Update rustls 0.21.7 and adapt code

Cargo.toml

@@ -15,20 +15,24 @@ unicase = "^2.6"
 
 [features]
 default = ["native-tls"]
-rust-tls = ["rustls", "webpki", "webpki-roots"]
+rust-tls = ["rustls", "webpki", "webpki-roots", "rustls-pemfile"]
 
 [dependencies.native-tls]
 version = "^0.2"
 optional = true
 
 [dependencies.rustls]
-version = "^0.19"
+version = "^0.21"
+optional = true
+
+[dependencies.rustls-pemfile]
+version = "^1.0"
 optional = true
 
 [dependencies.webpki]
-version = "^0.21"
+version = "^0.22"
 optional = true
 
 [dependencies.webpki-roots]
-version = "^0.21"
+version = "^0.25"
 optional = true

src/error.rs

@@ -10,6 +10,8 @@ pub enum ParseErr {
     UriErr,
     Invalid,
     Empty,
+    #[cfg(feature = "rust-tls")]
+    Rustls(rustls::Error),
 }
 
 impl error::Error for ParseErr {
@@ -19,6 +21,8 @@ impl error::Error for ParseErr {
         match self {
             Utf8(e) => Some(e),
             Int(e) => Some(e),
+            #[cfg(feature = "rust-tls")]
+            Rustls(e) => Some(e),
             StatusErr | HeadersErr | UriErr | Invalid | Empty => None,
         }
     }
@@ -36,11 +40,20 @@ impl fmt::Display for ParseErr {
             StatusErr => "status line contains invalid values",
             HeadersErr => "headers contain invalid values",
             UriErr => "uri contains invalid characters",
+            #[cfg(feature = "rust-tls")]
+            Rustls(_) => "rustls error",
         };
         write!(f, "ParseErr: {}", err)
     }
 }
 
+#[cfg(feature = "rust-tls")]
+impl From<rustls::Error> for ParseErr {
+    fn from(e: rustls::Error) -> Self {
+        ParseErr::Rustls(e)
+    }
+}
+
 impl From<num::ParseIntError> for ParseErr {
     fn from(e: num::ParseIntError) -> Self {
         ParseErr::Int(e)

src/tls.rs

@@ -23,7 +23,7 @@ pub struct Conn<S: io::Read + io::Write> {
     stream: native_tls::TlsStream<S>,
 
     #[cfg(feature = "rust-tls")]
-    stream: rustls::StreamOwned<rustls::ClientSession, S>,
+    stream: rustls::StreamOwned<rustls::ClientConnection, S>,
 }
 
 impl<S: io::Read + io::Write> io::Read for Conn<S> {
@@ -63,7 +63,7 @@ pub struct Config {
     #[cfg(feature = "native-tls")]
     extra_root_certs: Vec<native_tls::Certificate>,
     #[cfg(feature = "rust-tls")]
-    client_config: std::sync::Arc<rustls::ClientConfig>,
+    root_certs: std::sync::Arc<rustls::RootCertStore>,
 }
 
 impl Default for Config {
@@ -76,13 +76,16 @@ impl Default for Config {
 
     #[cfg(feature = "rust-tls")]
     fn default() -> Self {
-        let mut config = rustls::ClientConfig::new();
-        config
-            .root_store
-            .add_server_trust_anchors(&webpki_roots::TLS_SERVER_ROOTS);
-
+        let mut root_store = rustls::RootCertStore::empty();
+        root_store.add_trust_anchors(webpki_roots::TLS_SERVER_ROOTS.iter().map(|ta| {
+            rustls::OwnedTrustAnchor::from_subject_spki_name_constraints(
+                ta.subject,
+                ta.spki,
+                ta.name_constraints,
+            )
+        }));
         Config {
-            client_config: std::sync::Arc::new(config),
+            root_certs: std::sync::Arc::new(root_store),
         }
     }
 }
@@ -127,11 +130,8 @@ impl Config {
     pub fn add_root_cert_file_pem(&mut self, file_path: &Path) -> Result<&mut Self, HttpError> {
         let f = File::open(file_path)?;
         let mut f = BufReader::new(f);
-        let config = std::sync::Arc::make_mut(&mut self.client_config);
-        let _ = config
-            .root_store
-            .add_pem_file(&mut f)
-            .map_err(|_| HttpError::from(ParseErr::Invalid))?;
+        let root_certs = std::sync::Arc::make_mut(&mut self.root_certs);
+        root_certs.add_parsable_certificates(&rustls_pemfile::certs(&mut f)?);
         Ok(self)
     }
 
@@ -141,13 +141,17 @@ impl Config {
         H: AsRef<str>,
         S: io::Read + io::Write,
     {
-        use rustls::{ClientSession, StreamOwned};
-
-        let session = ClientSession::new(
-            &self.client_config,
-            webpki::DNSNameRef::try_from_ascii_str(hostname.as_ref())
-                .map_err(|_| HttpError::Tls)?,
-        );
+        use rustls::{ClientConnection, StreamOwned};
+
+        let client_config = rustls::ClientConfig::builder()
+            .with_safe_defaults()
+            .with_root_certificates(self.root_certs.clone())
+            .with_no_client_auth();
+        let session = ClientConnection::new(
+            std::sync::Arc::new(client_config),
+            hostname.as_ref().try_into().map_err(|_| HttpError::Tls)?,
+        )
+        .map_err(|e| ParseErr::Rustls(e))?;
         let stream = StreamOwned::new(session, stream);
 
         Ok(Conn { stream })