From ab7cd16dbcfa502b1f4c51841f19f2b9a9631a15 Mon Sep 17 00:00:00 2001
From: Jeron Lau <jeron.lau@smartthings.com>
Date: Tue, 22 Aug 2023 16:25:19 -0500
Subject: [PATCH] Update tokio-rustls and webpki-roots

---
 actix-tls/Cargo.toml            |  6 ++--
 actix-tls/src/connect/rustls.rs | 49 +++++++++++++++++----------------
 2 files changed, 28 insertions(+), 27 deletions(-)

diff --git a/actix-tls/Cargo.toml b/actix-tls/Cargo.toml
index d65d675b..07723e0a 100755
--- a/actix-tls/Cargo.toml
+++ b/actix-tls/Cargo.toml
@@ -58,8 +58,8 @@ tls-openssl = { package = "openssl", version = "0.10.48", optional = true }
 tokio-openssl = { version = "0.6", optional = true }
 
 # rustls
-tokio-rustls = { version = "0.23", optional = true }
-webpki-roots = { version = "0.22", optional = true }
+tokio-rustls = { version = "0.24", optional = true }
+webpki-roots = { version = "0.25", optional = true }
 
 # native-tls
 tokio-native-tls = { version = "0.3", optional = true }
@@ -74,7 +74,7 @@ futures-util = { version = "0.3.17", default-features = false, features = ["sink
 log = "0.4"
 rcgen = "0.10"
 rustls-pemfile = "1"
-tokio-rustls = { version = "0.23", features = ["dangerous_configuration"] }
+tokio-rustls = { version = "0.24", features = ["dangerous_configuration"] }
 trust-dns-resolver = "0.22"
 
 [[example]]
diff --git a/actix-tls/src/connect/rustls.rs b/actix-tls/src/connect/rustls.rs
index 5706047d..d33e337b 100644
--- a/actix-tls/src/connect/rustls.rs
+++ b/actix-tls/src/connect/rustls.rs
@@ -35,14 +35,14 @@ pub mod reexports {
 /// Returns standard root certificates from `webpki-roots` crate as a rustls certificate store.
 pub fn webpki_roots_cert_store() -> RootCertStore {
     let mut root_certs = RootCertStore::empty();
-    for cert in TLS_SERVER_ROOTS.0 {
+    for cert in TLS_SERVER_ROOTS {
         let cert = OwnedTrustAnchor::from_subject_spki_name_constraints(
             cert.subject,
             cert.spki,
             cert.name_constraints,
         );
         let certs = vec![cert].into_iter();
-        root_certs.add_server_trust_anchors(certs);
+        root_certs.add_trust_anchors(certs);
     }
     root_certs
 }
@@ -106,24 +106,25 @@ where
         let (stream, connection) = connection.replace_io(());
 
         match ServerName::try_from(connection.hostname()) {
-            Ok(host) => ConnectFut::Future {
-                connect: RustlsTlsConnector::from(self.connector.clone()).connect(host, stream),
+            Ok(host) => ConnectFut {
+                connect: Some(
+                    RustlsTlsConnector::from(self.connector.clone()).connect(host, stream),
+                ),
                 connection: Some(connection),
             },
-            Err(_) => ConnectFut::InvalidDns,
+            Err(_) => ConnectFut {
+                connect: None,
+                connection: None,
+            },
         }
     }
 }
 
 /// Connect future for Rustls service.
 #[doc(hidden)]
-pub enum ConnectFut<R, IO> {
-    /// See issue <https://github.com/briansmith/webpki/issues/54>
-    InvalidDns,
-    Future {
-        connect: RustlsConnect<IO>,
-        connection: Option<Connection<R, ()>>,
-    },
+pub struct ConnectFut<R, IO> {
+    connect: Option<RustlsConnect<IO>>,
+    connection: Option<Connection<R, ()>>,
 }
 
 impl<R, IO> Future for ConnectFut<R, IO>
@@ -131,19 +132,19 @@ where
     R: Host,
     IO: ActixStream,
 {
-    type Output = Result<Connection<R, AsyncTlsStream<IO>>, io::Error>;
+    type Output = io::Result<Connection<R, AsyncTlsStream<IO>>>;
 
     fn poll(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Self::Output> {
-        match self.get_mut() {
-            Self::InvalidDns => Poll::Ready(Err(
-                io::Error::new(io::ErrorKind::Other, "rustls currently only handles hostname-based connections. See https://github.com/briansmith/webpki/issues/54")
-            )),
-            Self::Future { connect, connection } => {
-                let stream = ready!(Pin::new(connect).poll(cx))?;
-                let connection = connection.take().unwrap();
-                trace!("TLS handshake success: {:?}", connection.hostname());
-                Poll::Ready(Ok(connection.replace_io(stream).1))
-            }
-        }
+        let Self {
+            connect,
+            connection,
+        } = self.get_mut();
+        let Some(connect) = connect else {
+            return Poll::Ready(Err(io::Error::new(io::ErrorKind::InvalidInput, "actix-tls currently only handles hostname-based connections")));
+        };
+        let stream = ready!(Pin::new(connect).poll(cx))?;
+        let connection = connection.take().unwrap();
+        trace!("TLS handshake success: {:?}", connection.hostname());
+        Poll::Ready(Ok(connection.replace_io(stream).1))
     }
 }