rust: allow TLS server cert validation from trust store

Providing no path to server certificate will by default enable trust store use for server certificate validation during handshake Signed-off-by: Nicolas Buffon <[email protected]>
Orange-OpenSource · Oct 14, 2024 · cfca0a2 · cfca0a2
1 parent 73fcef5
commit cfca0a2
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 44 deletions.
diff --git a/rust/src/client/configuration.rs b/rust/src/client/configuration.rs
@@ -23,7 +23,7 @@ use crate::client::configuration::configuration_error::ConfigurationError::{
  FieldNotFound, MissingMandatoryField, MissingMandatorySection, NoCustomSettings, NoPassword,
  TypeError,
 };
-use crate::transport::mqtt::{configure_tls, configure_transport};
+use crate::transport::mqtt::configure_transport;
 
 #[cfg(feature = "telemetry")]
 use crate::client::configuration::telemetry_configuration::{
@@ -142,16 +142,7 @@ impl TryFrom<&Properties> for MqttOptionWrapper {
  .unwrap_or_default()
  .unwrap_or_default();
 
- // FIXME manage ALPN, and authentication
- let tls_configuration = if use_tls {
- let ca_path = get_mandatory_field::<String>("tls_certificate", ("mqtt", properties))
- .expect("TLS enabled but no certificate path provided");
- Some(configure_tls(&ca_path, None, None))
- } else {
- None
- };
-
- configure_transport(tls_configuration, use_websocket, &mut mqtt_options);
+ configure_transport(use_tls, use_websocket, &mut mqtt_options);
 
  Ok(MqttOptionWrapper(mqtt_options))
  }

diff --git a/rust/src/transport/mqtt.rs b/rust/src/transport/mqtt.rs
@@ -20,48 +20,23 @@ pub mod topic;
 pub mod geo_topic;
 
 pub(crate) fn configure_transport(
- tls_configuration: Option<TlsConfiguration>,
+ use_tls: bool,
  use_websocket: bool,
  mqtt_options: &mut MqttOptions,
 ) {
- match (tls_configuration, use_websocket) {
- (Some(tls), true) => {
+ match (use_tls, use_websocket) {
+ (true, true) => {
  println!("Transport: MQTT over WebSocket; TLS enabled");
- mqtt_options.set_transport(Transport::Wss(tls));
+ mqtt_options.set_transport(Transport::Wss(TlsConfiguration::default()));
  }
- (Some(tls), false) => {
+ (true, false) => {
  println!("Transport: standard MQTT; TLS enabled");
- mqtt_options.set_transport(Transport::Tls(tls));
+ mqtt_options.set_transport(Transport::Tls(TlsConfiguration::default()));
  }
- (None, true) => {
+ (false, true) => {
  println!("Transport: MQTT over WebSocket; TLS disabled");
  mqtt_options.set_transport(Transport::Ws);
  }
- (None, false) => println!("Transport: standard MQTT; TLS disabled"),
- }
-}
-
-pub(crate) fn configure_tls(
- ca_path: &str,
- alpn: Option<Vec<Vec<u8>>>,
- client_auth: Option<(Vec<u8>, Vec<u8>)>,
-) -> TlsConfiguration {
- let ca: Vec<u8> = std::fs::read(ca_path).expect("Failed to read TLS certificate");
-
- TlsConfiguration::Simple {
- ca,
- alpn,
- client_auth,
- }
-}
-
-#[cfg(test)]
-mod tests {
- use crate::transport::mqtt::configure_tls;
-
- #[test]
- #[should_panic]
- fn configure_tls_with_invalid_path_should_return_error() {
- let _ = configure_tls("unextisting/path", None, None);
+ (false, false) => println!("Transport: standard MQTT; TLS disabled"),
  }
 }