prepare actix-tls 3.0.0-beta.7 release (#401)

actix-tls/src/connect/tls/mod.rs

@@ -0,0 +1,10 @@
+//! TLS Services
+
+#[cfg(feature = "openssl")]
+pub mod openssl;
+
+#[cfg(feature = "rustls")]
+pub mod rustls;
+
+#[cfg(feature = "native-tls")]
+pub mod native_tls;

actix-tls/src/connect/tls/native_tls.rs

@@ -0,0 +1,88 @@
+use std::io;
+
+use actix_rt::net::ActixStream;
+use actix_service::{Service, ServiceFactory};
+use futures_core::future::LocalBoxFuture;
+use log::trace;
+use tokio_native_tls::{TlsConnector as TokioNativetlsConnector, TlsStream};
+
+pub use tokio_native_tls::native_tls::TlsConnector;
+
+use crate::connect::{Address, Connection};
+
+/// Native-tls connector factory and service
+pub struct NativetlsConnector {
+    connector: TokioNativetlsConnector,
+}
+
+impl NativetlsConnector {
+    pub fn new(connector: TlsConnector) -> Self {
+        Self {
+            connector: TokioNativetlsConnector::from(connector),
+        }
+    }
+}
+
+impl NativetlsConnector {
+    pub fn service(connector: TlsConnector) -> Self {
+        Self::new(connector)
+    }
+}
+
+impl Clone for NativetlsConnector {
+    fn clone(&self) -> Self {
+        Self {
+            connector: self.connector.clone(),
+        }
+    }
+}
+
+impl<T: Address, U> ServiceFactory<Connection<T, U>> for NativetlsConnector
+where
+    U: ActixStream + 'static,
+{
+    type Response = Connection<T, TlsStream<U>>;
+    type Error = io::Error;
+    type Config = ();
+    type Service = Self;
+    type InitError = ();
+    type Future = LocalBoxFuture<'static, Result<Self::Service, Self::InitError>>;
+
+    fn new_service(&self, _: ()) -> Self::Future {
+        let connector = self.clone();
+        Box::pin(async { Ok(connector) })
+    }
+}
+
+// NativetlsConnector is both it's ServiceFactory and Service impl type.
+// As the factory and service share the same type and state.
+impl<T, U> Service<Connection<T, U>> for NativetlsConnector
+where
+    T: Address,
+    U: ActixStream + 'static,
+{
+    type Response = Connection<T, TlsStream<U>>;
+    type Error = io::Error;
+    type Future = LocalBoxFuture<'static, Result<Self::Response, Self::Error>>;
+
+    actix_service::always_ready!();
+
+    fn call(&self, stream: Connection<T, U>) -> Self::Future {
+        let (io, stream) = stream.replace_io(());
+        let connector = self.connector.clone();
+        Box::pin(async move {
+            trace!("SSL Handshake start for: {:?}", stream.host());
+            connector
+                .connect(stream.host(), io)
+                .await
+                .map(|res| {
+                    trace!("SSL Handshake success: {:?}", stream.host());
+                    stream.replace_io(res).1
+                })
+                .map_err(|e| {
+                    trace!("SSL Handshake error: {:?}", e);
+                    io::Error::new(io::ErrorKind::Other, format!("{}", e))
+                })
+        })
+    }
+}

actix-tls/src/connect/tls/openssl.rs

@@ -0,0 +1,130 @@
+use std::{
+    future::Future,
+    io,
+    pin::Pin,
+    task::{Context, Poll},
+};
+
+use actix_rt::net::ActixStream;
+use actix_service::{Service, ServiceFactory};
+use futures_core::{future::LocalBoxFuture, ready};
+use log::trace;
+
+pub use openssl::ssl::{Error as SslError, HandshakeError, SslConnector, SslMethod};
+pub use tokio_openssl::SslStream;
+
+use crate::connect::{Address, Connection};
+
+/// OpenSSL connector factory
+pub struct OpensslConnector {
+    connector: SslConnector,
+}
+
+impl OpensslConnector {
+    pub fn new(connector: SslConnector) -> Self {
+        OpensslConnector { connector }
+    }
+
+    pub fn service(connector: SslConnector) -> OpensslConnectorService {
+        OpensslConnectorService { connector }
+    }
+}
+
+impl Clone for OpensslConnector {
+    fn clone(&self) -> Self {
+        Self {
+            connector: self.connector.clone(),
+        }
+    }
+}
+
+impl<T, U> ServiceFactory<Connection<T, U>> for OpensslConnector
+where
+    T: Address,
+    U: ActixStream + 'static,
+{
+    type Response = Connection<T, SslStream<U>>;
+    type Error = io::Error;
+    type Config = ();
+    type Service = OpensslConnectorService;
+    type InitError = ();
+    type Future = LocalBoxFuture<'static, Result<Self::Service, Self::InitError>>;
+
+    fn new_service(&self, _: ()) -> Self::Future {
+        let connector = self.connector.clone();
+        Box::pin(async { Ok(OpensslConnectorService { connector }) })
+    }
+}
+
+pub struct OpensslConnectorService {
+    connector: SslConnector,
+}
+
+impl Clone for OpensslConnectorService {
+    fn clone(&self) -> Self {
+        Self {
+            connector: self.connector.clone(),
+        }
+    }
+}
+
+impl<T, U> Service<Connection<T, U>> for OpensslConnectorService
+where
+    T: Address,
+    U: ActixStream,
+{
+    type Response = Connection<T, SslStream<U>>;
+    type Error = io::Error;
+    type Future = ConnectAsyncExt<T, U>;
+
+    actix_service::always_ready!();
+
+    fn call(&self, stream: Connection<T, U>) -> Self::Future {
+        trace!("SSL Handshake start for: {:?}", stream.host());
+        let (io, stream) = stream.replace_io(());
+        let host = stream.host();
+
+        let config = self
+            .connector
+            .configure()
+            .expect("SSL connect configuration was invalid.");
+
+        let ssl = config
+            .into_ssl(host)
+            .expect("SSL connect configuration was invalid.");
+
+        ConnectAsyncExt {
+            io: Some(SslStream::new(ssl, io).unwrap()),
+            stream: Some(stream),
+        }
+    }
+}
+
+pub struct ConnectAsyncExt<T, U> {
+    io: Option<SslStream<U>>,
+    stream: Option<Connection<T, ()>>,
+}
+
+impl<T: Address, U> Future for ConnectAsyncExt<T, U>
+where
+    T: Address,
+    U: ActixStream,
+{
+    type Output = Result<Connection<T, SslStream<U>>, io::Error>;
+
+    fn poll(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Self::Output> {
+        let this = self.get_mut();
+
+        match ready!(Pin::new(this.io.as_mut().unwrap()).poll_connect(cx)) {
+            Ok(_) => {
+                let stream = this.stream.take().unwrap();
+                trace!("SSL Handshake success: {:?}", stream.host());
+                Poll::Ready(Ok(stream.replace_io(this.io.take().unwrap()).1))
+            }
+            Err(e) => {
+                trace!("SSL Handshake error: {:?}", e);
+                Poll::Ready(Err(io::Error::new(io::ErrorKind::Other, format!("{}", e))))
+            }
+        }
+    }
+}

actix-tls/src/connect/tls/rustls.rs

@@ -0,0 +1,146 @@
+use std::{
+    convert::TryFrom,
+    future::Future,
+    io,
+    pin::Pin,
+    sync::Arc,
+    task::{Context, Poll},
+};
+
+pub use tokio_rustls::{client::TlsStream, rustls::ClientConfig};
+pub use webpki_roots::TLS_SERVER_ROOTS;
+
+use actix_rt::net::ActixStream;
+use actix_service::{Service, ServiceFactory};
+use futures_core::{future::LocalBoxFuture, ready};
+use log::trace;
+use tokio_rustls::rustls::{client::ServerName, OwnedTrustAnchor, RootCertStore};
+use tokio_rustls::{Connect, TlsConnector};
+
+use crate::connect::{Address, Connection};
+
+/// Returns standard root certificates from `webpki-roots` crate as a rustls certificate store.
+pub fn webpki_roots_cert_store() -> RootCertStore {
+    let mut root_certs = RootCertStore::empty();
+    for cert in TLS_SERVER_ROOTS.0 {
+        let cert = OwnedTrustAnchor::from_subject_spki_name_constraints(
+            cert.subject,
+            cert.spki,
+            cert.name_constraints,
+        );
+        let certs = vec![cert].into_iter();
+        root_certs.add_server_trust_anchors(certs);
+    }
+    root_certs
+}
+
+/// Rustls connector factory
+pub struct RustlsConnector {
+    connector: Arc<ClientConfig>,
+}
+
+impl RustlsConnector {
+    pub fn new(connector: Arc<ClientConfig>) -> Self {
+        RustlsConnector { connector }
+    }
+}
+
+impl RustlsConnector {
+    pub fn service(connector: Arc<ClientConfig>) -> RustlsConnectorService {
+        RustlsConnectorService { connector }
+    }
+}
+
+impl Clone for RustlsConnector {
+    fn clone(&self) -> Self {
+        Self {
+            connector: self.connector.clone(),
+        }
+    }
+}
+
+impl<T, U> ServiceFactory<Connection<T, U>> for RustlsConnector
+where
+    T: Address,
+    U: ActixStream + 'static,
+{
+    type Response = Connection<T, TlsStream<U>>;
+    type Error = io::Error;
+    type Config = ();
+    type Service = RustlsConnectorService;
+    type InitError = ();
+    type Future = LocalBoxFuture<'static, Result<Self::Service, Self::InitError>>;
+
+    fn new_service(&self, _: ()) -> Self::Future {
+        let connector = self.connector.clone();
+        Box::pin(async { Ok(RustlsConnectorService { connector }) })
+    }
+}
+
+pub struct RustlsConnectorService {
+    connector: Arc<ClientConfig>,
+}
+
+impl Clone for RustlsConnectorService {
+    fn clone(&self) -> Self {
+        Self {
+            connector: self.connector.clone(),
+        }
+    }
+}
+
+impl<T, U> Service<Connection<T, U>> for RustlsConnectorService
+where
+    T: Address,
+    U: ActixStream,
+{
+    type Response = Connection<T, TlsStream<U>>;
+    type Error = io::Error;
+    type Future = RustlsConnectorServiceFuture<T, U>;
+
+    actix_service::always_ready!();
+
+    fn call(&self, connection: Connection<T, U>) -> Self::Future {
+        trace!("SSL Handshake start for: {:?}", connection.host());
+        let (stream, connection) = connection.replace_io(());
+
+        match ServerName::try_from(connection.host()) {
+            Ok(host) => RustlsConnectorServiceFuture::Future {
+                connect: TlsConnector::from(self.connector.clone()).connect(host, stream),
+                connection: Some(connection),
+            },
+            Err(_) => RustlsConnectorServiceFuture::InvalidDns,
+        }
+    }
+}
+
+pub enum RustlsConnectorServiceFuture<T, U> {
+    /// See issue https://github.com/briansmith/webpki/issues/54
+    InvalidDns,
+    Future {
+        connect: Connect<U>,
+        connection: Option<Connection<T, ()>>,
+    },
+}
+
+impl<T, U> Future for RustlsConnectorServiceFuture<T, U>
+where
+    T: Address,
+    U: ActixStream,
+{
+    type Output = Result<Connection<T, TlsStream<U>>, io::Error>;
+
+    fn poll(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Self::Output> {
+        match self.get_mut() {
+            Self::InvalidDns => Poll::Ready(Err(
+                io::Error::new(io::ErrorKind::Other, "rustls currently only handles hostname-based connections. See https://github.com/briansmith/webpki/issues/54")
+            )),
+            Self::Future { connect, connection } => {
+                let stream = ready!(Pin::new(connect).poll(cx))?;
+                let connection = connection.take().unwrap();
+                trace!("SSL Handshake success: {:?}", connection.host());
+                Poll::Ready(Ok(connection.replace_io(stream).1))
+            }
+        }
+    }
+}