poem-web / poem

A full-featured and easy-to-use web framework with the Rust programming language.
Apache License 2.0
3.62k stars 295 forks source link

Advanced mTLS support #837

Open Hackzzila opened 4 months ago

Hackzzila commented 4 months ago

First off, thanks for writing this! It is the simplest framework I have used.

Description

I am using poem for a service that uses mTLS auth. Right now I am using the RustlsListener, but I am starting to need 2 more features.

  1. The ability to use a rustls ServerConfig directly instead of the RustlsConfig provided by poem. 1.1 I need to be able to support CRLs 1.2 I have my CA cert in DER format, and I have to convert it to PEM to pass it into the poem RustlsConfig

  2. The ability to extract the client cert from the request. Here is an example of how you can do this in rocket

Right now I have started implementing this in my own crate, but I think it would be good to have support in poem directly. I am more than happy to make a PR if you think this is a good idea.

Implementation

From taking a peek around the code here is how I think this could be implemented:

Add a AdvancedRustlsListener (not sure about the name) that accepts a stream of Arc<rustls::server::ServerConfig> instead of the poem RustlsConfig

Add a new optional method to the Acceptor trait and implement it for the TLS acceptors.

    fn accept_with_certificate_chain(
        &mut self,
    ) -> impl Future<Output = io::Result<(Self::Io, LocalAddr, RemoteAddr, Scheme, Vec<Certificate>)>>
           + Send {
        async move {
            let (io, local_addr, remote_addr, scheme) = self.accept().await?;
            Ok((io, local_addr, remote_addr, scheme, Vec::new()))
        }
    }

Add a new field in Request to store the cert chain.

I am not sure what the best type would be to use for Certificate (maybe just Vec<u8>?)