Update env_logger dependency
#46
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- `webpki-roots` - `cfg-if` - `winapi` - `untrusted` - `pem`
When I tried updating to latest version of rustls, I've noticed the following test failure:
```
rustls::Custom {
kind: UnexpectedEof,
error: "peer closed connection without sending TLS close_notify: https://docs.rs/rustls/latest/rustls/manual/_03_howto/index.html#unexpected-eof"
}
```
This is happening because in [rustls 0.21.2](https://github.com/rustls/rustls/releases/tag/v%2F0.21.2), they started differentiating between "unexpected and expected EOF in `Stream` and `StreamOwned`". This follows TLS standard, as the close_notify message must be sent before closing the connection.
We weren't doing that I our test cases so they failed.
But even when I added `AsyncWrite::poll_shutdown(socket).await` to the tests, they were still failing, since we weren't propagating this call to the underlying sync TLS streams, but just calling `.flush()`. The problem here was that there is no sync equivalent to `AsyncWrite::shutdown`.
My solution was to add a new trait `WriteShutdown` that all sync TLS streams must implement. It turns out that OpenSSL, native TLS and rustls all have shutdown methods that they are expecting to be called.
---
This is a breaking change, because there are streams that previous versions deemed correct, but newer versions would return an error on.
This is fixes [vulnerability to truncation attacks](https://docs.rs/rustls/latest/rustls/manual/_03_howto/index.html#unexpected-eof).
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.