tonic/transport/server/
tls.rs

1/*
2 *
3 * Copyright 2025 gRPC authors.
4 *
5 * Permission is hereby granted, free of charge, to any person obtaining a copy
6 * of this software and associated documentation files (the "Software"), to
7 * deal in the Software without restriction, including without limitation the
8 * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
9 * sell copies of the Software, and to permit persons to whom the Software is
10 * furnished to do so, subject to the following conditions:
11 *
12 * The above copyright notice and this permission notice shall be included in
13 * all copies or substantial portions of the Software.
14 *
15 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
20 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
21 * IN THE SOFTWARE.
22 *
23 */
24
25use std::{fmt, time::Duration};
26
27use super::service::TlsAcceptor;
28use crate::transport::tls::{Certificate, Identity};
29
30/// Configures TLS settings for servers.
31#[derive(Clone, Default)]
32pub struct ServerTlsConfig {
33    identity: Option<Identity>,
34    client_ca_root: Option<Certificate>,
35    client_auth_optional: bool,
36    ignore_client_order: bool,
37    use_key_log: bool,
38    timeout: Option<Duration>,
39}
40
41impl fmt::Debug for ServerTlsConfig {
42    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
43        f.debug_struct("ServerTlsConfig").finish()
44    }
45}
46
47impl ServerTlsConfig {
48    /// Creates a new `ServerTlsConfig`.
49    pub fn new() -> Self {
50        ServerTlsConfig::default()
51    }
52
53    /// Sets the [`Identity`] of the server.
54    pub fn identity(self, identity: Identity) -> Self {
55        ServerTlsConfig {
56            identity: Some(identity),
57            ..self
58        }
59    }
60
61    /// Sets a certificate against which to validate client TLS certificates.
62    pub fn client_ca_root(self, cert: Certificate) -> Self {
63        ServerTlsConfig {
64            client_ca_root: Some(cert),
65            ..self
66        }
67    }
68
69    /// Sets whether client certificate verification is optional.
70    ///
71    /// This option has effect only if CA certificate is set.
72    ///
73    /// # Default
74    /// By default, this option is set to `false`.
75    pub fn client_auth_optional(self, optional: bool) -> Self {
76        ServerTlsConfig {
77            client_auth_optional: optional,
78            ..self
79        }
80    }
81
82    /// Sets whether the server's cipher preferences are followed instead of the client's.
83    ///
84    /// # Default
85    /// By default, this option is set to `false`.
86    pub fn ignore_client_order(self, ignore_client_order: bool) -> Self {
87        ServerTlsConfig {
88            ignore_client_order,
89            ..self
90        }
91    }
92
93    /// Use key log as specified by the `SSLKEYLOGFILE` environment variable.
94    pub fn use_key_log(self) -> Self {
95        ServerTlsConfig {
96            use_key_log: true,
97            ..self
98        }
99    }
100
101    /// Sets the timeout for the TLS handshake.
102    pub fn timeout(self, timeout: Duration) -> Self {
103        ServerTlsConfig {
104            timeout: Some(timeout),
105            ..self
106        }
107    }
108
109    pub(crate) fn tls_acceptor(&self) -> Result<TlsAcceptor, crate::BoxError> {
110        TlsAcceptor::new(
111            self.identity.as_ref().unwrap(),
112            self.client_ca_root.as_ref(),
113            self.client_auth_optional,
114            self.ignore_client_order,
115            self.use_key_log,
116            self.timeout,
117        )
118    }
119}
tonic/transport/server/tls.rs

tonic/transport/server/
tls.rs
