cpu
commented
1 year ago rustls-ffi / Clippy nightly (optional) (pull_request)
This failure is nightly clippy saying:
error: usage of `Arc<T>` where `T` is not `Send` or `Sync`
Error: --> src/lib.rs:396:23
|
396 | Arc::into_raw(Arc::new(src)) as *const _
| ^^^^^^^^^^^^^
|
= help: consider using `Rc<T>` instead or wrapping `T` in a std::sync type like `Mutex<T>`Ctz spotted that:
- This is also happening on
main. - It looks to be this false positive issue: https://github.com/rust-lang/rust-clippy/issues/11076
jsha
chore: ignore clion/jetbrains dir, venv dir.
Small quality of life improvement for developers using clion and a venv for the Python tests.
deps: update rustls ecosystem dependencies.
Brings in the latest Rustls and supporting libraries.
cipher: rename verifier types to match upstream.
This commit renames the
rustls_client_cert_verifierandrustls_client_cert_verifier_optionaltypes to better match their upstream Rustls equivalents:rustls_allow_any_authenticated_client_verifierandrustls_allow_any_anonymous_or_authenticated_client_verifier. While wordier, these names are easier to understand and to map back to their Rust equivalents.Associated functions (
_newand_free) are updated to match the new naming scheme.cipher: client cert verifier w/ CRLs support.
This commit reworks both the
rustls_client_cert_verifier_optionalandrustls_client_cert_verifierstructs to use a separate builder pattern. This enables optionally providing the builder CRLs from PEM files. Afterwards the intermediate builder can be turned into the standardconst *verifiers to provide to the client configuration.Thanks to @ctz for suggesting this approach and sketching it out with me in a draft branch I've tided up and extended here.
server: support reading CRL PEM for client auth.
This commit updates the
tests/server.cexample program to support reading one or more CRLs from a single PEM encoded CRL file, provided viaAUTH_CRL. This option is only processed when the server is performing mandatory client authentication (e.g.AUTH_CERTwas provided).tests: add CRL mTLS test.
This commit adds a simple test CRL (
testdata/test.crl.pem) that lists thetestdata/localhost/cert.pemcertificate as revoked, but not thetestdata/example.com/cert.pemcertificate.The
client-server.pyintegration test driver is then updated with a suite that will start the server binary in a mode that requires mTLS, and that loads the test crl. Two connection attempts are made with the client binary: one using theexample.comclient cert that isn't expected to error, and one using thelocalhostclient cert that is expected to error (since it's revoked).