mirror of
https://github.com/aphrody-labs/mullvadvpn-app.git
synced 2026-10-13 22:10:39 +00:00
Linus
6a303759cd
Four crates each built their own rustls configuration for the same endpoints, and each carried its own copy of the pinned root certificate, two of them reaching outside their package directory to include it. The parameters that make a connection to Mullvad infrastructure safe were therefore stated in several places and could drift apart, which is how the Android release tool ended up fetching metadata unpinned for as long as it did. Move the certificate and the configuration into a crate that owns them, and have call sites name a destination instead of assembling security parameters. SNI is now disabled for the version metadata fetchers as well. Both hosts they contact serve a usable certificate without it.
23 lines
687 B
TOML
23 lines
687 B
TOML
[package]
|
|
name = "am-i-mullvad-client"
|
|
edition.workspace = true
|
|
rust-version.workspace = true
|
|
description = "Async client for the am.i.mullvad.net geoip endpoint"
|
|
repository.workspace = true
|
|
license.workspace = true
|
|
|
|
[dependencies]
|
|
bytes = { workspace = true }
|
|
http-body-util = { workspace = true }
|
|
hyper = { workspace = true }
|
|
hyper-rustls = { workspace = true, features = ["aws-lc-rs", "http2"] }
|
|
hyper-util = { workspace = true }
|
|
mullvad-tls-client = { path = "../../mullvad-tls-client" }
|
|
serde = { workspace = true, features = ["derive"] }
|
|
serde_json = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
tokio = { workspace = true, features = ["time"] }
|
|
|
|
[lints]
|
|
workspace = true
|