upgrade from async-rustls to futures-rustls

6 files changed, 105 insertions, 54 deletions

diff --git a/net/Cargo.toml b/net/Cargo.toml
index 5fecff5..6b816a8 100644
--- a/net/Cargo.toml
+++ b/net/Cargo.toml
@@ -14,4 +14,4 @@ log = "0.4.20"
 bincode = { version="2.0.0-rc.3", features = ["derive"]}
 thiserror = "1.0.47"
 url = "2.4.1"
-async-rustls = { version = "0.4.1", features = ["dangerous_configuration"] }
+futures-rustls = "0.25.1"
diff --git a/net/src/error.rs b/net/src/error.rs
index 0d96d64..be90a03 100644
--- a/net/src/error.rs
+++ b/net/src/error.rs
@@ -29,10 +29,10 @@ pub enum Error {
     ChannelRecv(#[from] smol::channel::RecvError),
 
     #[error("Tls Error: {0}")]
-    Rustls(#[from] async_rustls::rustls::Error),
+    Rustls(#[from] futures_rustls::rustls::Error),
 
     #[error("Invalid DNS Name: {0}")]
-    InvalidDnsNameError(#[from] async_rustls::rustls::client::InvalidDnsNameError),
+    InvalidDnsNameError(#[from] futures_rustls::pki_types::InvalidDnsNameError),
 
     #[error(transparent)]
     KaryonCore(#[from] karyon_core::error::Error),
diff --git a/net/src/transports/tls.rs b/net/src/transports/tls.rs
index 8a43d7d..83f7a11 100644
--- a/net/src/transports/tls.rs
+++ b/net/src/transports/tls.rs
@@ -1,7 +1,7 @@
 use std::sync::Arc;
 
-use async_rustls::{rustls, TlsAcceptor, TlsConnector, TlsStream};
 use async_trait::async_trait;
+use futures_rustls::{pki_types, rustls, TlsAcceptor, TlsConnector, TlsStream};
 use smol::{
     io::{split, AsyncReadExt, AsyncWriteExt, ReadHalf, WriteHalf},
     lock::Mutex,
@@ -63,7 +63,7 @@ pub async fn dial_tls(
     addr: &Addr,
     port: &Port,
     config: rustls::ClientConfig,
-    dns_name: &str,
+    dns_name: &'static str,
 ) -> Result<TlsConn> {
     let address = format!("{}:{}", addr, port);
 
@@ -72,7 +72,7 @@ pub async fn dial_tls(
     let sock = TcpStream::connect(&address).await?;
     sock.set_nodelay(true)?;
 
-    let altname = rustls::ServerName::try_from(dns_name)?;
+    let altname = pki_types::ServerName::try_from(dns_name)?;
     let conn = connector.connect(altname, sock.clone()).await?;
     Ok(TlsConn::new(sock, TlsStream::Client(conn)))
 }
@@ -81,7 +81,7 @@ pub async fn dial_tls(
 pub async fn dial(
     endpoint: &Endpoint,
     config: rustls::ClientConfig,
-    dns_name: &str,
+    dns_name: &'static str,
 ) -> Result<Box<dyn Connection>> {
     match endpoint {
         Endpoint::Tcp(..) | Endpoint::Tls(..) => {}
diff --git a/p2p/Cargo.toml b/p2p/Cargo.toml
index 441c8f9..0679be8 100644
--- a/p2p/Cargo.toml
+++ b/p2p/Cargo.toml
@@ -21,7 +21,7 @@ semver = "1.0.20"
 sha2 = "0.10.8"
 
 # tls
-async-rustls = { version = "0.4.1", features = ["dangerous_configuration"] }
+futures-rustls = { version = "0.25.1", features = ["aws-lc-rs"] }
 rcgen = "0.11.3"
 yasna = "0.5.2"
 x509-parser = "0.15.1"
diff --git a/p2p/src/error.rs b/p2p/src/error.rs
index 11de0f1..75330a8 100644
--- a/p2p/src/error.rs
+++ b/p2p/src/error.rs
@@ -63,10 +63,10 @@ pub enum Error {
     Rcgen(#[from] rcgen::RcgenError),
 
     #[error("Tls Error: {0}")]
-    Rustls(#[from] async_rustls::rustls::Error),
+    Rustls(#[from] futures_rustls::rustls::Error),
 
     #[error("Invalid DNS Name: {0}")]
-    InvalidDnsNameError(#[from] async_rustls::rustls::client::InvalidDnsNameError),
+    InvalidDnsNameError(#[from] futures_rustls::pki_types::InvalidDnsNameError),
 
     #[error("Channel Send Error: {0}")]
     ChannelSend(String),
diff --git a/p2p/src/tls_config.rs b/p2p/src/tls_config.rs
index ebb12f4..893c321 100644
--- a/p2p/src/tls_config.rs
+++ b/p2p/src/tls_config.rs
@@ -1,10 +1,19 @@
 use std::sync::Arc;
 
-use async_rustls::rustls::{
-    self, cipher_suite::TLS13_CHACHA20_POLY1305_SHA256, client::ServerCertVerifier,
-    server::ClientCertVerifier, Certificate, CertificateError, Error::InvalidCertificate,
-    PrivateKey, SupportedCipherSuite, SupportedKxGroup, SupportedProtocolVersion,
+use futures_rustls::rustls::{
+    self,
+    client::danger::{HandshakeSignatureValid, ServerCertVerified, ServerCertVerifier},
+    crypto::{
+        aws_lc_rs::{self, cipher_suite::TLS13_CHACHA20_POLY1305_SHA256, kx_group},
+        CryptoProvider, SupportedKxGroup,
+    },
+    pki_types::{CertificateDer, PrivateKeyDer, ServerName, UnixTime},
+    server::danger::{ClientCertVerified, ClientCertVerifier},
+    CertificateError, DigitallySignedStruct, DistinguishedName,
+    Error::InvalidCertificate,
+    SignatureScheme, SupportedCipherSuite, SupportedProtocolVersion,
 };
+
 use log::error;
 use x509_parser::{certificate::X509Certificate, parse_x509_certificate};
 
@@ -16,7 +25,8 @@ use crate::{PeerID, Result};
 
 static PROTOCOL_VERSIONS: &[&SupportedProtocolVersion] = &[&rustls::version::TLS13];
 static CIPHER_SUITES: &[SupportedCipherSuite] = &[TLS13_CHACHA20_POLY1305_SHA256];
-static KX_GROUPS: &[&SupportedKxGroup] = &[&rustls::kx_group::X25519];
+static KX_GROUPS: &[&dyn SupportedKxGroup] = &[kx_group::X25519];
+static SIGNATURE_SCHEMES: &[SignatureScheme] = &[SignatureScheme::ED25519];
 
 const BAD_SIGNATURE_ERR: rustls::Error = InvalidCertificate(CertificateError::BadSignature);
 const BAD_ENCODING_ERR: rustls::Error = InvalidCertificate(CertificateError::BadEncoding);
@@ -28,12 +38,19 @@ pub fn tls_client_config(
 ) -> Result<rustls::ClientConfig> {
     let (cert, private_key) = generate_cert(key_pair)?;
     let server_verifier = SrvrCertVerifier { peer_id };
-    let client_config = rustls::ClientConfig::builder()
-        .with_cipher_suites(CIPHER_SUITES)
-        .with_kx_groups(KX_GROUPS)
-        .with_protocol_versions(PROTOCOL_VERSIONS)?
-        .with_custom_certificate_verifier(Arc::new(server_verifier))
-        .with_client_auth_cert(vec![cert], private_key)?;
+
+    let client_config = rustls::ClientConfig::builder_with_provider(
+        CryptoProvider {
+            kx_groups: KX_GROUPS.to_vec(),
+            cipher_suites: CIPHER_SUITES.to_vec(),
+            ..aws_lc_rs::default_provider()
+        }
+        .into(),
+    )
+    .with_protocol_versions(PROTOCOL_VERSIONS)?
+    .dangerous()
+    .with_custom_certificate_verifier(Arc::new(server_verifier))
+    .with_client_auth_cert(vec![cert], private_key)?;
 
     Ok(client_config)
 }
@@ -42,20 +59,25 @@ pub fn tls_client_config(
 pub fn tls_server_config(key_pair: &KeyPair) -> Result<rustls::ServerConfig> {
     let (cert, private_key) = generate_cert(key_pair)?;
     let client_verifier = CliCertVerifier {};
-    let server_config = rustls::ServerConfig::builder()
-        .with_cipher_suites(CIPHER_SUITES)
-        .with_kx_groups(KX_GROUPS)
-        .with_protocol_versions(PROTOCOL_VERSIONS)?
-        .with_client_cert_verifier(Arc::new(client_verifier))
-        .with_single_cert(vec![cert], private_key)?;
+    let server_config = rustls::ServerConfig::builder_with_provider(
+        CryptoProvider {
+            kx_groups: KX_GROUPS.to_vec(),
+            cipher_suites: CIPHER_SUITES.to_vec(),
+            ..aws_lc_rs::default_provider()
+        }
+        .into(),
+    )
+    .with_protocol_versions(PROTOCOL_VERSIONS)?
+    .with_client_cert_verifier(Arc::new(client_verifier))
+    .with_single_cert(vec![cert], private_key)?;
 
     Ok(server_config)
 }
 
 /// Generates a certificate and returns both the certificate and the private key.
-fn generate_cert(key_pair: &KeyPair) -> Result<(Certificate, PrivateKey)> {
+fn generate_cert<'a>(key_pair: &KeyPair) -> Result<(CertificateDer<'a>, PrivateKeyDer<'a>)> {
     let cert_key_pair = rcgen::KeyPair::generate(&rcgen::PKCS_ED25519)?;
-    let private_key = rustls::PrivateKey(cert_key_pair.serialize_der());
+    let private_key = PrivateKeyDer::Pkcs8(cert_key_pair.serialize_der().into());
 
     // Add a custom extension to the certificate:
     //   - Sign the certificate's public key with the provided key pair's private key
@@ -71,12 +93,12 @@ fn generate_cert(key_pair: &KeyPair) -> Result<(Certificate, PrivateKey)> {
     params.key_pair = Some(cert_key_pair);
     params.custom_extensions.push(ext);
 
-    let cert = rustls::Certificate(rcgen::Certificate::from_params(params)?.serialize_der()?);
+    let cert = CertificateDer::from(rcgen::Certificate::from_params(params)?.serialize_der()?);
     Ok((cert, private_key))
 }
 
 /// Verifies the given certification.
-fn verify_cert(end_entity: &Certificate) -> std::result::Result<PeerID, rustls::Error> {
+fn verify_cert(end_entity: &CertificateDer<'_>) -> std::result::Result<PeerID, rustls::Error> {
     // Parse the certificate.
     let cert = parse_cert(end_entity)?;
 
@@ -107,7 +129,9 @@ fn verify_cert(end_entity: &Certificate) -> std::result::Result<PeerID, rustls::
 }
 
 /// Parses the given x509 certificate.
-fn parse_cert(end_entity: &Certificate) -> std::result::Result<X509Certificate, rustls::Error> {
+fn parse_cert<'a>(
+    end_entity: &'a CertificateDer<'a>,
+) -> std::result::Result<X509Certificate<'a>, rustls::Error> {
     let (_, cert) = parse_x509_certificate(end_entity.as_ref()).map_err(|_| BAD_ENCODING_ERR)?;
 
     if !cert.validity().is_valid() {
@@ -134,6 +158,7 @@ fn verify_cert_signature(
         .map_err(|_| BAD_SIGNATURE_ERR)
 }
 
+#[derive(Debug)]
 struct SrvrCertVerifier {
     peer_id: Option<PeerID>,
 }
@@ -141,13 +166,12 @@ struct SrvrCertVerifier {
 impl ServerCertVerifier for SrvrCertVerifier {
     fn verify_server_cert(
         &self,
-        end_entity: &Certificate,
-        _intermediates: &[Certificate],
-        _server_name: &rustls::ServerName,
-        _scts: &mut dyn Iterator<Item = &[u8]>,
+        end_entity: &CertificateDer<'_>,
+        _intermediates: &[CertificateDer<'_>],
+        _server_name: &ServerName,
         _ocsp_response: &[u8],
-        _now: std::time::SystemTime,
-    ) -> std::result::Result<rustls::client::ServerCertVerified, rustls::Error> {
+        _now: UnixTime,
+    ) -> std::result::Result<ServerCertVerified, rustls::Error> {
         let peer_id = match verify_cert(end_entity) {
             Ok(pid) => pid,
             Err(err) => {
@@ -167,49 +191,76 @@ impl ServerCertVerifier for SrvrCertVerifier {
             }
         }
 
-        Ok(rustls::client::ServerCertVerified::assertion())
+        Ok(ServerCertVerified::assertion())
+    }
+
+    fn verify_tls12_signature(
+        &self,
+        _message: &[u8],
+        _cert: &CertificateDer<'_>,
+        _dss: &DigitallySignedStruct,
+    ) -> std::result::Result<HandshakeSignatureValid, rustls::Error> {
+        unreachable!("ONLY SUPPORT tls 13 VERSION")
     }
 
     fn verify_tls13_signature(
         &self,
         message: &[u8],
-        cert: &Certificate,
-        dss: &rustls::DigitallySignedStruct,
-    ) -> std::result::Result<rustls::client::HandshakeSignatureValid, rustls::Error> {
+        cert: &CertificateDer<'_>,
+        dss: &DigitallySignedStruct,
+    ) -> std::result::Result<HandshakeSignatureValid, rustls::Error> {
         let cert = parse_cert(cert)?;
         verify_cert_signature(&cert, message, dss.signature())?;
-        Ok(rustls::client::HandshakeSignatureValid::assertion())
+        Ok(HandshakeSignatureValid::assertion())
+    }
+
+    fn supported_verify_schemes(&self) -> Vec<SignatureScheme> {
+        SIGNATURE_SCHEMES.to_vec()
     }
 }
 
+#[derive(Debug)]
 struct CliCertVerifier {}
 impl ClientCertVerifier for CliCertVerifier {
     fn verify_client_cert(
         &self,
-        end_entity: &Certificate,
-        _intermediates: &[Certificate],
-        _now: std::time::SystemTime,
-    ) -> std::result::Result<rustls::server::ClientCertVerified, rustls::Error> {
+        end_entity: &CertificateDer<'_>,
+        _intermediates: &[CertificateDer<'_>],
+        _now: UnixTime,
+    ) -> std::result::Result<ClientCertVerified, rustls::Error> {
         if let Err(err) = verify_cert(end_entity) {
             error!("Failed to verify cert: {err}");
             return Err(err);
         };
-        Ok(rustls::server::ClientCertVerified::assertion())
+        Ok(ClientCertVerified::assertion())
+    }
+
+    fn root_hint_subjects(&self) -> &[DistinguishedName] {
+        &[]
+    }
+
+    fn verify_tls12_signature(
+        &self,
+        _message: &[u8],
+        _cert: &CertificateDer<'_>,
+        _dss: &DigitallySignedStruct,
+    ) -> std::result::Result<HandshakeSignatureValid, rustls::Error> {
+        unreachable!("ONLY SUPPORT tls 13 VERSION")
     }
 
     fn verify_tls13_signature(
         &self,
         message: &[u8],
-        cert: &Certificate,
-        dss: &rustls::DigitallySignedStruct,
-    ) -> std::result::Result<rustls::client::HandshakeSignatureValid, rustls::Error> {
+        cert: &CertificateDer<'_>,
+        dss: &DigitallySignedStruct,
+    ) -> std::result::Result<HandshakeSignatureValid, rustls::Error> {
         let cert = parse_cert(cert)?;
         verify_cert_signature(&cert, message, dss.signature())?;
-        Ok(rustls::client::HandshakeSignatureValid::assertion())
+        Ok(HandshakeSignatureValid::assertion())
     }
 
-    fn client_auth_root_subjects(&self) -> &[rustls::DistinguishedName] {
-        &[]
+    fn supported_verify_schemes(&self) -> Vec<SignatureScheme> {
+        SIGNATURE_SCHEMES.to_vec()
     }
 }