aws_smithy_http_client/client/tls/
rustls_provider.rs

1/*
2 * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
3 * SPDX-License-Identifier: Apache-2.0
4 */
5use crate::client::tls::Provider;
6use rustls::crypto::CryptoProvider;
7
8/// Choice of underlying cryptography library (this only applies to rustls)
9#[derive(Debug, Clone)]
10#[non_exhaustive]
11pub enum CryptoMode {
12    /// Crypto based on [ring](https://github.com/briansmith/ring)
13    #[cfg(feature = "rustls-ring")]
14    Ring,
15    /// Crypto based on [aws-lc](https://github.com/aws/aws-lc-rs)
16    #[cfg(feature = "rustls-aws-lc")]
17    AwsLc,
18    /// FIPS compliant variant of [aws-lc](https://github.com/aws/aws-lc-rs)
19    #[cfg(feature = "rustls-aws-lc-fips")]
20    AwsLcFips,
21    /// Use a caller-supplied [`CryptoProvider`].
22    ///
23    /// Unlike the built-in modes, the cipher-suite restriction normally
24    /// applied by smithy-rs is skipped -- the caller is expected
25    /// to select the applicable cipher suites via the supplied provider.
26    ///
27    /// This variant is provided behind an `aws_sdk_unstable` cfg flag,
28    /// because the version of rustls may change in the future,
29    #[cfg(all(aws_sdk_unstable, feature = "__rustls"))]
30    Custom(CryptoProvider),
31}
32
33impl std::cmp::PartialEq for CryptoMode {
34    fn eq(&self, other: &CryptoMode) -> bool {
35        match (self, other) {
36            #[cfg(feature = "rustls-ring")]
37            (Self::Ring, Self::Ring) => true,
38            #[cfg(feature = "rustls-aws-lc")]
39            (Self::AwsLc, Self::AwsLc) => true,
40            #[cfg(feature = "rustls-aws-lc-fips")]
41            (Self::AwsLcFips, Self::AwsLcFips) => true,
42            // `CryptoProvider` does not implement PartialEq, so any
43            // `CryptoMode::Custom` value will always compare not equal to
44            // any other.
45            #[allow(unreachable_patterns)]
46            _ => false,
47        }
48    }
49}
50
51#[cfg(not(all(aws_sdk_unstable, feature = "__rustls")))]
52impl Eq for CryptoMode {}
53
54impl CryptoMode {
55    fn provider(self) -> CryptoProvider {
56        match self {
57            #[cfg(feature = "rustls-aws-lc")]
58            CryptoMode::AwsLc => rustls::crypto::aws_lc_rs::default_provider(),
59
60            #[cfg(feature = "rustls-ring")]
61            CryptoMode::Ring => rustls::crypto::ring::default_provider(),
62
63            #[cfg(feature = "rustls-aws-lc-fips")]
64            CryptoMode::AwsLcFips => {
65                let provider = rustls::crypto::default_fips_provider();
66                assert!(
67                    provider.fips(),
68                    "FIPS was requested but the provider did not support FIPS"
69                );
70                provider
71            }
72            #[cfg(all(aws_sdk_unstable, feature = "__rustls"))]
73            CryptoMode::Custom(provider) => provider,
74        }
75    }
76
77    #[cfg(all(aws_sdk_unstable, feature = "__rustls"))]
78    fn is_custom(&self) -> bool {
79        matches!(self, Self::Custom(_))
80    }
81
82    #[cfg(not(all(aws_sdk_unstable, feature = "__rustls")))]
83    fn is_custom(&self) -> bool {
84        false
85    }
86}
87
88impl Provider {
89    /// Create a TLS provider based on [rustls](https://github.com/rustls/rustls)
90    /// and the given [`CryptoMode`]
91    pub fn rustls(mode: CryptoMode) -> Provider {
92        Provider::Rustls(mode)
93    }
94}
95
96pub(crate) mod build_connector {
97    use crate::client::tls::rustls_provider::CryptoMode;
98    use crate::tls::TlsContext;
99    use client::connect::HttpConnector;
100    use hyper_util::client::legacy as client;
101    use rustls::client::danger::ServerCertVerified;
102    use rustls::client::danger::ServerCertVerifier;
103    use rustls::client::WebPkiServerVerifier;
104    use rustls::crypto::CryptoProvider;
105    use rustls_native_certs::CertificateResult;
106    use rustls_pki_types::pem::PemObject;
107    use rustls_pki_types::CertificateDer;
108    use rustls_pki_types::ServerName as RustlsServerName;
109    use std::sync::Arc;
110    use std::sync::LazyLock;
111
112    /// Cached native certificates
113    ///
114    /// Creating a `with_native_roots()` hyper_rustls client re-loads system certs
115    /// each invocation (which can take 300ms on OSx). Cache the loaded certs
116    /// to avoid repeatedly incurring that cost.
117    pub(crate) static NATIVE_ROOTS: LazyLock<Vec<CertificateDer<'static>>> = LazyLock::new(|| {
118        let CertificateResult { certs, errors, .. } = rustls_native_certs::load_native_certs();
119        if !errors.is_empty() {
120            tracing::warn!("native root CA certificate loading errors: {errors:?}")
121        }
122
123        if certs.is_empty() {
124            tracing::warn!("no native root CA certificates found!");
125        }
126
127        // NOTE: unlike hyper-rustls::with_native_roots we don't validate here, we'll do that later
128        // for now we have a collection of certs that may or may not be valid.
129        certs
130    });
131
132    pub(crate) fn restrict_ciphers(base: CryptoProvider) -> CryptoProvider {
133        let suites = &[
134            rustls::CipherSuite::TLS13_AES_256_GCM_SHA384,
135            rustls::CipherSuite::TLS13_AES_128_GCM_SHA256,
136            // TLS1.2 suites
137            rustls::CipherSuite::TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
138            rustls::CipherSuite::TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
139            rustls::CipherSuite::TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
140            rustls::CipherSuite::TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
141            rustls::CipherSuite::TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
142        ];
143        let supported_suites = suites
144            .iter()
145            .flat_map(|suite| {
146                base.cipher_suites
147                    .iter()
148                    .find(|s| &s.suite() == suite)
149                    .cloned()
150            })
151            .collect::<Vec<_>>();
152        CryptoProvider {
153            cipher_suites: supported_suites,
154            ..base
155        }
156    }
157
158    impl TlsContext {
159        pub(crate) fn rustls_root_certs(&self) -> rustls::RootCertStore {
160            let mut roots = rustls::RootCertStore::empty();
161            if self.trust_store.enable_native_roots {
162                let (valid, _invalid) = roots.add_parsable_certificates(NATIVE_ROOTS.clone());
163                debug_assert!(valid > 0, "TrustStore configured to enable native roots but no valid root certificates parsed!");
164            }
165
166            for pem_cert in &self.trust_store.custom_certs {
167                let ders = CertificateDer::pem_slice_iter(&pem_cert.0)
168                    .collect::<Result<Vec<_>, _>>()
169                    .expect("valid PEM certificate");
170                for cert in ders {
171                    roots.add(cert).expect("cert parsable")
172                }
173            }
174
175            roots
176        }
177
178        fn additional_server_names(&self) -> Vec<RustlsServerName<'static>> {
179            self.additional_server_names
180                .iter()
181                .map(|name| name.0.clone())
182                .collect()
183        }
184    }
185
186    /// Create a rustls ClientConfig with smithy-rs defaults
187    ///
188    /// This centralizes the rustls ClientConfig creation logic to ensure
189    /// consistency between the main HTTPS connector and tunnel handlers.
190    pub(crate) fn create_rustls_client_config(
191        crypto_mode: CryptoMode,
192        tls_context: &TlsContext,
193    ) -> rustls::ClientConfig {
194        let skip_restrict = crypto_mode.is_custom();
195        let provider = Arc::new(if skip_restrict {
196            crypto_mode.provider()
197        } else {
198            restrict_ciphers(crypto_mode.provider())
199        });
200        let root_certs = tls_context.rustls_root_certs();
201        let additional_server_names = tls_context.additional_server_names();
202
203        let builder = rustls::ClientConfig::builder_with_provider(Arc::clone(&provider))
204            .with_safe_default_protocol_versions()
205            .expect("Error with the TLS configuration. Please file a bug report under https://github.com/smithy-lang/smithy-rs/issues.");
206
207        if additional_server_names.is_empty() {
208            builder
209                .with_root_certificates(root_certs)
210                .with_no_client_auth()
211        } else {
212            let web_pki_server_verifier = WebPkiServerVerifier::builder_with_provider(
213                Arc::new(root_certs),
214                Arc::clone(&provider),
215            )
216            .build()
217            .expect("at least one root certificate was provided as a trust anchor");
218
219            builder
220                .dangerous()
221                .with_custom_certificate_verifier(Arc::new(ServerVerifier {
222                    web_pki_server_verifier,
223                    additional_server_names,
224                }))
225                .with_no_client_auth()
226        }
227    }
228
229    /// A server certificate verifier that extends standard WebPKI verification with
230    /// support for additional server names.
231    ///
232    /// By default, rustls verifies the server's certificate against the hostname from
233    /// the request URI. This verifier first attempts standard verification against that
234    /// hostname, and if it fails, retries verification against each name in
235    /// [`additional_server_names`](crate::tls::TlsContext::additional_server_names).
236    /// This is useful when a server presents a certificate whose Subject Alternative
237    /// Names (SANs) do not include the hostname used to connect, but do include an
238    /// alternative name the client has been configured to accept.
239    ///
240    /// All other verification behavior (signature validation, trust chain resolution,
241    /// TLS 1.2/1.3 signature checks) is delegated to the inner [`WebPkiServerVerifier`].
242    #[derive(Debug)]
243    struct ServerVerifier {
244        web_pki_server_verifier: Arc<WebPkiServerVerifier>,
245        additional_server_names: Vec<RustlsServerName<'static>>,
246    }
247
248    impl ServerCertVerifier for ServerVerifier {
249        fn verify_server_cert(
250            &self,
251            end_entity: &CertificateDer<'_>,
252            intermediates: &[CertificateDer<'_>],
253            server_name: &RustlsServerName<'_>,
254            ocsp_response: &[u8],
255            now: rustls_pki_types::UnixTime,
256        ) -> Result<rustls::client::danger::ServerCertVerified, rustls::Error> {
257            match self.web_pki_server_verifier.verify_server_cert(
258                end_entity,
259                intermediates,
260                server_name,
261                ocsp_response,
262                now,
263            ) {
264                Ok(server_cert_verified) => Ok(server_cert_verified),
265                Err(error) => {
266                    let matched = self.additional_server_names.iter().any(|alt_name| {
267                        self.web_pki_server_verifier
268                            .verify_server_cert(
269                                end_entity,
270                                intermediates,
271                                alt_name,
272                                ocsp_response,
273                                now,
274                            )
275                            .is_ok()
276                    });
277                    if matched {
278                        Ok(ServerCertVerified::assertion())
279                    } else {
280                        Err(error)
281                    }
282                }
283            }
284        }
285
286        fn verify_tls12_signature(
287            &self,
288            message: &[u8],
289            cert: &CertificateDer<'_>,
290            dss: &rustls::DigitallySignedStruct,
291        ) -> Result<rustls::client::danger::HandshakeSignatureValid, rustls::Error> {
292            self.web_pki_server_verifier
293                .verify_tls12_signature(message, cert, dss)
294        }
295
296        fn verify_tls13_signature(
297            &self,
298            message: &[u8],
299            cert: &CertificateDer<'_>,
300            dss: &rustls::DigitallySignedStruct,
301        ) -> Result<rustls::client::danger::HandshakeSignatureValid, rustls::Error> {
302            self.web_pki_server_verifier
303                .verify_tls13_signature(message, cert, dss)
304        }
305
306        fn supported_verify_schemes(&self) -> Vec<rustls::SignatureScheme> {
307            self.web_pki_server_verifier.supported_verify_schemes()
308        }
309    }
310
311    pub(crate) fn wrap_connector<R>(
312        mut conn: HttpConnector<R>,
313        crypto_mode: CryptoMode,
314        tls_context: &TlsContext,
315        proxy_config: crate::client::proxy::ProxyConfig,
316    ) -> super::connect::RustTlsConnector<R> {
317        let client_config = create_rustls_client_config(crypto_mode, tls_context);
318        conn.enforce_http(false);
319        let https_connector = hyper_rustls::HttpsConnectorBuilder::new()
320            .with_tls_config(client_config.clone())
321            .https_or_http()
322            .enable_http1()
323            .enable_http2()
324            .wrap_connector(conn);
325
326        super::connect::RustTlsConnector::new(https_connector, client_config, proxy_config)
327    }
328}
329
330pub(crate) mod connect {
331    use crate::client::connect::{Conn, Connecting};
332    use crate::client::proxy::ProxyConfig;
333    use aws_smithy_runtime_api::box_error::BoxError;
334    use http_1x::uri::Scheme;
335    use http_1x::Uri;
336    use hyper::rt::{Read, ReadBufCursor, Write};
337    use hyper_rustls::MaybeHttpsStream;
338    use hyper_util::client::legacy::connect::{Connected, Connection, HttpConnector};
339    use hyper_util::client::proxy::matcher::Matcher;
340    use hyper_util::rt::TokioIo;
341    use pin_project_lite::pin_project;
342    use std::error::Error;
343    use std::sync::Arc;
344    use std::{
345        io::{self, IoSlice},
346        pin::Pin,
347        task::{Context, Poll},
348    };
349    use tokio::io::{AsyncRead, AsyncWrite};
350    use tokio::net::TcpStream;
351    use tokio_rustls::client::TlsStream;
352    use tower::Service;
353
354    #[derive(Debug, Clone)]
355    pub(crate) struct RustTlsConnector<R> {
356        https: hyper_rustls::HttpsConnector<HttpConnector<R>>,
357        tls_config: Arc<rustls::ClientConfig>,
358        proxy_matcher: Option<Arc<Matcher>>, // Pre-computed for performance
359    }
360
361    impl<R> RustTlsConnector<R> {
362        pub(super) fn new(
363            https: hyper_rustls::HttpsConnector<HttpConnector<R>>,
364            tls_config: rustls::ClientConfig,
365            proxy_config: ProxyConfig,
366        ) -> Self {
367            // Pre-compute the proxy matcher once during construction
368            let proxy_matcher = if proxy_config.is_disabled() {
369                None
370            } else {
371                Some(Arc::new(proxy_config.into_hyper_util_matcher()))
372            };
373
374            Self {
375                https,
376                tls_config: Arc::new(tls_config),
377                proxy_matcher,
378            }
379        }
380    }
381
382    impl<R> Service<Uri> for RustTlsConnector<R>
383    where
384        R: Clone + Send + Sync + 'static,
385        R: Service<hyper_util::client::legacy::connect::dns::Name>,
386        R::Response: Iterator<Item = std::net::SocketAddr>,
387        R::Future: Send,
388        R::Error: Into<Box<dyn Error + Send + Sync>>,
389    {
390        type Response = Conn;
391        type Error = BoxError;
392        type Future = Connecting;
393
394        fn poll_ready(&mut self, cx: &mut Context<'_>) -> Poll<Result<(), Self::Error>> {
395            self.https.poll_ready(cx).map_err(Into::into)
396        }
397
398        fn call(&mut self, dst: Uri) -> Self::Future {
399            // Check if this request should be proxied using pre-computed matcher
400            let proxy_intercept = if let Some(ref matcher) = self.proxy_matcher {
401                matcher.intercept(&dst)
402            } else {
403                None
404            };
405
406            if let Some(intercept) = proxy_intercept {
407                if dst.scheme() == Some(&Scheme::HTTPS) {
408                    // HTTPS through HTTP proxy: Use CONNECT tunneling + manual TLS
409                    self.handle_https_through_proxy(dst, intercept)
410                } else {
411                    // HTTP through proxy: Direct connection to proxy
412                    self.handle_http_through_proxy(dst, intercept)
413                }
414            } else {
415                // Direct connection: Use the existing HTTPS connector
416                self.handle_direct_connection(dst)
417            }
418        }
419    }
420
421    impl<R> RustTlsConnector<R>
422    where
423        R: Clone + Send + Sync + 'static,
424        R: Service<hyper_util::client::legacy::connect::dns::Name>,
425        R::Response: Iterator<Item = std::net::SocketAddr>,
426        R::Future: Send,
427        R::Error: Into<Box<dyn Error + Send + Sync>>,
428    {
429        fn handle_direct_connection(&mut self, dst: Uri) -> Connecting {
430            let fut = self.https.call(dst);
431            Box::pin(async move {
432                let conn = fut.await?;
433                Ok(Conn {
434                    inner: Box::new(conn),
435                    is_proxy: false,
436                })
437            })
438        }
439
440        fn handle_http_through_proxy(
441            &mut self,
442            _dst: Uri,
443            intercept: hyper_util::client::proxy::matcher::Intercept,
444        ) -> Connecting {
445            // For HTTP through proxy, connect to the proxy and let it handle the request
446            let proxy_uri = intercept.uri().clone();
447            let fut = self.https.call(proxy_uri);
448            Box::pin(async move {
449                let conn = fut.await?;
450                Ok(Conn {
451                    inner: Box::new(conn),
452                    is_proxy: true,
453                })
454            })
455        }
456
457        fn handle_https_through_proxy(
458            &mut self,
459            dst: Uri,
460            intercept: hyper_util::client::proxy::matcher::Intercept,
461        ) -> Connecting {
462            use rustls_pki_types::ServerName as RustlsServerName;
463            // For HTTPS through HTTP proxy, we need to:
464            // 1. Establish CONNECT tunnel using the HTTPS connector
465            // 2. Perform manual TLS handshake over the tunneled stream
466
467            let tunnel = hyper_util::client::legacy::connect::proxy::Tunnel::new(
468                intercept.uri().clone(),
469                self.https.clone(),
470            );
471
472            // Configure tunnel with authentication if present
473            let mut tunnel = if let Some(auth) = intercept.basic_auth() {
474                tunnel.with_auth(auth.clone())
475            } else {
476                tunnel
477            };
478
479            let tls_config = self.tls_config.clone();
480            let dst_clone = dst.clone();
481
482            Box::pin(async move {
483                // Establish CONNECT tunnel
484                tracing::trace!("tunneling HTTPS over proxy");
485                let tunneled = tunnel
486                    .call(dst_clone.clone())
487                    .await
488                    .map_err(|e| BoxError::from(format!("CONNECT tunnel failed: {e}")))?;
489
490                // Stage 2: Manual TLS handshake over tunneled stream
491                let host = dst_clone
492                    .host()
493                    .ok_or("missing host in URI for TLS handshake")?;
494
495                let server_name = RustlsServerName::try_from(host.to_owned()).map_err(|e| {
496                    BoxError::from(format!("invalid server name for TLS handshake: {e}"))
497                })?;
498
499                let tls_connector = tokio_rustls::TlsConnector::from(tls_config)
500                    .connect(server_name, TokioIo::new(tunneled))
501                    .await?;
502
503                Ok(Conn {
504                    inner: Box::new(RustTlsConn {
505                        inner: TokioIo::new(tls_connector),
506                    }),
507                    is_proxy: true,
508                })
509            })
510        }
511    }
512
513    pin_project! {
514        pub(crate) struct RustTlsConn<T> {
515            #[pin] pub(super) inner: TokioIo<TlsStream<T>>
516        }
517    }
518
519    impl Connection for RustTlsConn<TokioIo<TokioIo<TcpStream>>> {
520        fn connected(&self) -> Connected {
521            if self.inner.inner().get_ref().1.alpn_protocol() == Some(b"h2") {
522                self.inner
523                    .inner()
524                    .get_ref()
525                    .0
526                    .inner()
527                    .connected()
528                    .negotiated_h2()
529            } else {
530                self.inner.inner().get_ref().0.inner().connected()
531            }
532        }
533    }
534
535    impl Connection for RustTlsConn<TokioIo<MaybeHttpsStream<TokioIo<TcpStream>>>> {
536        fn connected(&self) -> Connected {
537            if self.inner.inner().get_ref().1.alpn_protocol() == Some(b"h2") {
538                self.inner
539                    .inner()
540                    .get_ref()
541                    .0
542                    .inner()
543                    .connected()
544                    .negotiated_h2()
545            } else {
546                self.inner.inner().get_ref().0.inner().connected()
547            }
548        }
549    }
550    impl<T: AsyncRead + AsyncWrite + Unpin> Read for RustTlsConn<T> {
551        fn poll_read(
552            self: Pin<&mut Self>,
553            cx: &mut Context<'_>,
554            buf: ReadBufCursor<'_>,
555        ) -> Poll<tokio::io::Result<()>> {
556            let this = self.project();
557            Read::poll_read(this.inner, cx, buf)
558        }
559    }
560
561    impl<T: AsyncRead + AsyncWrite + Unpin> Write for RustTlsConn<T> {
562        fn poll_write(
563            self: Pin<&mut Self>,
564            cx: &mut Context<'_>,
565            buf: &[u8],
566        ) -> Poll<Result<usize, tokio::io::Error>> {
567            let this = self.project();
568            Write::poll_write(this.inner, cx, buf)
569        }
570
571        fn poll_write_vectored(
572            self: Pin<&mut Self>,
573            cx: &mut Context<'_>,
574            bufs: &[IoSlice<'_>],
575        ) -> Poll<Result<usize, io::Error>> {
576            let this = self.project();
577            Write::poll_write_vectored(this.inner, cx, bufs)
578        }
579
580        fn is_write_vectored(&self) -> bool {
581            self.inner.is_write_vectored()
582        }
583
584        fn poll_flush(
585            self: Pin<&mut Self>,
586            cx: &mut Context<'_>,
587        ) -> Poll<Result<(), tokio::io::Error>> {
588            let this = self.project();
589            Write::poll_flush(this.inner, cx)
590        }
591
592        fn poll_shutdown(
593            self: Pin<&mut Self>,
594            cx: &mut Context<'_>,
595        ) -> Poll<Result<(), tokio::io::Error>> {
596            let this = self.project();
597            Write::poll_shutdown(this.inner, cx)
598        }
599    }
600}
aws_smithy_http_client/client/tls/rustls_provider.rs

aws_smithy_http_client/client/tls/
rustls_provider.rs
