This commit introduces the ability to dynamically select a TLS
configuration based on the client's TLS hello via the new `Resolver`
trait. In support of this, it also makes the following changes:
* Added `Authority::set_port()`.
* `UdsListener` is now `UnixListener`.
* `Bindable` removed in favor of new `Bind`.
* All built-in listeners now implement `Bind<&Rocket>`.
* `Connection` requires `AsyncRead + AsyncWrite`.
* The `Debug` impl for `Endpoint` displays the underlying address.
* `Listener` must be `Sized`.
* The TLS listener was moved to `tls::TlsListener`.
* The preview `quic` listener no longer implements `Listener`.
* Added `TlsConfig::server_config()`.
* Added `race` future helpers.
* Added `Rocket::launch_with()`, `Rocket::bind_launch()`.
* Added a default `client.pem` to the TLS example.
* Various unnecessary listener `Config` structures removed.
In addition, the testbench was revamped to support more scenarios. This
resulted in the following issues being found and fixed:
* Fix an issue where the logger would ignore color requests.
* Clarified docs for `mtls::Certificate` guard.
* Improved error messages on listener misconfiguration.
Resolves#2730.
Resolves#2363.
Closes#2748.
Closes#2683.
Closes#2577.
Prior to this commit, some TLS related operations used 'ring' even when
a different default 'CryptoProvider' was installed. This commit fixes
that by refactoring 'TlsConfig' such that all utility methods are
required to use the default 'CryptoProvider'.
This commit also cleans up code related to the rustls 0.23 update.
This commit updates rustls to 0.23 and adds support for custom
'CryptoProvider's installable via 'CryptoProvider::install_default()'.
In particular, this enables using `aws-lc-rs` for cryptography related
operation in TLS. The 'TLS' example was updated to test use of
'aws-lc-rs' on Unix.
This commit is a codebase-wide cleanup driven by clippy warnings. In
addition to fixing every reasonable warning, the following new
functionality was introduced:
* `Accept::new()` now takes any `T: Into<QMediaType>` iterator.
* `TempFile::is_empty()` was added.
* `HeaderMap` now implements `IntoIterator`.
This commit makes the following breaking changes:
* The `IntoCollection` trait is gone. Generics previously bound by the
trait are now bound by `IntoIterator`. This affects:
- `Accept::new()`
- `ContentType::with_params()`
- `Permission::{allow, allowed}()`
* `MediaType`, `QMediaType`, and `Allow` implement `IntoIterator`,
enabling most existing code to continue working without change.
* The inherent `HeaderMap::into_iter()` method was removed.
* The `Ok` variant in ErrorKind::Liftoff` is now `Box<Rocket<Orbit>>`.
This commit adds support for HTTP/3 and QUIC under a disabled-by-default
feature `http3-preview`. The current implementation depends on modified
versions of h3 and s2n-quic-h3 which will need to be upstreamed and
published before a release is possible.
During the course of development various facets of Rocket's internal
connection handling and recent listener APIs were improved. The complete
list of changes included in this PR is:
* A `shutdown` module was introduced.
* `config::Shutdown` was renamed to `ShutdownConfig` and moved to
`shutdown` while being re-exported from `config`.
* `ListenerAddr` is now called `Endpoint`. Various methods which
previously referred to "addresses" now refer to "endpoints".
* `Rocket::endpoint()` was renamed to `Rocket::endpoints()` and now
returns an iterator over the endpoints Rocket is listening on.
* `Endpoint` acquired various query utility methods.
* The `{set_}remote()` methods now take/produce `Endpoint`s.
* `TlsBindable` only accepts single-phase internal interfaces.
* Bind error messages include candidate endpoint info when possible.
* The warning message when a secret key is not configured now includes
information about its effect on private cookies.
Internal changes include:
* Config module tests were moved to `config/tests.rs`.
* The cancellable I/O implementation was significantly simplified.
* The `TripWire` implementation was simplified.
* Individual shutdown stages can now be awaited on via `Stages`.
* The `Shield` implementation was simplified.
Resolves#2723.
This commit completely rewrites Rocket's HTTP serving. In addition to
significant internal cleanup, this commit introduces the following major
features:
* Support for custom, external listeners in the `listener` module.
The new `listener` module contains new `Bindable`, `Listener`, and
`Connection` traits which enable composable, external
implementations of connection listeners. Rocket can launch on any
`Listener`, or anything that can be used to create a listener
(`Bindable`), via a new `launch_on()` method.
* Support for Unix domain socket listeners out of the box.
The default listener backwards compatibly supports listening on Unix
domain sockets. To do so, configure an `address` of
`unix:path/to/socket` and optional set `reuse` to `true` (the
default) or `false` which controls whether Rocket will handle
creating and deleting the unix domain socket.
In addition to these new features, this commit makes the following major
improvements:
* Rocket now depends on hyper 1.
* Rocket no longer depends on hyper to handle connections. This allows
us to handle more connection failure conditions which results in an
overall more robust server with fewer dependencies.
* Logic to work around hyper's inability to reference incoming request
data in the response results in a 15% performance improvement.
* `Client`s can be marked secure with `Client::{un}tracked_secure()`,
allowing Rocket to treat local connections as running under TLS.
* The `macros` feature of `tokio` is no longer used by Rocket itself.
Dependencies can take advantage of this reduction in compile-time
cost by disabling the new default feature `tokio-macros`.
* A new `TlsConfig::validate()` method allows checking a TLS config.
* New `TlsConfig::{certs,key}_reader()`,
`MtlsConfig::ca_certs_reader()` methods return `BufReader`s, which
allow reading the configured certs and key directly.
* A new `NamedFile::open_with()` constructor allows specifying
`OpenOptions`.
These improvements resulted in the following breaking changes:
* The MSRV is now 1.74.
* `hyper` is no longer exported from `rocket::http`.
* `IoHandler::io` takes `Box<Self>` instead of `Pin<Box<Self>>`.
- Use `Box::into_pin(self)` to recover the previous type.
* `Response::upgrade()` now returns an `&mut dyn IoHandler`, not
`Pin<& mut _>`.
* `Config::{address,port,tls,mtls}` methods have been removed.
- Use methods on `Rocket::endpoint()` instead.
* `TlsConfig` was moved to `tls::TlsConfig`.
* `MutualTls` was renamed and moved to `mtls::MtlsConfig`.
* `ErrorKind::TlsBind` was removed.
* The second field of `ErrorKind::Shutdown` was removed.
* `{Local}Request::{set_}remote()` methods take/return an `Endpoint`.
* `Client::new()` was removed; it was previously deprecated.
Internally, the following major changes were made:
* A new `async_bound` attribute macro was introduced to allow setting
bounds on futures returned by `async fn`s in traits while
maintaining good docs.
* All utility functionality was moved to a new `util` module.
Resolves#2671.
Resolves#1070.
Tokio's `File::write_all()` method has an unexpected quirk: it doesn't
actually write all the requested content to the file when the returned
future resolves. Instead, the write is attempted and queued. This means
that the `persist()` method can resolve without the data being persisted
to the file system. Subsequent reads of the ostensibly written-to file
can thus fail to contain the expected data.
An call to `flush()` following `write_all()` would circumvent the issue.
Alternatively, calling `fs::write()` actually writes to the file system
before returning and requires fewer lines of code. This commit thus
swaps the call to `write_all()` with `fs::write()`.
In the process, the following improvements were also made:
* Error messages related to TLS were improved.
* 'Redirector' in 'tls' example was improved.
Previously, the `NotFound` status code was used to signal many kinds of
recoverable, forwarding errors. This included validation errors, incorrect
Content-Type errors, and more.
This commit modifies the status code used to forward in these instances to more
precisely indicate the forwarding condition. In particular:
* Parameter `FromParam` errors now forward as 422 (`UnprocessableEntity`).
* Query paramater errors now forward as 422 (`UnprocessableEntity`).
* Use of incorrect form content-type forwards as 413 (`UnsupportedMediaType`).
* `WebSocket` guard now forwards as 400 (`BadRequest`).
* `&Host`, `&Accept`, `&ContentType`, `IpAddr`, and `SocketAddr` all forward
with a 500 (`InternalServerError`).
Additionally, the `IntoOutcome` trait was overhauled to support functionality
previously offered by methods on `Outcome`. The `Outcome::forward()` method now
requires a status code to use for the forwarding outcome.
Finally, logging of `Outcome`s now includes the relevant status code.
Resolves#2626.
The primary motivation is to deconflate the leading `F`s in `Failure` and
`Forward`. In particular, when using a generics, we used `F` for forward, which
could easily be confused for `F` for `Failure`. This resolves the conflation.
Sergio Benitez
Wesley Rosenblum
Łukasz Wojniłowicz
Abdullah Alyan
Tau
John Bampton
Arjen
Paul Lietar
Martyn
Lev Kokotov
cui fliter
Ruben Schmidmeister