feat(transport): Add support client mTLS (#77)

This commit adds a simple API for specifying the TLS certificate a GRPC
client will present (via the same `Identity` wrapper as a server cert is
configured). It also adds an API to specify which CA certificate client
TLS certificates will be validated against for servers.

tonic-examples/src/tls_client_auth/client.rs

@@ -0,0 +1,38 @@
+pub mod pb {
+    tonic::include_proto!("grpc.examples.echo");
+}
+
+use pb::{client::EchoClient, EchoRequest};
+use tonic::transport::{Certificate, Channel, ClientTlsConfig, Identity};
+
+#[tokio::main]
+async fn main() -> Result<(), Box<dyn std::error::Error>> {
+    let server_root_ca_cert = tokio::fs::read("tonic-examples/data/tls/ca.pem").await?;
+    let server_root_ca_cert = Certificate::from_pem(server_root_ca_cert);
+    let client_cert = tokio::fs::read("tonic-examples/data/tls/client1.pem").await?;
+    let client_key = tokio::fs::read("tonic-examples/data/tls/client1.key").await?;
+    let client_identity = Identity::from_pem(client_cert, client_key);
+
+    let tls = ClientTlsConfig::with_openssl()
+        .domain_name("localhost")
+        .ca_certificate(server_root_ca_cert)
+        .identity(client_identity)
+        .clone();
+
+    let channel = Channel::from_static("http://[::1]:50051")
+        .tls_config(&tls)
+        .clone()
+        .channel();
+
+    let mut client = EchoClient::new(channel);
+
+    let request = tonic::Request::new(EchoRequest {
+        message: "hello".into(),
+    });
+
+    let response = client.unary_echo(request).await?;
+
+    println!("RESPONSE={:?}", response);
+
+    Ok(())
+}

tonic-examples/src/tls_client_auth/server.rs

@@ -0,0 +1,52 @@
+pub mod pb {
+    tonic::include_proto!("grpc.examples.echo");
+}
+
+use std::collections::VecDeque;
+
+use pb::{EchoRequest, EchoResponse};
+use tonic::transport::{Certificate, Identity, Server, ServerTlsConfig};
+use tonic::{Request, Response, Status};
+
+type EchoResult<T> = Result<Response<T>, Status>;
+type Stream = VecDeque<Result<EchoResponse, Status>>;
+
+#[derive(Default)]
+pub struct EchoServer;
+
+#[tonic::async_trait]
+impl pb::server::Echo for EchoServer {
+    async fn unary_echo(&self, request: Request<EchoRequest>) -> EchoResult<EchoResponse> {
+        let message = request.into_inner().message;
+        Ok(Response::new(EchoResponse { message }))
+    }
+
+    type ServerStreamingEchoStream = Stream;
+    type BidirectionalStreamingEchoStream = Stream;
+}
+
+#[tokio::main]
+async fn main() -> Result<(), Box<dyn std::error::Error>> {
+    let cert = tokio::fs::read("tonic-examples/data/tls/server.pem").await?;
+    let key = tokio::fs::read("tonic-examples/data/tls/server.key").await?;
+    let server_identity = Identity::from_pem(cert, key);
+
+    let client_ca_cert = tokio::fs::read("tonic-examples/data/tls/client_ca.pem").await?;
+    let client_ca_cert = Certificate::from_pem(client_ca_cert);
+
+    let addr = "[::1]:50051".parse().unwrap();
+    let server = EchoServer::default();
+
+    let tls = ServerTlsConfig::with_rustls()
+        .identity(server_identity)
+        .client_ca_root(client_ca_cert)
+        .clone();
+
+    Server::builder()
+        .tls_config(&tls)
+        .clone()
+        .serve(addr, pb::server::EchoServer::new(server))
+        .await?;
+
+    Ok(())
+}