Send + 'static,
|
||||
{
|
||||
/// Creates a new `HttpsConnector`.
|
||||
///
|
||||
/// The session cache configuration of `ssl` will be overwritten.
|
||||
pub fn with_connector(
|
||||
http: S,
|
||||
ssl: SslConnectorBuilder,
|
||||
) -> Result<HttpsConnector<S>, ErrorStack> {
|
||||
HttpsLayer::with_connector(ssl).map(|l| l.layer(http))
|
||||
}
|
||||
|
||||
/// Registers a callback which can customize the configuration of each connection.
|
||||
pub fn set_callback<F>(&mut self, callback: F)
|
||||
where
|
||||
F: Fn(&mut ConnectConfiguration, &Uri) -> Result<(), ErrorStack> + 'static + Sync + Send,
|
||||
{
|
||||
self.inner.callback = Some(Arc::new(callback));
|
||||
}
|
||||
}
|
||||
|
||||
impl<S> Service<Uri> for HttpsConnector<S>
|
||||
where
|
||||
S: Service<Uri> + Send,
|
||||
S::Error: Into<Box<dyn Error + Send + Sync>>,
|
||||
S::Future: Unpin + Send + 'static,
|
||||
S::Response: AsyncRead + AsyncWrite + Connection + Unpin + Debug + Sync + Send + 'static,
|
||||
{
|
||||
type Response = MaybeHttpsStream<S::Response>;
|
||||
type Error = Box<dyn Error + Sync + Send>;
|
||||
#[allow(clippy::type_complexity)]
|
||||
type Future = Pin<Box<dyn Future<Output = Result<Self::Response, Self::Error>> + Send>>;
|
||||
|
||||
fn poll_ready(&mut self, cx: &mut Context<'_>) -> Poll<Result<(), Self::Error>> {
|
||||
self.http.poll_ready(cx).map_err(Into::into)
|
||||
}
|
||||
|
||||
fn call(&mut self, uri: Uri) -> Self::Future {
|
||||
let tls_setup = if uri.scheme() == Some(&Scheme::HTTPS) {
|
||||
Some((self.inner.clone(), uri.clone()))
|
||||
} else {
|
||||
None
|
||||
};
|
||||
|
||||
let connect = self.http.call(uri);
|
||||
|
||||
let f = async {
|
||||
let conn = connect.await.map_err(Into::into)?;
|
||||
|
||||
let (inner, uri) = match tls_setup {
|
||||
Some((inner, uri)) => (inner, uri),
|
||||
None => return Ok(MaybeHttpsStream::Http(conn)),
|
||||
};
|
||||
|
||||
let host = uri.host().ok_or_else(|| "URI missing host")?;
|
||||
|
||||
let config = inner.setup_ssl(&uri, host)?;
|
||||
let stream = tokio_boring::connect(config, host, conn).await?;
|
||||
|
||||
Ok(MaybeHttpsStream::Https(stream))
|
||||
};
|
||||
|
||||
Box::pin(f)
|
||||
}
|
||||
}
|
||||
|
||||
/// A stream which may be wrapped with TLS.
|
||||
pub enum MaybeHttpsStream<T> {
|
||||
/// A raw HTTP stream.
|
||||
Http(T),
|
||||
/// An SSL-wrapped HTTP stream.
|
||||
Https(SslStream<T>),
|
||||
}
|
||||
|
||||
impl<T> AsyncRead for MaybeHttpsStream<T>
|
||||
where
|
||||
T: AsyncRead + AsyncWrite + Unpin,
|
||||
{
|
||||
unsafe fn prepare_uninitialized_buffer(&self, buf: &mut [MaybeUninit<u8>]) -> bool {
|
||||
match &*self {
|
||||
MaybeHttpsStream::Http(s) => s.prepare_uninitialized_buffer(buf),
|
||||
MaybeHttpsStream::Https(s) => s.prepare_uninitialized_buffer(buf),
|
||||
}
|
||||
}
|
||||
|
||||
fn poll_read(
|
||||
mut self: Pin<&mut Self>,
|
||||
ctx: &mut Context<'_>,
|
||||
buf: &mut [u8],
|
||||
) -> Poll<io::Result<usize>> {
|
||||
match &mut *self {
|
||||
MaybeHttpsStream::Http(s) => Pin::new(s).poll_read(ctx, buf),
|
||||
MaybeHttpsStream::Https(s) => Pin::new(s).poll_read(ctx, buf),
|
||||
}
|
||||
}
|
||||
|
||||
fn poll_read_buf<B>(
|
||||
mut self: Pin<&mut Self>,
|
||||
ctx: &mut Context<'_>,
|
||||
buf: &mut B,
|
||||
) -> Poll<io::Result<usize>>
|
||||
where
|
||||
B: BufMut,
|
||||
{
|
||||
match &mut *self {
|
||||
MaybeHttpsStream::Http(s) => Pin::new(s).poll_read_buf(ctx, buf),
|
||||
MaybeHttpsStream::Https(s) => Pin::new(s).poll_read_buf(ctx, buf),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl<T> AsyncWrite for MaybeHttpsStream<T>
|
||||
where
|
||||
T: AsyncRead + AsyncWrite + Unpin,
|
||||
{
|
||||
fn poll_write(
|
||||
mut self: Pin<&mut Self>,
|
||||
ctx: &mut Context<'_>,
|
||||
buf: &[u8],
|
||||
) -> Poll<io::Result<usize>> {
|
||||
match &mut *self {
|
||||
MaybeHttpsStream::Http(s) => Pin::new(s).poll_write(ctx, buf),
|
||||
MaybeHttpsStream::Https(s) => Pin::new(s).poll_write(ctx, buf),
|
||||
}
|
||||
}
|
||||
|
||||
fn poll_flush(mut self: Pin<&mut Self>, ctx: &mut Context<'_>) -> Poll<io::Result<()>> {
|
||||
match &mut *self {
|
||||
MaybeHttpsStream::Http(s) => Pin::new(s).poll_flush(ctx),
|
||||
MaybeHttpsStream::Https(s) => Pin::new(s).poll_flush(ctx),
|
||||
}
|
||||
}
|
||||
|
||||
fn poll_shutdown(mut self: Pin<&mut Self>, ctx: &mut Context<'_>) -> Poll<io::Result<()>> {
|
||||
match &mut *self {
|
||||
MaybeHttpsStream::Http(s) => Pin::new(s).poll_shutdown(ctx),
|
||||
MaybeHttpsStream::Https(s) => Pin::new(s).poll_shutdown(ctx),
|
||||
}
|
||||
}
|
||||
|
||||
fn poll_write_buf<B>(
|
||||
mut self: Pin<&mut Self>,
|
||||
ctx: &mut Context<'_>,
|
||||
buf: &mut B,
|
||||
) -> Poll<io::Result<usize>>
|
||||
where
|
||||
B: Buf,
|
||||
{
|
||||
match &mut *self {
|
||||
MaybeHttpsStream::Http(s) => Pin::new(s).poll_write_buf(ctx, buf),
|
||||
MaybeHttpsStream::Https(s) => Pin::new(s).poll_write_buf(ctx, buf),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl<T> Connection for MaybeHttpsStream<T>
|
||||
where
|
||||
T: Connection,
|
||||
{
|
||||
fn connected(&self) -> Connected {
|
||||
match self {
|
||||
MaybeHttpsStream::Http(s) => s.connected(),
|
||||
MaybeHttpsStream::Https(s) => {
|
||||
let mut connected = s.get_ref().connected();
|
||||
// Avoid unused_mut warnings on OpenSSL 1.0.1
|
||||
connected = connected;
|
||||
|
||||
if s.ssl().selected_alpn_protocol() == Some(b"h2") {
|
||||
connected = connected.negotiated_h2();
|
||||
}
|
||||
|
||||
connected
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,139 @@
|
|||
use super::*;
|
||||
use boring::ssl::{SslAcceptor, SslFiletype, SslMethod};
|
||||
use futures::StreamExt;
|
||||
use hyper::client::HttpConnector;
|
||||
use hyper::server::conn::Http;
|
||||
use hyper::{service, Response};
|
||||
use hyper::{Body, Client};
|
||||
use tokio::net::TcpListener;
|
||||
|
||||
#[tokio::test]
|
||||
#[cfg(feature = "runtime")]
|
||||
async fn google() {
|
||||
let ssl = HttpsConnector::new().unwrap();
|
||||
let client = Client::builder()
|
||||
.pool_max_idle_per_host(0)
|
||||
.build::<_, Body>(ssl);
|
||||
|
||||
for _ in 0..3 {
|
||||
let resp = client
|
||||
.get("https://www.google.com".parse().unwrap())
|
||||
.await
|
||||
.unwrap();
|
||||
assert!(resp.status().is_success(), "{}", resp.status());
|
||||
let mut body = resp.into_body();
|
||||
while body.next().await.transpose().unwrap().is_some() {}
|
||||
}
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn localhost() {
|
||||
let mut listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
|
||||
let port = listener.local_addr().unwrap().port();
|
||||
|
||||
let server = async move {
|
||||
let mut acceptor = SslAcceptor::mozilla_intermediate(SslMethod::tls()).unwrap();
|
||||
acceptor.set_session_id_context(b"test").unwrap();
|
||||
acceptor
|
||||
.set_private_key_file("test/key.pem", SslFiletype::PEM)
|
||||
.unwrap();
|
||||
acceptor
|
||||
.set_certificate_chain_file("test/cert.pem")
|
||||
.unwrap();
|
||||
let acceptor = acceptor.build();
|
||||
|
||||
for _ in 0..3 {
|
||||
let stream = listener.accept().await.unwrap().0;
|
||||
let stream = tokio_boring::accept(&acceptor, stream).await.unwrap();
|
||||
|
||||
let service =
|
||||
service::service_fn(|_| async { Ok::<_, io::Error>(Response::new(Body::empty())) });
|
||||
|
||||
Http::new()
|
||||
.http1_keep_alive(false)
|
||||
.serve_connection(stream, service)
|
||||
.await
|
||||
.unwrap();
|
||||
}
|
||||
};
|
||||
tokio::spawn(server);
|
||||
|
||||
let mut connector = HttpConnector::new();
|
||||
connector.enforce_http(false);
|
||||
let mut ssl = SslConnector::builder(SslMethod::tls()).unwrap();
|
||||
ssl.set_ca_file("test/cert.pem").unwrap();
|
||||
|
||||
use std::fs::File;
|
||||
use std::io::Write;
|
||||
|
||||
let file = File::create("../target/keyfile.log").unwrap();
|
||||
ssl.set_keylog_callback(move |_, line| {
|
||||
let _ = writeln!(&file, "{}", line);
|
||||
});
|
||||
|
||||
let ssl = HttpsConnector::with_connector(connector, ssl).unwrap();
|
||||
let client = Client::builder().build::<_, Body>(ssl);
|
||||
|
||||
for _ in 0..3 {
|
||||
let resp = client
|
||||
.get(format!("https://localhost:{}", port).parse().unwrap())
|
||||
.await
|
||||
.unwrap();
|
||||
assert!(resp.status().is_success(), "{}", resp.status());
|
||||
let mut body = resp.into_body();
|
||||
while body.next().await.transpose().unwrap().is_some() {}
|
||||
}
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn alpn_h2() {
|
||||
use boring::ssl::{self, AlpnError};
|
||||
|
||||
let mut listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
|
||||
let port = listener.local_addr().unwrap().port();
|
||||
|
||||
let server = async move {
|
||||
let mut acceptor = SslAcceptor::mozilla_modern(SslMethod::tls()).unwrap();
|
||||
acceptor
|
||||
.set_certificate_chain_file("test/cert.pem")
|
||||
.unwrap();
|
||||
acceptor
|
||||
.set_private_key_file("test/key.pem", SslFiletype::PEM)
|
||||
.unwrap();
|
||||
acceptor.set_alpn_select_callback(|_, client| {
|
||||
ssl::select_next_proto(b"\x02h2", client).ok_or(AlpnError::NOACK)
|
||||
});
|
||||
let acceptor = acceptor.build();
|
||||
|
||||
let stream = listener.accept().await.unwrap().0;
|
||||
let stream = tokio_boring::accept(&acceptor, stream).await.unwrap();
|
||||
assert_eq!(stream.ssl().selected_alpn_protocol().unwrap(), b"h2");
|
||||
|
||||
let service =
|
||||
service::service_fn(|_| async { Ok::<_, io::Error>(Response::new(Body::empty())) });
|
||||
|
||||
Http::new()
|
||||
.http2_only(true)
|
||||
.serve_connection(stream, service)
|
||||
.await
|
||||
.unwrap();
|
||||
};
|
||||
tokio::spawn(server);
|
||||
|
||||
let mut connector = HttpConnector::new();
|
||||
connector.enforce_http(false);
|
||||
let mut ssl = SslConnector::builder(SslMethod::tls()).unwrap();
|
||||
ssl.set_ca_file("test/cert.pem").unwrap();
|
||||
ssl.set_alpn_protos(b"\x02h2\x08http/1.1").unwrap();
|
||||
|
||||
let ssl = HttpsConnector::with_connector(connector, ssl).unwrap();
|
||||
let client = Client::builder().build::<_, Body>(ssl);
|
||||
|
||||
let resp = client
|
||||
.get(format!("https://localhost:{}", port).parse().unwrap())
|
||||
.await
|
||||
.unwrap();
|
||||
assert!(resp.status().is_success(), "{}", resp.status());
|
||||
let mut body = resp.into_body();
|
||||
while body.next().await.transpose().unwrap().is_some() {}
|
||||
}
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIIDhTCCAm2gAwIBAgIJALClJS+cq+ykMA0GCSqGSIb3DQEBCwUAMFkxCzAJBgNV
|
||||
BAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBX
|
||||
aWRnaXRzIFB0eSBMdGQxEjAQBgNVBAMMCWxvY2FsaG9zdDAeFw0xNjExMjgwNTU5
|
||||
MjNaFw0yNjExMjYwNTU5MjNaMFkxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21l
|
||||
LVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQxEjAQBgNV
|
||||
BAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL4k
|
||||
A0mghV17MPi033tKh1IK4pM6zpzHFrgi2smU97O/kxvSbNnDoZHEdqq3AtRcjELg
|
||||
HeKTd02jyAHxGoRTAVORIp0p4LCCvlR7EnHH78e3vIq3lkLe5uqyujnx2NJJIrIX
|
||||
r5Y+Z3QuMUSAix6GreAb19KcTZG82igvh4dOQP/pmlqQsyrPpioLy50O2NuBqU5Q
|
||||
xyevFRHsWfe3M7ayzJBVwMpDJxg3saOETXgzMzfKtrj2Pw0mfcHQMtsPv7z85ug0
|
||||
yyd9iXwwLYx2RqZ6epChsWuY2zj7Zfcis3DzbsrW8/J758KNkjZVWS9aJmDGsT3R
|
||||
xRlVDnIeow/SWi5qtqECAwEAAaNQME4wHQYDVR0OBBYEFNU1F6I+C06y6rN1yjn0
|
||||
i/ARufw1MB8GA1UdIwQYMBaAFNU1F6I+C06y6rN1yjn0i/ARufw1MAwGA1UdEwQF
|
||||
MAMBAf8wDQYJKoZIhvcNAQELBQADggEBACvFmTY+QSrc9EIAtuGk20L4OHrkOoRv
|
||||
veMIu3PAGbrzjE0rRC1qeLqkqudlWCk+xE6nNe90tB0qyY8AOgj68K2OplrJIhqt
|
||||
rxJ/Ohtbepwi53Q5npRoib6f9aL+FuT0hnVtVon2ngWRizSdH/CY7vCWuJjTtlon
|
||||
3J8TGPA1cnj8FtEEfF3ISd0/XCE2oar875FOscf7S0eLnORbuunCVU/RaNn25h/r
|
||||
9EhvoaPZ6cSZpt7UliMkSt6b07/A2SwU5C19BS1XoqGH02P9OV0pmuJn7N/fOGer
|
||||
aVbDiPpb+UAUHFUSyu32iK6T2/6OuJS7MQ1cI2biB2SWgWNBTmhRF1s=
|
||||
-----END CERTIFICATE-----
|
||||
|
|
@ -0,0 +1,28 @@
|
|||
-----BEGIN PRIVATE KEY-----
|
||||
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC+JANJoIVdezD4
|
||||
tN97SodSCuKTOs6cxxa4ItrJlPezv5Mb0mzZw6GRxHaqtwLUXIxC4B3ik3dNo8gB
|
||||
8RqEUwFTkSKdKeCwgr5UexJxx+/Ht7yKt5ZC3ubqsro58djSSSKyF6+WPmd0LjFE
|
||||
gIsehq3gG9fSnE2RvNooL4eHTkD/6ZpakLMqz6YqC8udDtjbgalOUMcnrxUR7Fn3
|
||||
tzO2ssyQVcDKQycYN7GjhE14MzM3yra49j8NJn3B0DLbD7+8/OboNMsnfYl8MC2M
|
||||
dkamenqQobFrmNs4+2X3IrNw827K1vPye+fCjZI2VVkvWiZgxrE90cUZVQ5yHqMP
|
||||
0louarahAgMBAAECggEAd08brQCHjs/1O6orLS7n2IgyAhZ9fQzD6ckdJi5Oe8Cz
|
||||
K1sPqFlEMbZoi9iIcv6bmH8O4ZSM4O/rWaSTcgKvq2M/qASWE8wGZ/ZN7Y16nQRi
|
||||
z1xBcjZyCUUa668g0VrI5Z1NNWZ0/gbaLVTHduEli6GM/H/NgKxS67JfRXzJ9onl
|
||||
d6vrK+xmeHyA7QSOieEDettaNCvm+HjU8mmOb4F1pCNZktDrch5rI8EzQlmFQuq4
|
||||
y50YLRZGSlK1QLjzMnT//oaP7mHjN/inzZTHBvTzhU2OjcjzEW7l4ry224Sdu/eH
|
||||
lhEnNk2eq+mH/yESkn3sJcmH4uYIXh8Dyvcy/uVkPQKBgQDzSC89qxT4sls9n0sL
|
||||
0DfVhq1D7kEXggD/4wNA714N24N/NWi5BYUDZVh9Kxqy9SuWlFYg1L1ZNZHB02aV
|
||||
GJdEiFMFgRea2E5NHnhWop+qYPq5N9jD72MHmz/6swX9VGi1p5DqjzK2hWMgoih9
|
||||
4ky1zxMw+P+aDaQ6xwZF1nr+mwKBgQDIFKTvaJYjqQ/lzRMIPLA3sg6RQ+Mqwt/C
|
||||
BZ9Oc3DGtuglV8F73i7ML2Ptg0GtVZo3NJgGzMerpNvEoc1pDCuZkzSYitcYysQQ
|
||||
wsailMQFCv9jJ9g28lSGKlEPYhcLejH8ZRi8jH0fObHIvgr7komNvvPIDFnw/uR8
|
||||
WsgrloD1cwKBgAdlAkqVkKWehjdxSA6r3YaX+Vw/OatFQFKGy+qFXA5/xZdwQCaf
|
||||
jFN2GSJ01PLrkM+a4qNM1BSKFEwX6N5PSQnEOwHH0rfaK0cczfuUJdY/7F8E24nZ
|
||||
FOF+TouINX5lumkLFtSKVbhGhaTQSPrKjhpYmPS8HMjJ8Vv4ALDOvB5RAoGBAJAS
|
||||
RX3bCpmdCESKOdUplh5UyaaSgsZs0qCsWb0s5R1B4cHaAgnGwF3pFgSWCjndNRHh
|
||||
fkMPPAv9xv49IGMvD0ojtLDO8Pn6L9p91niFtOyIscNdkpRmRLTjTcFM+ZkbIVlE
|
||||
Ft7WLtbIPZt2NQRXzVLTGEmJk040zKQ63n58flm/AoGBAKt97WLeHB9S/q0dpEGX
|
||||
Qk+1BXRAH0/4wK9lNrSeaw+npFr8rNN9K3sIBC/XnOwhT+wbKBpOoBT3PNHbNxVr
|
||||
EPPQ/pPmZ1TcHc7bszJnZon2S2PFJRDN4601X1/eFoTvakBnLlt1096paaolSmCG
|
||||
nYED9qXuh2VzUU1GgcqPXgf/
|
||||
-----END PRIVATE KEY-----
|
||||
|
|
@ -2,6 +2,7 @@
|
|||
name = "systest"
|
||||
version = "0.1.0"
|
||||
authors = ["Alex Crichton <alex@alexcrichton.com>"]
|
||||
publish = false
|
||||
|
||||
[dependencies]
|
||||
libc = "0.2"
|
||||
|
|
|
|||
|
|
@ -14,8 +14,8 @@ An implementation of SSL streams for Tokio backed by BoringSSL
|
|||
[dependencies]
|
||||
boring = { version = "1.0.0", path = "../boring" }
|
||||
boring-sys = { version = "1.0.0", path = "../boring-sys" }
|
||||
tokio = "0.3"
|
||||
tokio = "0.2"
|
||||
|
||||
[dev-dependencies]
|
||||
futures = "0.3"
|
||||
tokio = { version = "0.3", features = ["full"] }
|
||||
tokio = { version = "0.2", features = ["full"] }
|
||||
|
|
|
|||
|
|
@ -1,4 +1,5 @@
|
|||
Copyright (c) 2016 Tokio contributors
|
||||
Copyright (c) 2020 Ivan Nikulin <ifaaan@gmail.com>
|
||||
|
||||
Permission is hereby granted, free of charge, to any
|
||||
person obtaining a copy of this software and associated
|
||||
|
|
|
|||
|
|
@ -22,9 +22,10 @@ use std::error::Error;
|
|||
use std::fmt;
|
||||
use std::future::Future;
|
||||
use std::io::{self, Read, Write};
|
||||
use std::mem::MaybeUninit;
|
||||
use std::pin::Pin;
|
||||
use std::task::{Context, Poll};
|
||||
use tokio::io::{AsyncRead, AsyncWrite, ReadBuf};
|
||||
use tokio::io::{AsyncRead, AsyncWrite};
|
||||
|
||||
/// Asynchronously performs a client-side TLS handshake over the provided stream.
|
||||
pub async fn connect<S>(
|
||||
|
|
@ -98,13 +99,10 @@ where
|
|||
S: AsyncRead + Unpin,
|
||||
{
|
||||
fn read(&mut self, buf: &mut [u8]) -> io::Result<usize> {
|
||||
self.with_context(|ctx, stream| {
|
||||
let mut buf = ReadBuf::new(buf);
|
||||
match stream.poll_read(ctx, &mut buf)? {
|
||||
Poll::Ready(()) => Ok(buf.filled().len()),
|
||||
match self.with_context(|ctx, stream| stream.poll_read(ctx, buf)) {
|
||||
Poll::Ready(r) => r,
|
||||
Poll::Pending => Err(io::Error::from(io::ErrorKind::WouldBlock)),
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -176,7 +174,7 @@ impl<S> SslStream<S>
|
|||
where
|
||||
S: AsyncRead + AsyncWrite + Unpin,
|
||||
{
|
||||
/// Constructs an `SslStream` from a pointer to the underlying BoringSSL `SSL` struct.
|
||||
/// Constructs an `SslStream` from a pointer to the underlying OpenSSL `SSL` struct.
|
||||
///
|
||||
/// This is useful if the handshake has already been completed elsewhere.
|
||||
///
|
||||
|
|
@ -193,18 +191,19 @@ impl<S> AsyncRead for SslStream<S>
|
|||
where
|
||||
S: AsyncRead + AsyncWrite + Unpin,
|
||||
{
|
||||
unsafe fn prepare_uninitialized_buffer(&self, _: &mut [MaybeUninit<u8>]) -> bool {
|
||||
// Note that this does not forward to `S` because the buffer is
|
||||
// unconditionally filled in by OpenSSL, not the actual object `S`.
|
||||
// We're decrypting bytes from `S` into the buffer above!
|
||||
false
|
||||
}
|
||||
|
||||
fn poll_read(
|
||||
mut self: Pin<&mut Self>,
|
||||
ctx: &mut Context<'_>,
|
||||
buf: &mut ReadBuf<'_>,
|
||||
) -> Poll<io::Result<()>> {
|
||||
self.with_context(ctx, |s| match cvt(s.read(buf.initialize_unfilled()))? {
|
||||
Poll::Ready(nread) => {
|
||||
buf.advance(nread);
|
||||
Poll::Ready(Ok(()))
|
||||
}
|
||||
Poll::Pending => Poll::Pending,
|
||||
})
|
||||
buf: &mut [u8],
|
||||
) -> Poll<io::Result<usize>> {
|
||||
self.with_context(ctx, |s| cvt(s.read(buf)))
|
||||
}
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -33,7 +33,7 @@ async fn google() {
|
|||
|
||||
#[tokio::test]
|
||||
async fn server() {
|
||||
let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
|
||||
let mut listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
|
||||
let addr = listener.local_addr().unwrap();
|
||||
|
||||
let server = async move {
|
||||
|
|
|
|||
Loading…
Reference in New Issue