//! Implementation for using Rustls with a runtime.

//!

//! #

#[cfg(feature = "tls-server")]

pub(crate) mod rustls_server;

use crate::StreamOps;

use crate::tls::TlsAcceptorSettings;

use crate::traits::{CertifiedConn, TlsConnector, TlsProvider};

use async_trait::async_trait;

use futures::{AsyncRead, AsyncWrite};

use futures_rustls::rustls::{self, crypto::CryptoProvider};

use rustls::client::danger;

use rustls::crypto::{WebPkiSupportedAlgorithms, verify_tls12_signature, verify_tls13_signature};

use rustls::{CertificateError, Error as TLSError};

use rustls_pki_types::{CertificateDer, ServerName};

use tracing::instrument;

use webpki::EndEntityCert; // this is actually rustls_webpki.

use std::borrow::Cow;

use std::{

    io::{self, Error as IoError, Result as IoResult},

    sync::Arc,

};

/// A [`TlsProvider`] that uses `rustls`.

///

/// It supports wrapping any reasonable stream type that implements `AsyncRead` + `AsyncWrite`.

///

/// # Cryptographic providers

///

/// The application is responsible for calling [`CryptoProvider::install_default()`]

/// before constructing [`TlsProvider`].  If they do not, rustls will fail,

/// and arti will not run.

///

/// We currently recommend the [aws-lc-rs] provider because,

/// of the two builtin providers that ship with rustls,

/// it appears to have better performance,

/// and it supports hybrid post-quantum handshakes.

/// It used to have a [problematic license][aws-lc-old-license],

/// but [this has been fixed][aws-lc-relicense] since March 2026.

///

/// See the [rustls documentation][all-providers] for a list of other rustls

/// cryptography providers.

///

/// [ring]: https://crates.io/crates/ring

/// [aws-lc-rs]: https://github.com/aws/aws-lc-rs

/// [aws-lc-old-license]: https://github.com/aws/aws-lc/issues/2203

/// [all-providers]: https://docs.rs/rustls/latest/rustls/#cryptography-providers

/// [aws-lc-relicense]: https://github.com/aws/aws-lc/pull/3091

#[cfg_attr(

    docsrs,

    doc(cfg(all(

        feature = "rustls",

        any(feature = "tokio", feature = "async-std", feature = "smol")

    )))

)]

#[derive(Clone)]

#[non_exhaustive]

pub struct RustlsProvider {

    /// Inner `ClientConfig` logic used to create connectors.

    config: Arc<futures_rustls::rustls::ClientConfig>,

}

impl<S> CertifiedConn for futures_rustls::client::TlsStream<S> {

        // This is a client stream, so (as we build them currently) we know we didn't present a certificate.

}

impl<S: StreamOps> StreamOps for futures_rustls::client::TlsStream<S> {

}

/// An implementation of [`TlsConnector`] built with `rustls`.

pub struct RustlsConnector<S> {

    /// The inner connector object.

    connector: futures_rustls::TlsConnector,

    /// Phantom data to ensure proper variance.

    _phantom: std::marker::PhantomData<fn(S) -> S>,

}

#[async_trait]

impl<S> TlsConnector<S> for RustlsConnector<S>

where

    S: AsyncRead + AsyncWrite + StreamOps + Unpin + Send + 'static,

{

    type Conn = futures_rustls::client::TlsStream<S>;

    #[instrument(skip_all, level = "trace")]

    async fn negotiate_unvalidated(&self, stream: S, sni_hostname: &str) -> IoResult<Self::Conn> {

        let name: ServerName<'_> = sni_hostname

            .try_into()

        self.connector.connect(name.to_owned(), stream).await

    }

}

impl<S> TlsProvider<S> for RustlsProvider

where

    S: AsyncRead + AsyncWrite + StreamOps + Unpin + Send + 'static,

{

    type Connector = RustlsConnector<S>;

    type TlsStream = futures_rustls::client::TlsStream<S>;

    cfg_if::cfg_if! {

        if #[cfg(feature = "tls-server")] {

            type Acceptor = rustls_server::RustlsAcceptor<S>;

            type TlsServerStream = rustls_server::RustlsServerStream<S>;

        } else {

            type Acceptor = crate::tls::UnimplementedTls;

            type TlsServerStream = crate::tls::UnimplementedTls;

            fn tls_acceptor(&self, _settings: TlsAcceptorSettings) -> IoResult<Self::Acceptor> {

                Err(crate::tls::TlsServerUnsupported{}.into())

            }

        }

    }

}

/// Try to install a default crypto provider if none has been installed, so that Rustls can operate.

///

/// We only use this for testing: It is the application's responsibility to install a CryptoProvider.

///

#[cfg(any(test, feature = "testing"))]

        // If we haven't installed a CryptoProvider at this point, we warn and install

        // the `ring` provider.  That isn't great, but the alternative would be to

        // panic.  Right now, that would cause many of our tests to fail.

            "Creating a RustlsRuntime, but no CryptoProvider is installed. The application \

                        should call CryptoProvider::install_default()"

        );

        );

impl RustlsProvider {

    /// Construct a new [`RustlsProvider`].

        #[cfg(any(test, feature = "testing"))]

        // Be afraid: we are overriding the default certificate verification and

        // TLS signature checking code! See notes on `Verifier` below for

        // details.

        //

        // Note that the `set_certificate_verifier` function is somewhat

        // misnamed: it overrides not only how certificates are verified, but

        // also how certificates are used to check the signatures in a TLS

        // handshake.

        // tor-spec:

        // > Implementations SHOULD NOT allow TLS session resumption – it can exacerbate some

        // > attacks (e.g. the “Triple Handshake” attack from Feb 2013), and it plays havoc with

        // > forward secrecy guarantees.

}

impl Default for RustlsProvider {

}

/// A custom [`rustls::client::danger::ServerCertVerifier`]

///

/// This verifier is necessary since Tor relays doesn't participate in the web

/// browser PKI, and as such their certificates won't check out as valid ones.

///

/// We enforce that the certificate itself has correctly authenticated the TLS

/// connection, but nothing else.

#[derive(Clone, Debug)]

struct Verifier(pub(crate) WebPkiSupportedAlgorithms);

impl danger::ServerCertVerifier for Verifier {

        // We don't check anything about the certificate at this point other

        // than making sure it is well-formed.

        //

        // When we make a channel, we'll check that it's authenticated by the

        // other party's real identity key, inside the Tor handshake.

        //

        // In theory, we shouldn't have to do even this much: rustls should not

        // allow a handshake  without a certificate, and the certificate's

        // well-formedness should get checked below in one of the

        // verify_*_signature functions.  But this check is cheap, so let's

        // leave it in.

        // Note that we don't even check timeliness or key usage: Tor uses the presented

        // relay certificate just as a container for the relay's public link

        // key.  Actual timeliness checks will happen later, on the certificates

        // that authenticate this one, when we process the relay's CERTS cell in

        // `tor_proto::channel::handshake`.

        //

        // (This is what makes it safe for us _not_ to call

        // EndEntityCert::verify_for_usage.)

        // We don't actually want to send any DNs for our root certs,

        // since they aren't real.

}

#[cfg(test)]

mod test {

    // @@ begin test lint list maintained by maint/add_warning @@

    #![allow(clippy::bool_assert_comparison)]

    #![allow(clippy::clone_on_copy)]

    #![allow(clippy::dbg_macro)]

    #![allow(clippy::mixed_attributes_style)]

    #![allow(clippy::print_stderr)]

    #![allow(clippy::print_stdout)]

    #![allow(clippy::single_char_pattern)]

    #![allow(clippy::unwrap_used)]

    #![allow(clippy::unchecked_time_subtraction)]

    #![allow(clippy::useless_vec)]

    #![allow(clippy::needless_pass_by_value)]

    //! <!-- @@ end test lint list maintained by maint/add_warning @@ -->

    use super::*;

    /// A certificate returned by a C Tor relay implementation.

    ///

    /// We want to have a test for this, since some older versions of `webpki`

    /// rejected C Tor's certificates as unparsable because they did not contain

    /// any extensions.  Back then, we had to use `x509_signature`,

    /// which now appears unmaintained.

    const TOR_CERTIFICATE: &[u8] = include_bytes!("./tor-generated.der");

    #[test]

    fn basic_tor_cert() {

        ensure_testing_provider_installed();

        let der = CertificateDer::from_slice(TOR_CERTIFICATE);

        let _cert = EndEntityCert::try_from(&der).unwrap();

    }

}