rustls · ctz · Oct 1, 2024 · Sep 30, 2024 · Sep 30, 2024 · Sep 30, 2024
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/bogo/Cargo.toml b/bogo/Cargo.toml
@@ -6,7 +6,6 @@ edition = "2021"
 [dependencies]
 base64 = "0.22"
 env_logger = "0.10" # 0.11 requires 1.71 MSRV even as a dev-dep (due to manifest features)
-pki-types = { package = "rustls-pki-types", version = "1.7" }
+pki-types = { package = "rustls-pki-types", version = "1.9", features = ["std"] }
 rustls = { path = "../rustls", features = ["aws_lc_rs", "fips", "ring", "tls12"] }
-rustls-pemfile = "2"
 rustls-post-quantum = { path = "../rustls-post-quantum" }
diff --git a/bogo/src/main.rs b/bogo/src/main.rs
@@ -5,11 +5,12 @@
 //
 
 use std::fmt::{Debug, Formatter};
-use std::io::{self, BufReader, Read, Write};
+use std::io::{self, Read, Write};
 use std::sync::Arc;
-use std::{env, fs, net, process, thread, time};
+use std::{env, net, process, thread, time};
 
 use base64::prelude::{Engine, BASE64_STANDARD};
+use pki_types::pem::PemObject;
 use pki_types::{CertificateDer, PrivateKeyDer, ServerName, UnixTime};
 use rustls::client::danger::{HandshakeSignatureValid, ServerCertVerified, ServerCertVerifier};
 use rustls::client::{
@@ -263,24 +264,6 @@ impl SelectedProvider {
     }
 }
 
-fn load_cert(filename: &str) -> Vec<CertificateDer<'static>> {
-    let certfile = fs::File::open(filename).expect("cannot open certificate file");
-    let mut reader = BufReader::new(certfile);
-    rustls_pemfile::certs(&mut reader)
-        .map(|result| result.unwrap())
-        .collect()
-}
-
-fn load_key(filename: &str) -> PrivateKeyDer<'static> {
-    let keyfile = fs::File::open(filename).expect("cannot open private key file");
-    let mut reader = BufReader::new(keyfile);
-    let mut keys = rustls_pemfile::pkcs8_private_keys(&mut reader)
-        .map(|result| result.unwrap())
-        .collect::<Vec<_>>();
-    assert!(keys.len() == 1);
-    keys.pop().unwrap().into()
-}
-
 fn load_root_certs(filename: &str) -> Arc<RootCertStore> {
     let mut roots = RootCertStore::empty();
 
@@ -295,7 +278,11 @@ fn load_root_certs(filename: &str) -> Arc<RootCertStore> {
         filename => filename,
     };
 
-    roots.add_parsable_certificates(load_cert(filename));
+    roots.add_parsable_certificates(
+        CertificateDer::pem_file_iter(filename)
+            .unwrap()
+            .map(|item| item.unwrap()),
+    );
     Arc::new(roots)
 }
 
@@ -611,8 +598,11 @@ fn make_server_cfg(opts: &Options) -> Arc<ServerConfig> {
             server::WebPkiClientVerifier::no_client_auth()
         };
 
-    let cert = load_cert(&opts.cert_file);
-    let key = load_key(&opts.key_file);
+    let cert = CertificateDer::pem_file_iter(&opts.cert_file)
+        .unwrap()
+        .map(|cert| cert.unwrap())
+        .collect::<Vec<_>>();
+    let key = PrivateKeyDer::from_pem_file(&opts.key_file).unwrap();
 
     let mut provider = opts.provider.clone();
 
@@ -795,8 +785,11 @@ fn make_client_cfg(opts: &Options) -> Arc<ClientConfig> {
         .with_custom_certificate_verifier(Arc::new(DummyServerAuth::new(&opts.trusted_cert_file)));
 
     let mut cfg = if !opts.cert_file.is_empty() && !opts.key_file.is_empty() {
-        let cert = load_cert(&opts.cert_file);
-        let key = load_key(&opts.key_file);
+        let cert = CertificateDer::pem_file_iter(&opts.cert_file)
+            .unwrap()
+            .map(|item| item.unwrap())
+            .collect();
+        let key = PrivateKeyDer::from_pem_file(&opts.key_file).unwrap();
         cfg.with_client_auth_cert(cert, key)
             .unwrap()
     } else {

diff --git a/ci-bench/Cargo.toml b/ci-bench/Cargo.toml
@@ -13,10 +13,9 @@ byteorder = "1.4.3"
 clap = { version = "4.3.21", features = ["derive"] }
 fxhash = "0.2.1"
 itertools = "0.13"
-pki-types = { package = "rustls-pki-types", version = "1.4.1" }
+pki-types = { package = "rustls-pki-types", version = "1.9" }
 rayon = "1.7.0"
 rustls = { path = "../rustls", features = ["ring", "aws_lc_rs"] }
-rustls-pemfile = "2"
 
 [target.'cfg(not(target_env = "msvc"))'.dependencies]
 tikv-jemallocator = "0.6"

diff --git a/ci-bench/src/main.rs b/ci-bench/src/main.rs
@@ -1,5 +1,5 @@
 use std::collections::HashMap;
-use std::fs::{self, File};
+use std::fs::File;
 use std::hint::black_box;
 use std::io::{self, BufRead, BufReader, Write};
 use std::mem;
@@ -17,6 +17,8 @@ use rayon::iter::Either;
 use rayon::prelude::*;
 use rustls::client::Resumption;
 use rustls::crypto::{aws_lc_rs, ring, CryptoProvider, GetRandomFailed, SecureRandom};
+use rustls::pki_types::pem::PemObject;
+use rustls::pki_types::CertificateDer;
 use rustls::server::{NoServerSessionStorage, ServerSessionMemoryCache, WebPkiClientVerifier};
 use rustls::{
     CipherSuite, ClientConfig, ClientConnection, HandshakeKind, ProtocolVersion, RootCertStore,
@@ -502,10 +504,10 @@ impl ClientSideStepper<'_> {
     fn make_config(params: &BenchmarkParams, resume: ResumptionKind) -> Arc<ClientConfig> {
         assert_eq!(params.ciphersuite.version(), params.version);
         let mut root_store = RootCertStore::empty();
-        let mut rootbuf =
-            io::BufReader::new(fs::File::open(params.key_type.path_for("ca.cert")).unwrap());
         root_store.add_parsable_certificates(
-            rustls_pemfile::certs(&mut rootbuf).map(|result| result.unwrap()),
+            CertificateDer::pem_file_iter(params.key_type.path_for("ca.cert"))
+                .unwrap()
+                .map(|result| result.unwrap()),
         );
 
         let mut cfg = ClientConfig::builder_with_provider(

diff --git a/ci-bench/src/util.rs b/ci-bench/src/util.rs
@@ -1,5 +1,4 @@
-use std::{fs, io};
-
+use rustls::pki_types::pem::PemObject;
 use rustls::pki_types::{CertificateDer, PrivateKeyDer};
 
 #[derive(PartialEq, Clone, Copy, Debug)]
@@ -19,19 +18,14 @@ impl KeyType {
     }
 
     pub(crate) fn get_chain(&self) -> Vec<CertificateDer<'static>> {
-        rustls_pemfile::certs(&mut io::BufReader::new(
-            fs::File::open(self.path_for("end.fullchain")).unwrap(),
-        ))
-        .map(|result| result.unwrap())
-        .collect()
+        CertificateDer::pem_file_iter(self.path_for("end.fullchain"))
+            .unwrap()
+            .map(|result| result.unwrap())
+            .collect()
     }
 
     pub(crate) fn get_key(&self) -> PrivateKeyDer<'static> {
-        rustls_pemfile::private_key(&mut io::BufReader::new(
-            fs::File::open(self.path_for("end.key")).unwrap(),
-        ))
-        .unwrap()
-        .unwrap()
+        PrivateKeyDer::from_pem_file(self.path_for("end.key")).unwrap()
     }
 }
 

diff --git a/examples/Cargo.toml b/examples/Cargo.toml
@@ -13,10 +13,9 @@ env_logger = "0.10" # 0.11 requires 1.71 MSRV even as a dev-dep (due to manifest
 hickory-resolver = { version = "0.25.0-alpha.1", features = ["dns-over-https-rustls", "webpki-roots"] }
 log = { version = "0.4.4" }
 mio = { version = "0.8", features = ["net", "os-poll"] }
-pki-types = { package = "rustls-pki-types", version = "1", features = ["std"] }
+pki-types = { package = "rustls-pki-types", version = "1.9", features = ["std"] }
 rcgen = { version = "0.13", features = ["pem", "aws_lc_rs"], default-features = false }
 rustls = { path = "../rustls", features = [ "logging" ]}
-rustls-pemfile = "2"
 serde = "1.0"
 serde_derive = "1.0"
 tokio = { version = "1.34.0", features = ["io-util", "macros", "net", "rt"]}

diff --git a/examples/src/bin/ech-client.rs b/examples/src/bin/ech-client.rs
@@ -35,7 +35,8 @@ use rustls::client::{EchConfig, EchGreaseConfig, EchStatus};
 use rustls::crypto::aws_lc_rs;
 use rustls::crypto::aws_lc_rs::hpke::ALL_SUPPORTED_SUITES;
 use rustls::crypto::hpke::Hpke;
-use rustls::pki_types::ServerName;
+use rustls::pki_types::pem::PemObject;
+use rustls::pki_types::{CertificateDer, ServerName};
 use rustls::RootCertStore;
 
 fn main() {
@@ -78,10 +79,10 @@ fn main() {
     let root_store = match args.cafile {
         Some(file) => {
             let mut root_store = RootCertStore::empty();
-            let certfile = fs::File::open(file).expect("Cannot open CA file");
-            let mut reader = BufReader::new(certfile);
             root_store.add_parsable_certificates(
-                rustls_pemfile::certs(&mut reader).map(|result| result.unwrap()),
+                CertificateDer::pem_file_iter(file)
+                    .expect("Cannot open CA file")
+                    .map(|result| result.unwrap()),
             );
             root_store
         }

diff --git a/examples/src/bin/simple_0rtt_client.rs b/examples/src/bin/simple_0rtt_client.rs
@@ -9,13 +9,14 @@
 //! Note that `unwrap()` is used to deal with networking errors; this is not something
 //! that is sensible outside of example code.
 
+use std::env;
 use std::io::{BufRead, BufReader, Write};
 use std::net::TcpStream;
 use std::str::FromStr;
 use std::sync::Arc;
-use std::{env, fs};
 
-use rustls::pki_types::ServerName;
+use rustls::pki_types::pem::PemObject;
+use rustls::pki_types::{CertificateDer, ServerName};
 use rustls::RootCertStore;
 
 fn start_connection(config: &Arc<rustls::ClientConfig>, domain_name: &str, port: u16) {
@@ -82,10 +83,10 @@ fn main() {
 
     let mut root_store = RootCertStore::empty();
     if let Some(cafile) = args.next() {
-        let certfile = fs::File::open(cafile).expect("Cannot open CA file");
-        let mut reader = BufReader::new(certfile);
         root_store.add_parsable_certificates(
-            rustls_pemfile::certs(&mut reader).map(|result| result.unwrap()),
+            CertificateDer::pem_file_iter(cafile)
+                .expect("Cannot open CA file")
+                .map(|result| result.unwrap()),
         );
     } else {
         root_store.extend(

diff --git a/examples/src/bin/simple_0rtt_server.rs b/examples/src/bin/simple_0rtt_server.rs
@@ -13,12 +13,14 @@
 //! that is sensible outside of example code.
 
 use std::error::Error as StdError;
-use std::fs::File;
-use std::io::{BufReader, Read, Write};
+use std::io::{Read, Write};
 use std::net::TcpListener;
 use std::sync::Arc;
 use std::{env, io};
 
+use rustls::pki_types::pem::PemObject;
+use rustls::pki_types::{CertificateDer, PrivateKeyDer};
+
 fn main() -> Result<(), Box<dyn StdError>> {
     let mut args = env::args();
     args.next();
@@ -29,11 +31,12 @@ fn main() -> Result<(), Box<dyn StdError>> {
         .next()
         .expect("missing private key file argument");
 
-    let certs = rustls_pemfile::certs(&mut BufReader::new(&mut File::open(cert_file)?))
-        .collect::<Result<Vec<_>, _>>()?;
+    let certs = CertificateDer::pem_file_iter(cert_file)
+        .expect("cannot open certificate file")
+        .map(|cert| cert.unwrap())
+        .collect::<Vec<_>>();
     let private_key =
-        rustls_pemfile::private_key(&mut BufReader::new(&mut File::open(private_key_file)?))?
-            .unwrap();
+        PrivateKeyDer::from_pem_file(private_key_file).expect("cannot open private key file");
 
     let mut config = rustls::ServerConfig::builder()
         .with_no_client_auth()

diff --git a/examples/src/bin/simpleserver.rs b/examples/src/bin/simpleserver.rs
@@ -9,11 +9,13 @@
 
 use std::env;
 use std::error::Error as StdError;
-use std::fs::File;
-use std::io::{BufReader, Read, Write};
+use std::io::{Read, Write};
 use std::net::TcpListener;
 use std::sync::Arc;
 
+use rustls::pki_types::pem::PemObject;
+use rustls::pki_types::{CertificateDer, PrivateKeyDer};
+
 fn main() -> Result<(), Box<dyn StdError>> {
     let mut args = env::args();
     args.next();
@@ -24,11 +26,11 @@ fn main() -> Result<(), Box<dyn StdError>> {
         .next()
         .expect("missing private key file argument");
 
-    let certs = rustls_pemfile::certs(&mut BufReader::new(&mut File::open(cert_file)?))
-        .collect::<Result<Vec<_>, _>>()?;
-    let private_key =
-        rustls_pemfile::private_key(&mut BufReader::new(&mut File::open(private_key_file)?))?
-            .unwrap();
+    let certs = CertificateDer::pem_file_iter(cert_file)
+        .unwrap()
+        .map(|cert| cert.unwrap())
+        .collect();
+    let private_key = PrivateKeyDer::from_pem_file(private_key_file).unwrap();
     let config = rustls::ServerConfig::builder()
         .with_no_client_auth()
         .with_single_cert(certs, private_key)?;