diff --git a/Cargo.lock b/Cargo.lock index 7b40353a4f0c..5537cfe2b0da 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -155,6 +155,15 @@ dependencies = [ "byteorder 1.0.0 (registry+https://github.com/rust-lang/crates.io-index)", ] +[[package]] +name = "base64" +version = "0.6.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "byteorder 1.0.0 (registry+https://github.com/rust-lang/crates.io-index)", + "safemem 0.2.0 (registry+https://github.com/rust-lang/crates.io-index)", +] + [[package]] name = "binary-space-partition" version = "0.1.2" @@ -1280,6 +1289,16 @@ dependencies = [ "openssl 0.9.12 (registry+https://github.com/rust-lang/crates.io-index)", ] +[[package]] +name = "hyper-sync-rustls" +version = "0.1.0" +source = "git+https://github.com/SergioBenitez/hyper-sync-rustls.git#33a052910fce5d0a40178c43707e0e89fd090dc0" +dependencies = [ + "hyper 0.10.10 (registry+https://github.com/rust-lang/crates.io-index)", + "rustls 0.9.0 (registry+https://github.com/rust-lang/crates.io-index)", + "webpki-roots 0.11.0 (registry+https://github.com/rust-lang/crates.io-index)", +] + [[package]] name = "hyper_serde" version = "0.7.0" @@ -1843,6 +1862,7 @@ dependencies = [ "flate2 0.2.19 (registry+https://github.com/rust-lang/crates.io-index)", "hyper 0.10.10 (registry+https://github.com/rust-lang/crates.io-index)", "hyper-openssl 0.2.6 (registry+https://github.com/rust-lang/crates.io-index)", + "hyper-sync-rustls 0.1.0 (git+https://github.com/SergioBenitez/hyper-sync-rustls.git)", "hyper_serde 0.7.0 (registry+https://github.com/rust-lang/crates.io-index)", "immeta 0.3.5 (registry+https://github.com/rust-lang/crates.io-index)", "ipc-channel 0.8.0 (registry+https://github.com/rust-lang/crates.io-index)", @@ -1856,6 +1876,7 @@ dependencies = [ "openssl 0.9.12 (registry+https://github.com/rust-lang/crates.io-index)", "parse-hosts 0.4.0 (registry+https://github.com/rust-lang/crates.io-index)", "profile_traits 0.0.1", + "rustls 0.9.0 (registry+https://github.com/rust-lang/crates.io-index)", "serde 1.0.8 (registry+https://github.com/rust-lang/crates.io-index)", "serde_json 1.0.2 (registry+https://github.com/rust-lang/crates.io-index)", "servo-websocket 0.19.1 (registry+https://github.com/rust-lang/crates.io-index)", @@ -2348,6 +2369,14 @@ dependencies = [ "serde 1.0.8 (registry+https://github.com/rust-lang/crates.io-index)", ] +[[package]] +name = "rayon" +version = "0.7.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "rayon-core 1.2.0 (registry+https://github.com/rust-lang/crates.io-index)", +] + [[package]] name = "rayon" version = "0.8.1" @@ -2401,6 +2430,18 @@ name = "regex-syntax" version = "0.4.1" source = "registry+https://github.com/rust-lang/crates.io-index" +[[package]] +name = "ring" +version = "0.11.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "gcc 0.3.47 (registry+https://github.com/rust-lang/crates.io-index)", + "lazy_static 0.2.8 (registry+https://github.com/rust-lang/crates.io-index)", + "libc 0.2.23 (registry+https://github.com/rust-lang/crates.io-index)", + "rayon 0.7.1 (registry+https://github.com/rust-lang/crates.io-index)", + "untrusted 0.5.0 (registry+https://github.com/rust-lang/crates.io-index)", +] + [[package]] name = "rust-webvr" version = "0.5.0" @@ -2433,6 +2474,24 @@ dependencies = [ "semver 0.1.20 (registry+https://github.com/rust-lang/crates.io-index)", ] +[[package]] +name = "rustls" +version = "0.9.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "base64 0.6.0 (registry+https://github.com/rust-lang/crates.io-index)", + "log 0.3.8 (registry+https://github.com/rust-lang/crates.io-index)", + "ring 0.11.0 (registry+https://github.com/rust-lang/crates.io-index)", + "time 0.1.37 (registry+https://github.com/rust-lang/crates.io-index)", + "untrusted 0.5.0 (registry+https://github.com/rust-lang/crates.io-index)", + "webpki 0.14.0 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "safemem" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" + [[package]] name = "same-file" version = "0.1.3" @@ -3360,6 +3419,11 @@ dependencies = [ "void 1.0.2 (registry+https://github.com/rust-lang/crates.io-index)", ] +[[package]] +name = "untrusted" +version = "0.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" + [[package]] name = "url" version = "1.5.1" @@ -3474,6 +3538,25 @@ dependencies = [ "webdriver 0.22.0 (registry+https://github.com/rust-lang/crates.io-index)", ] +[[package]] +name = "webpki" +version = "0.14.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "ring 0.11.0 (registry+https://github.com/rust-lang/crates.io-index)", + "time 0.1.37 (registry+https://github.com/rust-lang/crates.io-index)", + "untrusted 0.5.0 (registry+https://github.com/rust-lang/crates.io-index)", +] + +[[package]] +name = "webpki-roots" +version = "0.11.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "untrusted 0.5.0 (registry+https://github.com/rust-lang/crates.io-index)", + "webpki 0.14.0 (registry+https://github.com/rust-lang/crates.io-index)", +] + [[package]] name = "webrender" version = "0.48.0" @@ -3655,6 +3738,7 @@ dependencies = [ "checksum backtrace 0.3.2 (registry+https://github.com/rust-lang/crates.io-index)" = "72f9b4182546f4b04ebc4ab7f84948953a118bd6021a1b6a6c909e3e94f6be76" "checksum backtrace-sys 0.1.11 (registry+https://github.com/rust-lang/crates.io-index)" = "3a0d842ea781ce92be2bf78a9b38883948542749640b8378b3b2f03d1fd9f1ff" "checksum base64 0.5.2 (registry+https://github.com/rust-lang/crates.io-index)" = "30e93c03064e7590d0466209155251b90c22e37fab1daf2771582598b5827557" +"checksum base64 0.6.0 (registry+https://github.com/rust-lang/crates.io-index)" = "96434f987501f0ed4eb336a411e0631ecd1afa11574fe148587adc4ff96143c9" "checksum binary-space-partition 0.1.2 (registry+https://github.com/rust-lang/crates.io-index)" = "88ceb0d16c4fd0e42876e298d7d3ce3780dd9ebdcbe4199816a32c77e08597ff" "checksum bincode 0.8.0 (registry+https://github.com/rust-lang/crates.io-index)" = "e103c8b299b28a9c6990458b7013dc4a8356a9b854c51b9883241f5866fac36e" "checksum bindgen 0.29.0 (registry+https://github.com/rust-lang/crates.io-index)" = "0c338079dafc81bef7d581f494b906603d12359c4306979eae6ca081925a4984" @@ -3751,6 +3835,7 @@ dependencies = [ "checksum httparse 1.2.1 (registry+https://github.com/rust-lang/crates.io-index)" = "a6e7a63e511f9edffbab707141fbb8707d1a3098615fb2adbd5769cdfcc9b17d" "checksum hyper 0.10.10 (registry+https://github.com/rust-lang/crates.io-index)" = "36e108e0b1fa2d17491cbaac4bc460dc0956029d10ccf83c913dd0e5db3e7f07" "checksum hyper-openssl 0.2.6 (registry+https://github.com/rust-lang/crates.io-index)" = "85a372eb692590b3fe014c196c30f9f52d4c42f58cd49dd94caeee1593c9cc37" +"checksum hyper-sync-rustls 0.1.0 (git+https://github.com/SergioBenitez/hyper-sync-rustls.git)" = "" "checksum hyper_serde 0.7.0 (registry+https://github.com/rust-lang/crates.io-index)" = "cbe43f514f80494e9329c9fc47d61b85b167d245685424637a0f4a409177e444" "checksum idna 0.1.2 (registry+https://github.com/rust-lang/crates.io-index)" = "2233d4940b1f19f0418c158509cd7396b8d70a5db5705ce410914dc8fa603b37" "checksum image 0.12.4 (registry+https://github.com/rust-lang/crates.io-index)" = "d95816db758249fe16f23a4e23f1a3a817fe11892dbfd1c5836f625324702158" @@ -3835,6 +3920,7 @@ dependencies = [ "checksum quasi_codegen 0.32.0 (registry+https://github.com/rust-lang/crates.io-index)" = "51b9e25fa23c044c1803f43ca59c98dac608976dd04ce799411edd58ece776d4" "checksum quote 0.3.15 (registry+https://github.com/rust-lang/crates.io-index)" = "7a6e920b65c65f10b2ae65c831a81a073a89edd28c7cce89475bff467ab4167a" "checksum rand 0.3.15 (registry+https://github.com/rust-lang/crates.io-index)" = "022e0636ec2519ddae48154b028864bdce4eaf7d35226ab8e65c611be97b189d" +"checksum rayon 0.7.1 (registry+https://github.com/rust-lang/crates.io-index)" = "a77c51c07654ddd93f6cb543c7a849863b03abc7e82591afda6dc8ad4ac3ac4a" "checksum rayon 0.8.1 (registry+https://github.com/rust-lang/crates.io-index)" = "705cf28d52a26a9ab548930a9a3d9799eb77cf84d66d7cc6e52fa222ca662424" "checksum rayon-core 1.2.0 (registry+https://github.com/rust-lang/crates.io-index)" = "e2c21a92a5dca958fb030787c1158446c6deb7f976399b72fa8074603f169e2a" "checksum redox_syscall 0.1.17 (registry+https://github.com/rust-lang/crates.io-index)" = "29dbdfd4b9df8ab31dec47c6087b7b13cbf4a776f335e4de8efba8288dda075b" @@ -3842,10 +3928,13 @@ dependencies = [ "checksum ref_slice 1.1.1 (registry+https://github.com/rust-lang/crates.io-index)" = "825740057197b7d43025e7faf6477eaabc03434e153233da02d1f44602f71527" "checksum regex 0.2.2 (registry+https://github.com/rust-lang/crates.io-index)" = "1731164734096285ec2a5ec7fea5248ae2f5485b3feeb0115af4fda2183b2d1b" "checksum regex-syntax 0.4.1 (registry+https://github.com/rust-lang/crates.io-index)" = "ad890a5eef7953f55427c50575c680c42841653abd2b028b68cd223d157f62db" +"checksum ring 0.11.0 (registry+https://github.com/rust-lang/crates.io-index)" = "1f2a6dc7fc06a05e6de183c5b97058582e9da2de0c136eafe49609769c507724" "checksum rust-webvr 0.5.0 (registry+https://github.com/rust-lang/crates.io-index)" = "6090d0c49df36e14c9b25a6ae3ab6004f44d558c184141a1797554ff65a49b37" "checksum rustc-demangle 0.1.4 (registry+https://github.com/rust-lang/crates.io-index)" = "3058a43ada2c2d0b92b3ae38007a2d0fa5e9db971be260e0171408a4ff471c95" "checksum rustc-serialize 0.3.24 (registry+https://github.com/rust-lang/crates.io-index)" = "dcf128d1287d2ea9d80910b5f1120d0b8eede3fbf1abe91c40d39ea7d51e6fda" "checksum rustc_version 0.1.7 (registry+https://github.com/rust-lang/crates.io-index)" = "c5f5376ea5e30ce23c03eb77cbe4962b988deead10910c372b226388b594c084" +"checksum rustls 0.9.0 (registry+https://github.com/rust-lang/crates.io-index)" = "17727f4b991294da2c84d75a43c003151ff58072212768800f66c56ee46dca43" +"checksum safemem 0.2.0 (registry+https://github.com/rust-lang/crates.io-index)" = "e27a8b19b835f7aea908818e871f5cc3a5a186550c30773be987e155e8163d8f" "checksum same-file 0.1.3 (registry+https://github.com/rust-lang/crates.io-index)" = "d931a44fdaa43b8637009e7632a02adc4f2b2e0733c08caa4cf00e8da4a117a7" "checksum scoped_threadpool 0.1.7 (registry+https://github.com/rust-lang/crates.io-index)" = "3ef399c8893e8cb7aa9696e895427fab3a6bf265977bb96e126f24ddd2cda85a" "checksum scopeguard 0.3.2 (registry+https://github.com/rust-lang/crates.io-index)" = "c79eb2c3ac4bc2507cda80e7f3ac5b88bd8eae4c0914d5663e6a8933994be918" @@ -3907,6 +3996,7 @@ dependencies = [ "checksum unicode-width 0.1.4 (registry+https://github.com/rust-lang/crates.io-index)" = "bf3a113775714a22dcb774d8ea3655c53a32debae63a063acc00a91cc586245f" "checksum unicode-xid 0.0.4 (registry+https://github.com/rust-lang/crates.io-index)" = "8c1f860d7d29cf02cb2f3f359fd35991af3d30bac52c57d265a3c461074cb4dc" "checksum unreachable 0.1.1 (registry+https://github.com/rust-lang/crates.io-index)" = "1f2ae5ddb18e1c92664717616dd9549dde73f539f01bd7b77c2edb2446bdff91" +"checksum untrusted 0.5.0 (registry+https://github.com/rust-lang/crates.io-index)" = "6b65243989ef6aacd9c0d6bd2b822765c3361d8ed352185a6f3a41f3a718c673" "checksum url 1.5.1 (registry+https://github.com/rust-lang/crates.io-index)" = "eeb819346883532a271eb626deb43c4a1bb4c4dd47c519bd78137c3e72a4fe27" "checksum url_serde 0.2.0 (registry+https://github.com/rust-lang/crates.io-index)" = "74e7d099f1ee52f823d4bdd60c93c3602043c728f5db3b97bdb548467f7bddea" "checksum user32-sys 0.2.0 (registry+https://github.com/rust-lang/crates.io-index)" = "4ef4711d107b21b410a3a974b1204d9accc8b10dad75d8324b5d755de1617d47" @@ -3918,6 +4008,8 @@ dependencies = [ "checksum void 1.0.2 (registry+https://github.com/rust-lang/crates.io-index)" = "6a02e4885ed3bc0f2de90ea6dd45ebcbb66dacffe03547fadbb0eeae2770887d" "checksum walkdir 1.0.7 (registry+https://github.com/rust-lang/crates.io-index)" = "bb08f9e670fab86099470b97cd2b252d6527f0b3cc1401acdb595ffc9dd288ff" "checksum webdriver 0.22.0 (registry+https://github.com/rust-lang/crates.io-index)" = "d548aabf87411b1b4ba91fd07eacd8b238135c7131a452b8a9f6386209167e18" +"checksum webpki 0.14.0 (registry+https://github.com/rust-lang/crates.io-index)" = "e499345fc4c6b7c79a5b8756d4592c4305510a13512e79efafe00dfbd67bbac6" +"checksum webpki-roots 0.11.0 (registry+https://github.com/rust-lang/crates.io-index)" = "5bfb3f50499f21ad2317f442845e3b5805b007f1e728f59885c99e61b8c181a7" "checksum webrender 0.48.0 (git+https://github.com/servo/webrender)" = "" "checksum webrender_api 0.48.0 (git+https://github.com/servo/webrender)" = "" "checksum winapi 0.2.8 (registry+https://github.com/rust-lang/crates.io-index)" = "167dc9d6949a9b857f3451275e911c3f44255842c1f7a76f33c55103a909087a" diff --git a/components/net/Cargo.toml b/components/net/Cargo.toml index d86b6ac0ba16..59d07741e791 100644 --- a/components/net/Cargo.toml +++ b/components/net/Cargo.toml @@ -30,6 +30,7 @@ net_traits = {path = "../net_traits"} openssl = "0.9" parse-hosts = "0.4.0" profile_traits = {path = "../profile_traits"} +rustls = "0.9.0" serde = "1.0" serde_json = "1.0" servo_config = {path = "../config"} @@ -41,6 +42,7 @@ unicase = "1.4.0" url = {version = "1.2", features = ["heap_size"]} uuid = {version = "0.5", features = ["v4"]} webrender_api = {git = "https://github.com/servo/webrender", features = ["ipc"]} +hyper-sync-rustls = {git = "https://github.com/SergioBenitez/hyper-sync-rustls.git"} [target.'cfg(any(target_os = "macos", target_os = "linux", target_os = "windows"))'.dependencies] tinyfiledialogs = "2.5.9" diff --git a/components/net/connector.rs b/components/net/connector.rs index 659fb4b6ad91..f4fd9d82388d 100644 --- a/components/net/connector.rs +++ b/components/net/connector.rs @@ -6,19 +6,19 @@ use hosts::replace_host; use hyper::client::Pool; use hyper::error::{Result as HyperResult, Error as HyperError}; use hyper::net::{NetworkConnector, HttpsStream, HttpStream, SslClient}; -use hyper_openssl::OpensslClient; -use openssl::ssl::{SSL_OP_NO_COMPRESSION, SSL_OP_NO_SSLV2, SSL_OP_NO_SSLV3}; -use openssl::ssl::{SslConnectorBuilder, SslMethod}; -use std::io; +use hyper_sync_rustls::TlsClient; +use rustls; +use std::{io, fs}; use std::net::TcpStream; use std::path::PathBuf; +use std::sync::Arc; pub struct HttpsConnector { - ssl: OpensslClient, + ssl: TlsClient, } impl HttpsConnector { - fn new(ssl: OpensslClient) -> HttpsConnector { + fn new(ssl: TlsClient) -> HttpsConnector { HttpsConnector { ssl: ssl, } @@ -26,7 +26,7 @@ impl HttpsConnector { } impl NetworkConnector for HttpsConnector { - type Stream = HttpsStream<::Stream>; + type Stream = HttpsStream<::Stream>; fn connect(&self, host: &str, port: u16, scheme: &str) -> HyperResult { if scheme != "http" && scheme != "https" { @@ -50,35 +50,17 @@ impl NetworkConnector for HttpsConnector { pub type Connector = HttpsConnector; -pub fn create_ssl_client(ca_file: &PathBuf) -> OpensslClient { - let mut ssl_connector_builder = SslConnectorBuilder::new(SslMethod::tls()).unwrap(); - { - let context = ssl_connector_builder.builder_mut(); - context.set_ca_file(ca_file).expect("could not set CA file"); - context.set_cipher_list(DEFAULT_CIPHERS).expect("could not set ciphers"); - context.set_options(SSL_OP_NO_SSLV2 | SSL_OP_NO_SSLV3 | SSL_OP_NO_COMPRESSION); - } - let ssl_connector = ssl_connector_builder.build(); - OpensslClient::from(ssl_connector) +pub fn create_ssl_client(ca_file: &PathBuf) -> TlsClient { + let mut ca = { + let f = fs::File::open(ca_file).expect("cannot open CA file"); + io::BufReader::new(f) + }; + let mut tls = rustls::ClientConfig::new(); + tls.root_store.add_pem_file(&mut ca).unwrap(); + TlsClient { cfg: Arc::new(tls) } } -pub fn create_http_connector(ssl_client: OpensslClient) -> Pool { +pub fn create_http_connector(ssl_client: TlsClient ) -> Pool { let https_connector = HttpsConnector::new(ssl_client); Pool::with_connector(Default::default(), https_connector) } - -// The basic logic here is to prefer ciphers with ECDSA certificates, Forward -// Secrecy, AES GCM ciphers, AES ciphers, and finally 3DES ciphers. -// A complete discussion of the issues involved in TLS configuration can be found here: -// https://wiki.mozilla.org/Security/Server_Side_TLS -const DEFAULT_CIPHERS: &'static str = concat!( - "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:", - "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:", - "DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:", - "ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:", - "ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA:", - "ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:", - "DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:", - "ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:", - "AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA" -); diff --git a/components/net/http_loader.rs b/components/net/http_loader.rs index 6c59669a7502..c2cb6d284462 100644 --- a/components/net/http_loader.rs +++ b/components/net/http_loader.rs @@ -27,8 +27,8 @@ use hyper::header::{Pragma, Quality, QualityItem, Referer, SetCookie}; use hyper::header::{UserAgent, q, qitem}; use hyper::method::Method; use hyper::status::StatusCode; -use hyper_openssl::OpensslClient; use hyper_serde::Serde; +use hyper_sync_rustls::TlsClient; use log; use msg::constellation_msg::PipelineId; use net_traits::{CookieSource, FetchMetadata, NetworkError, ReferrerPolicy}; @@ -69,12 +69,12 @@ pub struct HttpState { pub hsts_list: RwLock, pub cookie_jar: RwLock, pub auth_cache: RwLock, - pub ssl_client: OpensslClient, + pub ssl_client: TlsClient, pub connector: Pool, } impl HttpState { - pub fn new(ssl_client: OpensslClient) -> HttpState { + pub fn new(ssl_client: TlsClient) -> HttpState { HttpState { hsts_list: RwLock::new(HstsList::new()), cookie_jar: RwLock::new(CookieStorage::new(150)), diff --git a/components/net/lib.rs b/components/net/lib.rs index c22825ad0663..f516344abb36 100644 --- a/components/net/lib.rs +++ b/components/net/lib.rs @@ -12,8 +12,8 @@ extern crate cookie as cookie_rs; extern crate devtools_traits; extern crate flate2; extern crate hyper; -extern crate hyper_openssl; extern crate hyper_serde; +extern crate hyper_sync_rustls; extern crate immeta; extern crate ipc_channel; #[macro_use] @@ -28,6 +28,7 @@ extern crate net_traits; extern crate openssl; extern crate parse_hosts; extern crate profile_traits; +extern crate rustls; #[macro_use] extern crate serde; extern crate serde_json; extern crate servo_config; diff --git a/servo-tidy.toml b/servo-tidy.toml index 65690061677a..2f4768c967fc 100644 --- a/servo-tidy.toml +++ b/servo-tidy.toml @@ -36,6 +36,8 @@ packages = [ "error-chain", "bitflags", "libloading", # Conflicting version is only used at build-time by geckolib. + "base64", # Conflicting version is used for ring + "rayon", # Conflicting version is used for rustls ] # Files that are ignored for all tidy and lint checks. files = [