examples/main.rs

@@ -1,4 +1,3 @@
-use async_trait::async_trait;
 use tokio_gemini::{
     certs::{
         dane, file_sscv::KnownHostsFile, fingerprint::CertFingerprint, SelfsignedCertVerifier,
@@ -13,7 +12,7 @@ use tokio_gemini::{
 //
 
 const USAGE: &str = "-k\t\tinsecure mode (trust all certs)
--d <DNS server>\tuse custom DNS for resolving & DANE
+-d <DNS server addr>\tuse custom DNS for resolving & DANE
 -h\t\tshow help";
 
 #[tokio::main]
@@ -121,11 +120,10 @@ struct CertVerifier {
     dns: Option<DnsClient>,
 }
 
-#[async_trait]
 impl SelfsignedCertVerifier for CertVerifier {
-    async fn verify(
+    async fn verify<'c>(
         &self,
-        cert: &tokio_gemini::certs::CertificateDer<'_>,
+        cert: &'c tokio_gemini::certs::CertificateDer<'c>,
         host: &str,
         port: u16,
     ) -> Result<bool, tokio_gemini::LibError> {

examples/simple.rs

@@ -1,4 +1,3 @@
-use async_trait::async_trait;
 use tokio_gemini::{
     certs::{fingerprint::CertFingerprint, SelfsignedCertVerifier},
     Client, LibError,
@@ -33,11 +32,10 @@ async fn main() -> Result<(), LibError> {
 
 struct CertVerifier;
 
-#[async_trait]
 impl SelfsignedCertVerifier for CertVerifier {
-    async fn verify(
+    async fn verify<'c>(
         &self,
-        cert: &tokio_gemini::certs::CertificateDer<'_>,
+        cert: &'c tokio_gemini::certs::CertificateDer<'c>,
         host: &str,
         port: u16,
     ) -> Result<bool, tokio_gemini::LibError> {

src/certs/dane.rs

@@ -4,9 +4,9 @@ use crate::{
     LibError,
 };
 
-pub async fn dane(
+pub async fn dane<'d>(
     dns: &DnsClient,
-    cert: &CertificateDer<'_>,
+    cert: &CertificateDer<'d>,
     host: &str,
     port: u16,
 ) -> Result<CertFingerprint, LibError> {

src/certs/mod.rs

@@ -17,9 +17,9 @@ pub use tokio_rustls::rustls::pki_types::{CertificateDer, ServerName, UnixTime};
 /// It is recommended to use helpers from file_sscv.
 #[async_trait]
 pub trait SelfsignedCertVerifier: Send + Sync {
-    async fn verify(
+    async fn verify<'c>(
         &self,
-        cert: &CertificateDer<'_>,
+        cert: &'c CertificateDer<'c>,
         host: &str,
         port: u16,
         // now: UnixTime,

src/client/mod.rs

@@ -25,7 +25,7 @@ use tokio::{
     io::{AsyncBufReadExt, AsyncReadExt, AsyncWriteExt},
     net::TcpStream,
 };
-use tokio_rustls::{rustls, TlsConnector};
+use tokio_rustls::TlsConnector;
 use url::Url;
 
 pub struct Client {
@@ -101,20 +101,6 @@ impl Client {
         let stream = self.try_connect(host, port).await?;
         let mut stream = self.connector.connect(domain, stream).await?;
 
-        if let Some(ssv) = &self.ss_verifier {
-            let cert = stream
-                .get_ref()
-                .1 // rustls::ClientConnection
-                .peer_certificates()
-                .unwrap() // i think handshake already completed if we awaited on connector.connect?
-                .first()
-                .ok_or(rustls::Error::NoCertificatesPresented)?;
-
-            if !ssv.verify(cert, host, port).await? {
-                return Err(rustls::CertificateError::ApplicationVerificationFailure.into());
-            }
-        }
-
         // Write URL, then CRLF
         stream.write_all(url_str.as_bytes()).await?;
         stream.write_all(b"\r\n").await?;

src/dns.rs

@@ -89,9 +89,7 @@ impl DnsClient {
             Ok(answers.into_iter().filter_map(|rec| {
                 if let Some(RData::TLSA(tlsa)) = rec.data() {
                     if tlsa.cert_usage() == CertUsage::DomainIssued
-                        // maybe implement extracting public key later,
-                        // but for now only accept TLSA records with full certs hashed
-                        && tlsa.selector() == Selector::Full
+                        && tlsa.selector() == Selector::Spki
                     {
                         match tlsa.matching() {
                             Matching::Sha256 => CertFingerprint::try_from_sha256(tlsa.cert_data())

src/error.rs

@@ -1,11 +1,11 @@
 //! Library error structures and enums
 
-use tokio_rustls::rustls;
-
 #[cfg(feature = "hickory")]
 use hickory_client::{
     error::ClientError as HickoryClientError, proto::error::ProtoError as HickoryProtoError,
 };
+#[cfg(feature = "hickory")]
+use tokio::runtime::TryCurrentError;
 
 /// Main error structure, also a wrapper for everything else
 #[derive(Debug)]
@@ -15,12 +15,9 @@ pub enum LibError {
     IoError(std::io::Error),
     /// URL parse or check error
     InvalidUrlError(InvalidUrl),
-    /// DNS server has provided no suitable records
+    /// DNS provided no suitable records
     /// (e. g. domain does not exist)
     HostLookupError,
-    /// TLS library error related to certificate/signature
-    /// verification failure or connection failure
-    RustlsError(rustls::Error),
     /// Response status code is out of [10; 69] range
     StatusOutOfRange(u8),
     /// Response metadata or content cannot be parsed
@@ -28,9 +25,16 @@ pub enum LibError {
     DataNotUtf8(std::string::FromUtf8Error),
     /// Provided string is not a valid MIME type
     InvalidMime(mime::FromStrError),
-    /// Hickory DNS client error
+    /// Hickory Client error
     #[cfg(feature = "hickory")]
     DnsClientError(HickoryClientError),
+    /// Hickory Proto error
+    #[cfg(feature = "hickory")]
+    DnsProtoError(HickoryProtoError),
+    /// Could not get Tokio runtime handle
+    /// inside Rustls cert verifier
+    #[cfg(feature = "hickory")]
+    NoTokioRuntime(TryCurrentError),
 }
 
 impl From<std::io::Error> for LibError {
@@ -54,20 +58,6 @@ impl From<InvalidUrl> for LibError {
     }
 }
 
-impl From<rustls::Error> for LibError {
-    #[inline]
-    fn from(err: rustls::Error) -> Self {
-        Self::RustlsError(err)
-    }
-}
-
-impl From<rustls::CertificateError> for LibError {
-    #[inline]
-    fn from(err: rustls::CertificateError) -> Self {
-        Self::RustlsError(err.into())
-    }
-}
-
 impl LibError {
     #[inline]
     pub fn status_out_of_range(num: u8) -> Self {
@@ -101,7 +91,15 @@ impl From<HickoryClientError> for LibError {
 impl From<HickoryProtoError> for LibError {
     #[inline]
     fn from(err: HickoryProtoError) -> Self {
-        Self::DnsClientError(err.into())
+        Self::DnsProtoError(err)
+    }
+}
+
+#[cfg(feature = "hickory")]
+impl From<TryCurrentError> for LibError {
+    #[inline]
+    fn from(err: TryCurrentError) -> Self {
+        Self::NoTokioRuntime(err)
     }
 }