Advanced mTLS support
First off, thanks for writing this! It is the simplest framework I have used.
Description
I am using poem for a service that uses mTLS auth. Right now I am using the RustlsListener, but I am starting to need 2 more features.
-
The ability to use a rustls
ServerConfigdirectly instead of theRustlsConfigprovided by poem. 1.1 I need to be able to support CRLs 1.2 I have my CA cert in DER format, and I have to convert it to PEM to pass it into the poemRustlsConfig -
The ability to extract the client cert from the request. Here is an example of how you can do this in rocket
Right now I have started implementing this in my own crate, but I think it would be good to have support in poem directly. I am more than happy to make a PR if you think this is a good idea.
Implementation
From taking a peek around the code here is how I think this could be implemented:
Add a AdvancedRustlsListener (not sure about the name) that accepts a stream of Arc<rustls::server::ServerConfig> instead of the poem RustlsConfig
Add a new optional method to the Acceptor trait and implement it for the TLS acceptors.
fn accept_with_certificate_chain(
&mut self,
) -> impl Future<Output = io::Result<(Self::Io, LocalAddr, RemoteAddr, Scheme, Vec<Certificate>)>>
+ Send {
async move {
let (io, local_addr, remote_addr, scheme) = self.accept().await?;
Ok((io, local_addr, remote_addr, scheme, Vec::new()))
}
}
Add a new field in Request to store the cert chain.
I am not sure what the best type would be to use for Certificate (maybe just Vec<u8>?)