Skip to content
This repository has been archived by the owner on Feb 4, 2021. It is now read-only.

Commit

Permalink
feat(transport): Add system root anchors for TLS (hyperium#114)
Browse files Browse the repository at this point in the history
As per hyperium#101, it is sometimes desirable to use standard web PKI roots for
gRPC clients. This commit adds a method to ClientTlsConfig to add the
trust roots from the system certificate store:

- OpenSSL uses `openssl-probe` to search the system for roots.
- Rustls uses `rustls-native-certs` to load the system roots.

Enabling the `openssl-roots` or `rustls-roots` feature for `tonic` in
`Cargo.toml` will add system roots by default when configuring a gRPC
client.
  • Loading branch information
jen20 authored and rabbitinspace committed Jan 1, 2020
1 parent e339ef9 commit 44fc78e
Show file tree
Hide file tree
Showing 4 changed files with 43 additions and 0 deletions.
4 changes: 4 additions & 0 deletions tonic/Cargo.toml
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,8 @@ transport = [
]
openssl = ["openssl1", "tokio-openssl", "tls"]
rustls = ["tokio-rustls", "tls"]
openssl-roots = ["openssl-probe"]
rustls-roots = ["rustls-native-certs"]
tls = []

[[bench]]
Expand Down Expand Up @@ -73,9 +75,11 @@ tower-load = { version = "=0.3.0-alpha.2", optional = true }
# openssl
tokio-openssl = { version = "=0.4.0-alpha.6", optional = true }
openssl1 = { package = "openssl", version = "0.10", optional = true }
openssl-probe = { version = "0.1", optional = true }

# rustls
tokio-rustls = { version = "=0.12.0-alpha.5", optional = true }
rustls-native-certs = { version = "0.1", optional = true }

[dev-dependencies]
static_assertions = "1.0"
Expand Down
6 changes: 6 additions & 0 deletions tonic/src/lib.rs
Original file line number Diff line number Diff line change
Expand Up @@ -22,8 +22,14 @@
//! for [`tonic-build`]. Enabled by default.
//! - `openssl`: Enables the `openssl` based tls options for the `transport` feature`. Not
//! enabled by default.
//! - `openssl-roots`: Adds system trust roots to `openssl`-based gRPC clients using the
//! `openssl-probe` crate. Not enabled by default. `openssl` must be enabled to use
//! `openssl-roots`.
//! - `rustls`: Enables the `ruslts` based tls options for the `transport` feature`. Not
//! enabled by default.
//! - `rustls-roots`: Adds system trust roots to `rustls`-based gRPC clients using the
//! `rustls-native-certs` crate. Not enabled by default. `rustls` must be enabled to use
//! `openssl-roots`.
//! - `prost`: Enables the [`prost`] based gRPC [`Codec`] implementation.
//!
//! # Structure
Expand Down
9 changes: 9 additions & 0 deletions tonic/src/transport/endpoint.rs
Original file line number Diff line number Diff line change
Expand Up @@ -259,18 +259,27 @@ impl ClientTlsConfig {
}

/// Sets the domain name against which to verify the server's TLS certificate.
///
/// This has no effect if `rustls_client_config` or `openssl_connector` is used to configure
/// Rustls or OpenSSL respectively.
pub fn domain_name(&mut self, domain_name: impl Into<String>) -> &mut Self {
self.domain = Some(domain_name.into());
self
}

/// Sets the CA Certificate against which to verify the server's TLS certificate.
///
/// This has no effect if `rustls_client_config` or `openssl_connector` is used to configure
/// Rustls or OpenSSL respectively.
pub fn ca_certificate(&mut self, ca_certificate: Certificate) -> &mut Self {
self.cert = Some(ca_certificate);
self
}

/// Sets the client identity to present to the server.
///
/// This has no effect if `rustls_client_config` or `openssl_connector` is used to configure
/// Rustls or OpenSSL respectively.
pub fn identity(&mut self, identity: Identity) -> &mut Self {
self.identity = Some(identity);
self
Expand Down
24 changes: 24 additions & 0 deletions tonic/src/transport/service/tls.rs
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,10 @@ use openssl1::{
ssl::{select_next_proto, AlpnError, SslAcceptor, SslConnector, SslMethod, SslVerifyMode},
x509::{store::X509StoreBuilder, X509},
};
#[cfg(feature = "openssl-roots")]
use openssl_probe;
#[cfg(feature = "rustls-roots")]
use rustls_native_certs;
use std::{fmt, sync::Arc};
use tokio::net::TcpStream;
#[cfg(feature = "rustls")]
Expand Down Expand Up @@ -37,6 +41,8 @@ enum TlsError {
CertificateParseError,
#[cfg(feature = "rustls")]
PrivateKeyParseError,
#[cfg(feature = "openssl-roots")]
TrustAnchorsConfigurationError(openssl1::error::ErrorStack),
}

#[derive(Clone)]
Expand All @@ -63,6 +69,15 @@ impl TlsConnector {
let mut config = SslConnector::builder(SslMethod::tls())?;
config.set_alpn_protos(ALPN_H2_WIRE)?;

#[cfg(feature = "openssl-roots")]
{
openssl_probe::init_ssl_cert_env_vars();
match config.cert_store_mut().set_default_paths() {
Ok(()) => (),
Err(e) => return Err(Box::new(TlsError::TrustAnchorsConfigurationError(e))),
};
}

if let Some(cert) = cert {
let ca = X509::from_pem(&cert.pem[..])?;
config.cert_store_mut().add_cert(ca)?;
Expand Down Expand Up @@ -106,6 +121,11 @@ impl TlsConnector {
config.set_single_client_cert(client_cert, client_key);
}

#[cfg(feature = "rustls-roots")]
{
config.root_store = rustls_native_certs::load_native_certs()?;
}

if let Some(cert) = ca_cert {
let mut buf = std::io::Cursor::new(&cert.pem[..]);
config.root_store.add_pem_file(&mut buf).unwrap();
Expand Down Expand Up @@ -336,6 +356,10 @@ impl fmt::Display for TlsError {
f,
"Error parsing TLS private key - no RSA or PKCS8-encoded keys found."
),
#[cfg(feature = "openssl-roots")]
TlsError::TrustAnchorsConfigurationError(stack) => {
f.write_fmt(format_args!("Error adding trust anchors - {}", stack))
}
}
}
}
Expand Down

0 comments on commit 44fc78e

Please sign in to comment.