max / makenotwork

1.9 KB · 38 lines History Blame Raw

1	//! Shared TLS configuration for pom's outbound HTTP.
2	//!
3	//! Every probe (health, CORS, routes, peer, alerts) trusts the bundled Mozilla
4	//! root set via `webpki-roots`, the same anchor the TLS-expiry check reports
5	//! against, so a host with an extra local root cannot make the HTTP check and
6	//! the certificate check disagree about one target. The rustls provider is ring
7	//! (pure Rust), installed process-wide by [`install_crypto_provider`] at startup.
8
9	/// Install ring as the process-wide rustls crypto provider. Idempotent (guarded
10	/// by a `Once`); safe to call from `main` at startup and from every config
11	/// builder, so a TLS client can never be built before a provider is installed.
12	pub fn install_crypto_provider() {
13	static INSTALLED: std::sync::Once = std::sync::Once::new();
14	INSTALLED.call_once(\|\| {
15	let _ = rustls::crypto::ring::default_provider().install_default();
16	});
17	}
18
19	/// A rustls client config pinned to the bundled webpki (Mozilla) roots.
20	pub fn webpki_client_config() -> rustls::ClientConfig {
21	// `ClientConfig::builder()` reads the process-default provider, so make sure
22	// ring is installed even if this runs before `main`'s explicit install (tests).
23	install_crypto_provider();
24	let mut roots = rustls::RootCertStore::empty();
25	roots.extend(webpki_roots::TLS_SERVER_ROOTS.iter().cloned());
26	rustls::ClientConfig::builder()
27	.with_root_certificates(roots)
28	.with_no_client_auth()
29	}
30
31	/// A `reqwest` client builder that trusts the webpki root set. Callers add their
32	/// own timeout / redirect policy, then `.build()`. reqwest is compiled
33	/// `rustls-no-provider`, so without this preconfigured config it would fall back
34	/// to the OS platform verifier, a different trust model than the cert check uses.
35	pub fn https_client_builder() -> reqwest::ClientBuilder {
36	reqwest::Client::builder().use_preconfigured_tls(webpki_client_config())
37	}
38