mirrors/arti.git/crates/tor-rtcompat/src/impls/rustls.rs, branch arti-v1.4.2

rustls: move provider-installer to its own function.

2025-03-04T19:45:18Z

We do this so that we can make sure there's a provider installed when we run the tests.

rustls.rs: Replace x509-signature with rustls-webpki

2025-03-04T19:45:18Z

The x509-signature crate is archived, and won't see any more releases. Using it is tying us to ring 0.16 internally, which means we depend on two ring versions. Fortunately, rustls-webpki relaxes some of the earlier restrictions from the vanilla webpki crate, which means that its certificate parser now accepts C tor's oddball x509 certificates as valid. With this change, we can delegate to rustls's built-in signature-checking code, and we only have to override its certificate validation. (We still override it with a pile of comments about how we don't validate link certificates much.) I've had to include a few certificates: two are for tests, but one is needed as a placeholder, since we can't construct a rustls certificate validator without a root cert, even if we'll never use it. Closes #1824. Closes #1854.

rtcompat: Un-rename CertificateDer type.

2025-03-04T19:45:18Z

(We had added this rename when rustls renamed it originally.)

tor-rtcompat: Big invasive change adding StreamOps bound everywhere.

2025-01-15T13:49:17Z

This is unfortunately necessary, because after the channel handshake, we need to give the channel reactor a `StreamOps` handle to the underlying stream.

tor-rtcompat: Implement StreamOps for TLS stream types.

2025-01-15T13:49:17Z

tls: Support export keying material (RFC 5705)

2024-06-18T14:18:58Z

Add a function to get the keying material as detailed by RFC 5705. Because native-tls doesn't have such support, there is a place holder panic!() for now. This means that for the forseable future, relay would only work with rustls until we figure out a solution for native-tls. Closes #1432 Signed-off-by: David Goulet

Add a note about CryptoProvicder.

2024-04-22T15:25:45Z

Upgrade to futures-rustls 0.26.0, rustls 0.23.5.

2024-04-22T15:25:45Z

The rustls upgrade will solve #1377 and CVE-2024-32650. Note that we've had to patch our RustlsProvider impl a bit in order to keep the tests passing. See comments. Closes #1377.

Run maint/add_warning.

2024-03-13T16:30:53Z

rtcompat: Fix a rustdoc link.

2024-01-30T18:17:49Z