This commit adds a new crate `tonic-health` which implements the
[standard GRPC Health Checking][checking] protocol.
Currently there is only a server implementation, though others have
alluded in the discussion in #135 that client implementations exist
which could also be imported as necessary.
A example server has also been added - once the client work is done a
client for this should be added also.
[checking]: https://github.com/grpc/grpc/blob/master/doc/health-checking.mdFixes#135.
This commit adjusts the code generation for the internal structs in the
implementation of Service<http::Request<HyperBody>> for *Server<T> in
order to annotate internal structs whose names are derived from gRPC
method names with `[allow(non_camel_case_types)]`. This supresses
compiler warnings about type names when compiling generated code. The
struct names are not exposed externally, so this has no impact on types
seen by library consumers.
Fixes#295.
Rust 1.42 deprecates the `description()` method of `std::error::Error`
and provides a blanket implementation suggesting implementation of
`std::fmt::Display` instead. We already implemented `Display` for error
types but in terms of the deprecated `description`. This commit
implements `Display` directly and falls back to the blanket
implementation of `description()`.
`crossbeam-queue` is currently brought in both by Rayon (up to date v0.2.0) and
Hyper's dependency chain (0.1.x). Since Hyper is in the process of updating
things, I proposed we temporarily allow this to pass CI and revisit it when
there is a new release of Hyper or the relevant dependencies thereof.
* Use rustls for interop tests
This commit changes the interop tests to use rustls instead of openssl.
Apparently in the past there was some issue with this, but it seems to
work OK to me.
* Use certificates with larger key sizes for interop
This commit switches out the certificates used for testing interop to be
based on 4096-bit RSA keys, allowing rustls to be used for the interop
testing instead of OpenSSL.
The keys are generated using Terraform, although the state file is not
committed. A README.md is added to the data directory that explains how
to use Terraform to rotate the test certificates if this is ever
desirable.
This is desirable in order that none of the crates which `cargo build
--all` will build have the `openssl` feature, which should allow Tonic
to build on Windows with no issues.
As per #101, it is sometimes desirable to use standard web PKI roots for
gRPC clients. This commit adds a method to ClientTlsConfig to add the
trust roots from the system certificate store:
- OpenSSL uses `openssl-probe` to search the system for roots.
- Rustls uses `rustls-native-certs` to load the system roots.
Enabling the `openssl-roots` or `rustls-roots` feature for `tonic` in
`Cargo.toml` will add system roots by default when configuring a gRPC
client.
This commit adds a simple API for specifying the TLS certificate a GRPC
client will present (via the same `Identity` wrapper as a server cert is
configured). It also adds an API to specify which CA certificate client
TLS certificates will be validated against for servers.
This commit reworks TLS configuration of both servers and endpoints in
order to provide a more flexible API. We now add options to configure
the selected TLS library using the appropriate 'native' configuration
structures, as well as retaining the existing simplier interface which
is compatible with both.
The new API can also be easily extended to support simple interfaces for
configuring mTLS and a range of other options without creating sprawl
in the builders for `Server` and `Endpoint`.
Currently, using an RSA key - or indeed any text which is not a
PEM-encoded PKCS8-format key with RusTLS panics with an index-out-of-
range exception.
This commit introduces two new types of `TlsError` which indicate
problems with loading a certificate or private key:
- `CertificateParseError`, indicating that the certificate cannot be
parsed
- `PrivateKeyParseError`, indicating that the private key cannot be
parsed.
Additionally, in the case that reading the private key as PKCS8 fails,
we now try loading it as an RSA key before failing.
