state: enable mTLS on the client side

Cargo.toml

@@ -5,14 +5,18 @@ edition = "2024"
 
 [dependencies]
 anyhow = "1.0.100"
+asn1 = "0.23.1"
 bytes = "1.11.0"
 chrono = "0.4.43"
 clap = { version = "4.5.57", features = ["derive", "string"] }
+cryptoki = "0.12.0"
 fast-socks5 = "1.0.0"
 hyper = { version = "1.8.1", features = ["full"] }
 nix = { version = "0.31.1", features = ["socket", "uio", "net"] }
 peekable = { version = "0.4.1", features = ["tokio"] }
 regex = "1.12.2"
+rustls-pemfile = "2.2.0"
+rustls-webpki = "0.103.9"
 serde = { version = "1.0.228", features = ["derive"] }
 serde_json = "1.0.149"
 serde_with = { version = "3.16.1", features = ["chrono"] }
@@ -24,3 +28,4 @@ tracing = "0.1.44"
 tracing-subscriber = { version = "0.3.22", features = ["env-filter"] }
 varlink = { version = "13.0.0", features = ["tokio"] }
 winnow = "0.7.14"
+x509-certificate = "0.25.0"

src/config.rs

@@ -29,7 +29,9 @@ pub struct EscapeSettings {
     pub cacert_file: Option<PathBuf>,
     pub tls_privkey: Option<PathBuf>,
     pub tls_certificate: Option<PathBuf>,
-    pub pkcs11_uri: Option<String>,
+
+    /// If set, PKCS#11 is used to resolve client certificates automatically.
+    pub pkcs11_library: Option<PathBuf>,
 }
 
 #[serde_with::serde_as]
@@ -59,7 +61,10 @@ pub struct Settings {
 
     /// Settings for the workload socket (e.g. this is where clients connect to, e.g. Firefox or
     /// another instance of this proxy via routing)
+    /// If this is unset, there's no TLS on incoming connections.
+    /// Use this when you are binding a local daemon.
     pub listener: Option<ListenSettings>,
+
     /// Settings for connecting to other proxy instances or websites via client certificate
     /// authentication.
     pub escaper: Option<EscapeSettings>,

src/main.rs

@@ -14,6 +14,7 @@ mod proxy;
 mod rpc;
 mod state;
 mod systemd;
+mod pkcs11;
 
 #[derive(Parser)]
 #[command(name = "Portail")]