HTHou commented on code in PR #2:
URL: https://github.com/apache/iotdb-client-rust/pull/2#discussion_r3765680120
##########
src/connection/mod.rs:
##########
@@ -515,29 +644,76 @@ mod tls_tests {
use super::*;
use crate::protocol::client::TIClientRPCServiceSyncClient;
use std::path::PathBuf;
+ use std::sync::Arc;
fn fixture(name: &str) -> PathBuf {
PathBuf::from(env!("CARGO_MANIFEST_DIR"))
.join("tests/fixtures/tls")
.join(name)
}
- /// Spawn a TLS acceptor on a loopback port that completes one handshake
- /// and then drops the connection. Uses the checked-in self-signed cert
- /// (CN=localhost, SAN DNS:localhost + IP:127.0.0.1, 100-year validity).
+ fn pkcs8_key(name: &str) -> rustls::pki_types::PrivateKeyDer<'static> {
+ let file = std::fs::File::open(fixture(name)).expect("read key
fixture");
+ let mut reader = std::io::BufReader::new(file);
+ let key = rustls_pemfile::pkcs8_private_keys(&mut reader)
+ .next()
+ .expect("PKCS#8 key item")
+ .expect("parse PKCS#8 key")
+ .into();
+ key
+ }
+
+ fn server_config(require_client_auth: bool) -> Arc<rustls::ServerConfig> {
+ let provider = Arc::new(rustls::crypto::ring::default_provider());
+ let builder =
rustls::ServerConfig::builder_with_provider(Arc::clone(&provider))
+ .with_safe_default_protocol_versions()
+ .expect("protocol versions");
+ let builder = if require_client_auth {
+ let mut roots = rustls::RootCertStore::empty();
+ for certificate in
+ load_certificates(&fixture("client-cert.pem"), "client
root").expect("client root")
+ {
+ roots.add(certificate).expect("add client root");
+ }
+ let verifier =
+
rustls::server::WebPkiClientVerifier::builder_with_provider(roots.into(),
provider)
+ .build()
+ .expect("client verifier");
+ builder.with_client_cert_verifier(verifier)
+ } else {
+ builder.with_no_client_auth()
+ };
+ let config = builder
+ .with_single_cert(
+ load_certificates(&fixture("cert.pem"), "server certificate")
+ .expect("server certificate"),
+ pkcs8_key("key.pem"),
+ )
+ .expect("server config");
+ Arc::new(config)
+ }
+
+ /// Spawn a rustls acceptor on a loopback port that completes handshakes
+ /// and then drops each connection. Uses the checked-in self-signed cert
+ /// (CN=localhost, SAN DNS:localhost + IP:127.0.0.1).
fn tls_acceptor_once() -> Endpoint {
- let cert = std::fs::read(fixture("cert.pem")).expect("read cert
fixture");
- let key = std::fs::read(fixture("key.pem")).expect("read key fixture");
- let identity = native_tls::Identity::from_pkcs8(&cert,
&key).expect("identity");
- let acceptor =
native_tls::TlsAcceptor::new(identity).expect("acceptor");
+ tls_acceptor(false)
+ }
+
+ fn tls_acceptor(require_client_auth: bool) -> Endpoint {
+ let config = server_config(require_client_auth);
let listener =
std::net::TcpListener::bind("127.0.0.1:0").expect("bind");
let port = listener.local_addr().expect("local_addr").port();
std::thread::spawn(move || {
for stream in listener.incoming() {
match stream {
// Handshake (which may itself fail when the client
// rejects our cert — fine, just move on), then drop.
- Ok(s) => drop(acceptor.accept(s)),
+ Ok(mut stream) => {
+ let mut connection =
rustls::ServerConnection::new(Arc::clone(&config))
+ .expect("server connection");
+ let _ = connection.complete_io(&mut stream);
Review Comment:
Fixed in 4c38328. `tls_acceptor` now returns the server-side handshake
result through a channel, and the mutual-TLS test waits for it and asserts that
`WebPkiClientVerifier` accepted the client identity. `cargo test --features
tls` passes (124 tests plus the doc test).
##########
src/connection/mod.rs:
##########
@@ -515,29 +644,76 @@ mod tls_tests {
use super::*;
use crate::protocol::client::TIClientRPCServiceSyncClient;
use std::path::PathBuf;
+ use std::sync::Arc;
fn fixture(name: &str) -> PathBuf {
PathBuf::from(env!("CARGO_MANIFEST_DIR"))
.join("tests/fixtures/tls")
.join(name)
}
- /// Spawn a TLS acceptor on a loopback port that completes one handshake
- /// and then drops the connection. Uses the checked-in self-signed cert
- /// (CN=localhost, SAN DNS:localhost + IP:127.0.0.1, 100-year validity).
+ fn pkcs8_key(name: &str) -> rustls::pki_types::PrivateKeyDer<'static> {
+ let file = std::fs::File::open(fixture(name)).expect("read key
fixture");
+ let mut reader = std::io::BufReader::new(file);
+ let key = rustls_pemfile::pkcs8_private_keys(&mut reader)
+ .next()
+ .expect("PKCS#8 key item")
+ .expect("parse PKCS#8 key")
+ .into();
+ key
Review Comment:
Cleaned up in 4c38328. Returning the iterator chain directly causes a
borrow-checker error because the tail-expression temporary outlives `reader`,
so the code now keeps a named key iterator and returns the parsed key
expression directly. `cargo clippy --all-targets --features tls -- -D warnings`
passes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
