`crossbeam-queue` is currently brought in both by Rayon (up to date v0.2.0) and
Hyper's dependency chain (0.1.x). Since Hyper is in the process of updating
things, I proposed we temporarily allow this to pass CI and revisit it when
there is a new release of Hyper or the relevant dependencies thereof.
* Use rustls for interop tests
This commit changes the interop tests to use rustls instead of openssl.
Apparently in the past there was some issue with this, but it seems to
work OK to me.
* Use certificates with larger key sizes for interop
This commit switches out the certificates used for testing interop to be
based on 4096-bit RSA keys, allowing rustls to be used for the interop
testing instead of OpenSSL.
The keys are generated using Terraform, although the state file is not
committed. A README.md is added to the data directory that explains how
to use Terraform to rotate the test certificates if this is ever
desirable.
This is desirable in order that none of the crates which `cargo build
--all` will build have the `openssl` feature, which should allow Tonic
to build on Windows with no issues.
As per #101, it is sometimes desirable to use standard web PKI roots for
gRPC clients. This commit adds a method to ClientTlsConfig to add the
trust roots from the system certificate store:
- OpenSSL uses `openssl-probe` to search the system for roots.
- Rustls uses `rustls-native-certs` to load the system roots.
Enabling the `openssl-roots` or `rustls-roots` feature for `tonic` in
`Cargo.toml` will add system roots by default when configuring a gRPC
client.
This commit adds a simple API for specifying the TLS certificate a GRPC
client will present (via the same `Identity` wrapper as a server cert is
configured). It also adds an API to specify which CA certificate client
TLS certificates will be validated against for servers.
This commit reworks TLS configuration of both servers and endpoints in
order to provide a more flexible API. We now add options to configure
the selected TLS library using the appropriate 'native' configuration
structures, as well as retaining the existing simplier interface which
is compatible with both.
The new API can also be easily extended to support simple interfaces for
configuring mTLS and a range of other options without creating sprawl
in the builders for `Server` and `Endpoint`.
Currently, using an RSA key - or indeed any text which is not a
PEM-encoded PKCS8-format key with RusTLS panics with an index-out-of-
range exception.
This commit introduces two new types of `TlsError` which indicate
problems with loading a certificate or private key:
- `CertificateParseError`, indicating that the certificate cannot be
parsed
- `PrivateKeyParseError`, indicating that the private key cannot be
parsed.
Additionally, in the case that reading the private key as PKCS8 fails,
we now try loading it as an RSA key before failing.
