Upgrade a insecure tokio::net::TcpStream to TLS

rustnoob12 · February 4, 2023, 8:20pm

What is the proper way to upgrade an existing tokio::net::TcpStream connection to TLS? Examples are appreciated and I would prefer to use rustls.

sfackler · February 4, 2023, 9:26pm

github.com

tokio-rs/tls/blob/master/tokio-rustls/examples/client/src/main.rs

use argh::FromArgs;
use std::convert::TryFrom;
use std::fs::File;
use std::io;
use std::io::BufReader;
use std::net::ToSocketAddrs;
use std::path::PathBuf;
use std::sync::Arc;
use tokio::io::{copy, split, stdin as tokio_stdin, stdout as tokio_stdout, AsyncWriteExt};
use tokio::net::TcpStream;
use tokio_rustls::rustls::{self, OwnedTrustAnchor};
use tokio_rustls::{webpki, TlsConnector};

/// Tokio Rustls client example
#[derive(FromArgs)]
struct Options {
    /// host
    #[argh(positional)]
    host: String,

This file has been truncated. show original

rustnoob12 · February 4, 2023, 9:48pm

In this part:

let mut pem = BufReader::new(File::open(cafile)?);
        let certs = rustls_pemfile::certs(&mut pem)?;
        let trust_anchors = certs.iter().map(|cert| {
            let ta = webpki::TrustAnchor::try_from_cert_der(&cert[..]).unwrap();
            OwnedTrustAnchor::from_subject_spki_name_constraints(
                ta.subject,
                ta.spki,
                ta.name_constraints,
            )
        });

Assuming I'm using Let's Encrypt which file does it want there?

sfackler · February 4, 2023, 10:02pm

You can probably use webpki-roots instead of loading a PEM file: TLS_SERVER_ROOTS in webpki_roots - Rust

rustnoob12 · February 4, 2023, 10:05pm

Sorry, what does this mean? The goal I have in mind here is to use a Let's Encrypt cert I have provisioned. I thought to do a proper exchange it had to be my cert, but that webpki thing is somehow connected to Mozilla's roots. I don't understand that.

Also what is the domain meant to be in the code sample you posted? Is it my domain or the endpoint's domain?

Finally how does this example translate for tokio_rustls?

bjorn3 · February 5, 2023, 11:30pm

If you are a client you should fill in the domain name of the server and use webpki_roots as root cert store (the root cert store is the list of CA's to trust issueing server certificates (trust anchors)). If you are the server, I think you are incorrectly trying to use the client api. The server api doesn't have any trust anchor concept. Instead you only pass a single certficate + private key where the certificate is issued by for example Let's Encrypt.