Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Advanced mTLS support #837

Open
Hackzzila opened this issue Jun 25, 2024 · 0 comments
Open

Advanced mTLS support #837

Hackzzila opened this issue Jun 25, 2024 · 0 comments
Labels
enhancement New feature or request

Comments

@Hackzzila
Copy link

First off, thanks for writing this! It is the simplest framework I have used.

Description

I am using poem for a service that uses mTLS auth. Right now I am using the RustlsListener, but I am starting to need 2 more features.

  1. The ability to use a rustls ServerConfig directly instead of the RustlsConfig provided by poem.
    1.1 I need to be able to support CRLs
    1.2 I have my CA cert in DER format, and I have to convert it to PEM to pass it into the poem RustlsConfig

  2. The ability to extract the client cert from the request. Here is an example of how you can do this in rocket

Right now I have started implementing this in my own crate, but I think it would be good to have support in poem directly. I am more than happy to make a PR if you think this is a good idea.

Implementation

From taking a peek around the code here is how I think this could be implemented:

Add a AdvancedRustlsListener (not sure about the name) that accepts a stream of Arc<rustls::server::ServerConfig> instead of the poem RustlsConfig

Add a new optional method to the Acceptor trait and implement it for the TLS acceptors.

    fn accept_with_certificate_chain(
        &mut self,
    ) -> impl Future<Output = io::Result<(Self::Io, LocalAddr, RemoteAddr, Scheme, Vec<Certificate>)>>
           + Send {
        async move {
            let (io, local_addr, remote_addr, scheme) = self.accept().await?;
            Ok((io, local_addr, remote_addr, scheme, Vec::new()))
        }
    }

Add a new field in Request to store the cert chain.

I am not sure what the best type would be to use for Certificate (maybe just Vec<u8>?)

@Hackzzila Hackzzila added the enhancement New feature or request label Jun 25, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant