diff --git a/tokio-quiche/src/quic/mod.rs b/tokio-quiche/src/quic/mod.rs index a56df0c70c..d8dce2b70f 100644 --- a/tokio-quiche/src/quic/mod.rs +++ b/tokio-quiche/src/quic/mod.rs @@ -241,6 +241,16 @@ where } } + if let Some(verify_file) = ¶ms.settings.verify_file { + log::info!("setting up verify_file"; "verify_file"=>verify_file); + &client_config.quiche_config.load_verify_locations_from_file(verify_file); + } + + if let Some(verify_directory) = ¶ms.settings.verify_directory { + log::info!("setting up verify_directory"; "verify_directory"=>verify_directory); + &client_config.quiche_config.load_verify_locations_from_directory(verify_directory); + } + // Set the keylog file here for the same reason if let Some(keylog_file) = &client_config.keylog_file { log::info!("setting up keylog file"); @@ -291,7 +301,17 @@ where "O_NONBLOCK should be set for the listening socket" ); - let config = Config::new(params, socket.capabilities).into_io()?; + let mut config = Config::new(params, socket.capabilities).into_io()?; + + if let Some(verify_file) = ¶ms.settings.verify_file { + log::info!("setting up verify_file"; "verify_file"=>verify_file); + &config.quiche_config.load_verify_locations_from_file(verify_file); + } + + if let Some(verify_directory) = ¶ms.settings.verify_directory { + log::info!("setting up verify_directory"; "verify_directory"=>verify_directory); + &config.quiche_config.load_verify_locations_from_directory(verify_directory); + } let local_addr = socket.socket.local_addr()?; let socket_tx = Arc::new(socket.socket); diff --git a/tokio-quiche/src/settings/quic.rs b/tokio-quiche/src/settings/quic.rs index 5873d24271..deab8e9870 100644 --- a/tokio-quiche/src/settings/quic.rs +++ b/tokio-quiche/src/settings/quic.rs @@ -146,6 +146,26 @@ pub struct QuicSettings { /// Path to a directory where QLOG files will be saved. pub qlog_dir: Option, + /// Specifies a file where trusted CA certificates are stored for the + /// purposes of certificate verification. + /// + /// The content of `file` is parsed as a PEM-encoded certificate chain. + /// + /// See [`load_verify_locations_from_file()`] + /// + /// [`load_verify_locations_from_file()`]: https://docs.quic.tech/quiche/struct.Config.html#method.load_verify_locations_from_file + pub verify_file: Option, + + /// Specifies a directory where trusted CA certificates are stored for the + /// purposes of certificate verification. + /// + /// The content of `dir` a set of PEM-encoded certificate chains. + /// + /// See [`load_verify_locations_from_directory()`] + /// + /// [`load_verify_locations_from_directory()`]: https://docs.quic.tech/quiche/struct.Config.html#method.load_verify_locations_from_directory + pub verify_directory: Option, + /// Congestion control algorithm to use. /// /// For available values, see