41 lines
1.5 KiB
Rust
41 lines
1.5 KiB
Rust
use crate::cert::{check_cert_included, sign};
|
|
use crate::info;
|
|
use rustls_pemfile::{certs, private_key};
|
|
use std::io::BufReader;
|
|
use std::sync::Arc;
|
|
|
|
pub fn build_tls_acceptor(target_hosts: Vec<String>) -> Arc<rustls::ServerConfig> {
|
|
let is_included_built_in = check_cert_included(target_hosts.iter().map(|s| s.as_str()));
|
|
let (cert_chain, key) = if is_included_built_in {
|
|
let fullchain = include_bytes!(concat!(env!("OUT_DIR"), "/fullchain.pem"));
|
|
let leaf_key = include_bytes!(concat!(env!("OUT_DIR"), "/leaf.key"));
|
|
let cert_chain = certs(&mut BufReader::new(&fullchain[..]))
|
|
.collect::<Result<Vec<_>, _>>()
|
|
.unwrap();
|
|
let key = private_key(&mut BufReader::new(&leaf_key[..]))
|
|
.unwrap()
|
|
.unwrap();
|
|
(cert_chain, key)
|
|
} else {
|
|
info!("Target hosts not match built-in cert, generating new cert");
|
|
let target = target_hosts.iter().map(|s| s.as_str()).collect::<Vec<_>>();
|
|
let (fullchain, leaf_key) = sign(target.iter());
|
|
let cert_chain = certs(&mut BufReader::new(fullchain.as_bytes()))
|
|
.collect::<Result<Vec<_>, _>>()
|
|
.unwrap();
|
|
let key = private_key(&mut BufReader::new(leaf_key.as_bytes()))
|
|
.unwrap()
|
|
.unwrap();
|
|
(cert_chain, key)
|
|
};
|
|
|
|
let mut config = rustls::ServerConfig::builder()
|
|
.with_no_client_auth()
|
|
.with_single_cert(cert_chain, key)
|
|
.unwrap();
|
|
|
|
config.alpn_protocols = vec![b"http/1.1".to_vec()];
|
|
|
|
Arc::new(config)
|
|
}
|