meshtls-rustls: update to rustls 0.20 and tokio-rustls 0.23#1362
Merged
meshtls-rustls: update to rustls 0.20 and tokio-rustls 0.23#1362
rustls 0.20 and tokio-rustls 0.23#1362Conversation
Signed-off-by: Eliza Weisman <[email protected]>
Signed-off-by: Eliza Weisman <[email protected]>
Signed-off-by: Eliza Weisman <[email protected]>
Signed-off-by: Eliza Weisman <[email protected]>
Signed-off-by: Eliza Weisman <[email protected]>
hawkw
commented
Nov 6, 2021
hawkw
commented
Nov 6, 2021
Comment on lines
+95
to
+96
| // XXX(eliza): it's a bummer that the server name has to be cloned here... | ||
| .connect(self.server_id.clone(), io) |
Contributor
Author
There was a problem hiding this comment.
this is not my favorite thing about the new rustls API, but i don't think we can fix it in the proxy...
Contributor
Author
|
|
Contributor
Author
...oh, I figured out why this is in my fork rather than linkerd's fork --- it's obvious in hindsight. turns out i don't have push permission for |
Member
|
@hawkw you should have access to linkerd/webpki now. |
olix0r
approved these changes
Nov 8, 2021
hawkw
commented
Nov 9, 2021
| tokio-rustls = "0.23.1" | ||
| rustls = { version = "0.20", features = ["dangerous_configuration"] } | ||
| rustls-pemfile = "0.2" | ||
| tokio-rustls = { version = "0.23.1", features = ["dangerous_configuration"] } |
Contributor
Author
There was a problem hiding this comment.
ah, i hadn't realized tokio-rustls also exposed that!
olix0r
added a commit
to linkerd/linkerd2
that referenced
this pull request
Nov 9, 2021
This release updates the proxy's `rustls`, `ring`, and `webpki` dependencies. Additionally, the proxy can now be built to use a `boringssl` backend instead of the default `rustls` backend, but this functionality is disabled in default builds. --- * meshtls: replace build script with `compile_error!` macro (linkerd/linkerd2-proxy#1357) * ci: Split actions into several workflows (linkerd/linkerd2-proxy#1356) * ci: Make job names uniform (linkerd/linkerd2-proxy#1358) * meshtls: allow building without any TLS impls enabled (linkerd/linkerd2-proxy#1359) * `app-core` should not enable `meshtls-rustls` (linkerd/linkerd2-proxy#1360) * Restore rustls credential tests (linkerd/linkerd2-proxy#1363) * build(deps): bump hex from 0.3 to 0.4 (linkerd/linkerd2-proxy#1364) * ci: Split jobs into 'fast' and 'slow' workflows (linkerd/linkerd2-proxy#1365) * meshtls: Move TLS e2e tests into the meshtls crate (linkerd/linkerd2-proxy#1366) * rustls: Tidy std::task imports (linkerd/linkerd2-proxy#1367) * build(deps): bump serde_json from 1.0.68 to 1.0.69 (linkerd/linkerd2-proxy#1368) * build(deps): bump libc from 0.2.106 to 0.2.107 (linkerd/linkerd2-proxy#1369) * meshtls: Add a `boring` backend (linkerd/linkerd2-proxy#1351) * meshtls-rustls: update to `rustls` 0.20 and `tokio-rustls` 0.23 (linkerd/linkerd2-proxy#1362)
olix0r
added a commit
to linkerd/linkerd2
that referenced
this pull request
Nov 9, 2021
This release updates the proxy's `rustls`, `ring`, and `webpki` dependencies. Additionally, the proxy can now be built to use a `boringssl` backend instead of the default `rustls` backend, but this functionality is disabled in default builds. --- * meshtls: replace build script with `compile_error!` macro (linkerd/linkerd2-proxy#1357) * ci: Split actions into several workflows (linkerd/linkerd2-proxy#1356) * ci: Make job names uniform (linkerd/linkerd2-proxy#1358) * meshtls: allow building without any TLS impls enabled (linkerd/linkerd2-proxy#1359) * `app-core` should not enable `meshtls-rustls` (linkerd/linkerd2-proxy#1360) * Restore rustls credential tests (linkerd/linkerd2-proxy#1363) * build(deps): bump hex from 0.3 to 0.4 (linkerd/linkerd2-proxy#1364) * ci: Split jobs into 'fast' and 'slow' workflows (linkerd/linkerd2-proxy#1365) * meshtls: Move TLS e2e tests into the meshtls crate (linkerd/linkerd2-proxy#1366) * rustls: Tidy std::task imports (linkerd/linkerd2-proxy#1367) * build(deps): bump serde_json from 1.0.68 to 1.0.69 (linkerd/linkerd2-proxy#1368) * build(deps): bump libc from 0.2.106 to 0.2.107 (linkerd/linkerd2-proxy#1369) * meshtls: Add a `boring` backend (linkerd/linkerd2-proxy#1351) * meshtls-rustls: update to `rustls` 0.20 and `tokio-rustls` 0.23 (linkerd/linkerd2-proxy#1362)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This branch updates
linkerd-meshtls-rustlsto userustlsversion0.20,
tokio-rustls0.23, andwebpki0.22.Hopefully, this change should be relatively straightforward --- I've
just updated the proxy's usage of these crates to use their new APIs.
Perhaps the most significant change in
rustlsis the new builder APIsfor
ClientConfigandServerConfig. Besides that, there were a coupleplaces where we had to restructure our code a bit to use the new API ---
we can no longer access the server cert verifier from the
ClientConfig, which we previously used inStore::validateforvalidating the proxy's cert. Now, instead of accessing it from the
ClientConfig, we pass in anArced server cert verifier into theclient config, and hold onto a clone of it for use in
Store::validate.This is effectively the same as what we were doing before, but required
some restructuring.
Also, since
rustlsno longer exposeswebpkitypes in its public API,this change reduces our
webpkiusage significantly.