feat(transport): added support for EC keys (#1145)

* tonic: allow TLS to read ECKeys. Fixes: #1143 Signed-off-by: Yu Juncen <[email protected]> * tonic: minimize the scope of published function. Signed-off-by: Yu Juncen <[email protected]> --------- Signed-off-by: Yu Juncen <[email protected]>
hyperium · Feb 13, 2023 · 17d6a4b · 17d6a4b
1 parent 69ec5df
commit 17d6a4b
Showing 1 changed file with 82 additions and 13 deletions.
diff --git a/tonic/src/transport/service/tls.rs b/tonic/src/transport/service/tls.rs
@@ -178,21 +178,15 @@ mod rustls_keys {
  use crate::transport::service::tls::TlsError;
  use crate::transport::Identity;
 
- fn load_rustls_private_key(
+ pub(super) fn load_rustls_private_key(
  mut cursor: std::io::Cursor<&[u8]>,
  ) -> Result<PrivateKey, crate::Error> {
- // First attempt to load the private key assuming it is PKCS8-encoded
- if let Ok(mut keys) = rustls_pemfile::pkcs8_private_keys(&mut cursor) {
- if let Some(key) = keys.pop() {
- return Ok(PrivateKey(key));
- }
- }
-
- // If it not, try loading the private key as an RSA key
- cursor.set_position(0);
- if let Ok(mut keys) = rustls_pemfile::rsa_private_keys(&mut cursor) {
- if let Some(key) = keys.pop() {
- return Ok(PrivateKey(key));
+ while let Ok(Some(item)) = rustls_pemfile::read_one(&mut cursor) {
+ match item {
+ rustls_pemfile::Item::RSAKey(key)
+ | rustls_pemfile::Item::PKCS8Key(key)
+ | rustls_pemfile::Item::ECKey(key) => return Ok(PrivateKey(key)),
+ _ => continue,
  }
  }
 
@@ -235,3 +229,78 @@ mod rustls_keys {
  }
  }
 }
+
+#[cfg(test)]
+mod tests {
+ use std::io::Cursor;
+
+ // generated by: openssl ecparam -keygen -name 'prime256v1'
+ const SIMPLE_EC_KEY: &str = r#"-----BEGIN EC PARAMETERS-----
+BggqhkjOPQMBBw==
+-----END EC PARAMETERS-----
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEICIDyh40kMVWGDAYr1gXnMfeMeO3zXYigOaWrg5SNB+zoAoGCCqGSM49
+AwEHoUQDQgAEacJyVg299dkPTzUaMbOmACUfF67yp+ZrDhXVjn/5WxBAgjcmFBHg
+Tw8dfwpMzaJPXX5lWYzP276fcmbRO25CXw==
+-----END EC PRIVATE KEY-----"#;
+
+ // generated by: openssl genpkey -algorithm rsa
+ const SIMPLE_PKCS8_KEY: &str = r#"-----BEGIN PRIVATE KEY-----
+MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBAKHkX1YIvqOIAllD
+5fKcIxu2kYjIxxAAQrOBRTloGZUKdPFQY1RANB4t/LEaI5/NJ6NK4915pTn35QAQ
+zHJl+X4rNFMgVt+o/nY40PgrQxyyv5A0/URp+iS8Yn3GKt3q6p4zguiO9uNXhiiD
+b+VKIFRDm4bHR2yM7pNJ0kMdoattAgMBAAECgYAMpw6UaMaNfVnBpD7agT11MwWY
+zShRpdOQt++zFuG49kJBgejhcssf+LQhG0vhd2U7q+S3MISrTSaGpMl1v2aKR/nV
+G7X4Bb6X8vrVSMrfze2loT0aNri9jKDZkD/muy6+9JkhRa03NOdhDdseokmcqF3L
+xsU4BUOOFYb23ycoeQJBANOGxbZu/3BqsPJMQmXWo1CXuaviZ83lTczPtrz9mJVl
+Zs/KmGnJ8I2Azu/dlYXsHRvbIbqA93l1M3GnsWl5IxsCQQDD7hKvOY6qzUNyj+R4
+vul/3xaqjiTj59f3jN7Fh6+9AY+WfvEkWfyUUAXY74z43wBgtORfMXnZnjFO96tJ
+sswXAkBDYDtb19E/cox4MTg5DfwpMJrwmAYufCqi4Uq4uiI++/SanVKc57jaqbvA
+hZkZ9lJzTAJbULcDFgTT3/FPwkkfAkEAqbSDMIzdGuox2n/x9/f8jcpweogmQdUl
+xgCZUGSnfkFk2ojXW5Ip6Viqx+0toL6fOCRWjnFvRmPz958kGPCqPwJBAID4y7XV
+peOO6Yadu0YbSmFNluRebia6410p5jR21LhG1ty2h22xVhlBWjOC+TyDuKwhmiYT
+ed50S3LR1PWt4zE=
+-----END PRIVATE KEY-----"#;
+
+ // generated by: openssl genrsa
+ const SIMPLE_RSA_KEY: &str = r#"-----BEGIN RSA PRIVATE KEY-----
+MIIEogIBAAKCAQEAoEILGds1/RGBHT7jM4R+EL24sQ6Bsn14GgTHc7WoZ7lainEH
+H/n+DtHCYUXYyJnN5AMIi3pkigCP1hdXXBQga3zs3lXoi/mAMkT6vjuqQ7Xg5/95
+ABx5Ztyy25mZNaXm77glyAzSscKHxWYooXVJYG4C3SGuBJJ1zVjxen6Rkzse5Lpr
+yZOUUeqeV3M6KbJ/dkR37HFQVwmlctQukFnb4kozFBQDDnkXi9jT/PH00g6JpW3z
+YMzdMq2RMadJ0dzYv62OtdtqmQpVz0dRu/yODV4DkhrWwgPRj2uY4DnYthzILESB
+x41gxHj+jqo6NW+C+0fr6uh2CXtD0p+ZVANtBQIDAQABAoIBAE7IaOCrLV1dr5WL
+BvKancbpHdSdBxGSMOrJkqvFkCZ9ro8EhbYolcb/Q4nCZpInWlpPS3IWFzroj811
+6BJyKoXtAh1DKnE1lNohowrGFiv3S7uBkiCF3wC8Wokud20yQ9dxNdGkzCdrNIfM
+cwj8ubfYHTxMhFnnDlaG9R98/V/dFy0FLxL37eMP/heMbcwKKm9P/G2FqvuCn8a4
+FoPbAfvaR64IGCybjoiTjUD7xMHIV4Gr5K07br2TzG2zVlFTacoqXyGBbVVy+ibt
+QMh0sn+rMkAy+cFse+yCYZeAFa4FzwGz43sdFviU7uvLG7yXpvZ+uDACFzxlxUVg
+v57r1cECgYEA1MMJEe6IunDUyuzRaFNTfQX16QcAv/xLN/1TtVB3HUX5p2bIZKDr
+XEl0NCVOrCoz5RsYqbtGmp8B4Yxl3DeX+WeWeD9/f2ZTVGWyBx1N6dZ5hRsyfzG/
+xVBUqYxkChjXQ20cNtf8u7JKdnVjOJen9M92nXhFRTwgH83Id4gPp70CgYEAwNN8
+lvVJnd05ekyf1qIKOSyKiSGnGa5288PpqsjYMZisXy12y4n8cK2pX5Z5PICHeJVu
+K99WdTtO7Q4ghCXRB1jR5pTd4/3/3089SQyDnWz9jlA3pGWcSLDTB1dBJXpMQ6yG
+cR2dX5hPDNIdKsc+9Bl/OF5PScvGVUYv4SLF6ukCgYAVhh2WyNDgO6XrWYXdzgA2
+N7Im/uReh8F8So57W0aRmZCmFMnVFEp7LZsp41RQKnzRgqo+EYoU/l0MWk27t4wS
+WR5pz9KwKsPnV9poydgl/eKRSq0THQ9PgM7v0BoWw2iTk6g1DCivPFw4G6wL/5uo
+MozHZXFsjaaaUREktokO6QKBgC3Dg7RILtqaoIOYH+9OseJz4cU+CWyc7XpZKuHv
+nO/YbkCAh8syyojrjmEzUz66umwx+t3KubhFBSxZx/nVB9EYkWiKOEdeBxY2tjLa
+F3qLXXojK7GGtBrEbLE3UizU47jD/3xlLO59NXWzgFygwR4p1vnH2EWJaV7fs4lZ
+OWPRAoGAL0nX0vZ0N9qPETiQan1uHjKYuuFiSP+cwRXVSUYIQM9qDRlKG9zjugwO
+az+B6uiR4TrgbwG+faCQwcGk9B8QbcoIb8IigwrWe3XpVaEtcsqFORX0r+tJNDoY
+I0O2DOQVPKSK2N5AZzXY4IkybWTV4Yxc7rdXEO3dOOpHGKbpwFQ=
+-----END RSA PRIVATE KEY-----"#;
+
+ #[test]
+ fn test_parse_ec_key() {
+ for (n, key) in [SIMPLE_EC_KEY, SIMPLE_PKCS8_KEY, SIMPLE_RSA_KEY]
+ .iter()
+ .enumerate()
+ {
+ let c = Cursor::new(key.as_bytes());
+ let key = super::rustls_keys::load_rustls_private_key(c);
+
+ assert!(key.is_ok(), "at the {}-th case", n);
+ }
+ }
+}