harald/teepot
1
0
Fork 0
mirror of https://github.com/matter-labs/teepot.git synced 2025-07-24 00:04:47 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

fix(teepot-vault): use ring as CryptoProvider for rustls

Browse source 
New `rustls` needs global install of default `CryptoProvider`.

Signed-off-by: Harald Hoyer <harald@matterlabs.dev>
This commit is contained in:
Harald Hoyer 2025-02-28 14:14:57 +01:00
parent 0a73ed5012
commit d6061c35a8
Signed by: harald
GPG key ID: F519A1143B3FBE32
6 changed files with 70 additions and 52 deletions
Download patch file Download diff file Expand all files Collapse all files

42
bin/tee-vault-unseal/src/main.rs
View file

@ -1,5 +1,5 @@
// SPDX-License-Identifier: Apache-2.0
// Copyright (c) 2023-2024 Matter Labs
// Copyright (c) 2023-2025 Matter Labs
//! Server to initialize and unseal the Vault TEE.
@ -9,27 +9,33 @@
mod init;
mod unseal;
use actix_web::rt::time::sleep;
use actix_web::web::Data;
use actix_web::{web, App, HttpServer};
use actix_web::{rt::time::sleep, web, web::Data, App, HttpServer};
use anyhow::{bail, Context, Result};
use awc::Client;
use clap::Parser;
use init::post_init;
use rustls::ServerConfig;
use std::fmt::Debug;
use std::io::Read;
use std::net::Ipv6Addr;
use std::path::PathBuf;
use std::sync::{Arc, RwLock};
use std::time::Duration;
use teepot::client::{AttestationArgs, TeeConnection};
use teepot::json::http::{Init, Unseal};
use teepot::json::secrets::AdminConfig;
use teepot::server::attestation::{get_quote_and_collateral, VaultAttestationArgs};
use teepot::server::new_json_cfg;
use teepot::server::pki::make_self_signed_cert;
use teepot::sgx::{parse_tcb_levels, EnumSet, TcbLevel};
use std::{
fmt::Debug,
io::Read,
net::Ipv6Addr,
path::PathBuf,
sync::{Arc, RwLock},
time::Duration,
};
use teepot::{
client::{AttestationArgs, TeeConnection},
json::{
http::{Init, Unseal},
secrets::AdminConfig,
},
server::{
attestation::{get_quote_and_collateral, VaultAttestationArgs},
new_json_cfg,
pki::make_self_signed_cert,
},
sgx::{parse_tcb_levels, EnumSet, TcbLevel},
};
use tracing::{error, info};
use tracing_log::LogTracer;
use tracing_subscriber::{fmt, prelude::*, EnvFilter, Registry};
@ -136,6 +142,8 @@ async fn main() -> Result<()> {
let (report_data, cert_chain, priv_key) = make_self_signed_cert("CN=localhost", None)?;
let _ = rustls::crypto::ring::default_provider().install_default();
// init server config builder with safe defaults
let config = ServerConfig::builder()
.with_no_client_auth()