feat: Add WebTransport protocol based on BiagioFesta/wtransport

Cargo.toml

@@ -64,6 +64,7 @@ members = [
     "transports/websocket-websys",
     "transports/websocket",
     "transports/webtransport-websys",
+    "transports/webtransport",
     "wasm-tests/webtransport-tests",
 ]
 resolver = "2"
@@ -111,6 +112,7 @@ libp2p-webrtc-utils = { version = "0.4.0", path = "misc/webrtc-utils" }
 libp2p-webrtc-websys = { version = "0.4.0", path = "transports/webrtc-websys" }
 libp2p-websocket = { version = "0.45.0", path = "transports/websocket" }
 libp2p-websocket-websys = { version = "0.5.0", path = "transports/websocket-websys" }
+libp2p-webtransport = { version = "0.1.0", path = "transports/webtransport" }
 libp2p-webtransport-websys = { version = "0.5.0", path = "transports/webtransport-websys" }
 libp2p-yamux = { version = "0.47.0", path = "muxers/yamux" }
 

transports/tls/CHANGELOG.md

@@ -1,3 +1,9 @@
+## 0.7.0
+
+- Added functions to generate a webtransport certificate,
+  to make webtransport server and client TLS configurations.
+  See [PR 5701](https://github.com/libp2p/rust-libp2p/pull/5701)
+
 ## 0.6.0
 
 <!-- Update to libp2p-core v0.43.0 -->

transports/tls/Cargo.toml

@@ -19,6 +19,7 @@ thiserror = { workspace = true }
 webpki = { version = "0.101.4", package = "rustls-webpki", features = ["std"] }
 x509-parser = "0.16.0"
 yasna = "0.5.2"
+time = "0.3"
 
 # Exposed dependencies. Breaking changes to these are breaking changes to us.
 [dependencies.rustls]

transports/tls/src/certificate.rs

@@ -24,6 +24,7 @@
 
 use std::sync::Arc;
 
+use ::time::OffsetDateTime;
 use libp2p_identity as identity;
 use libp2p_identity::PeerId;
 use x509_parser::{prelude::*, signature_algorithm::SignatureAlgorithm};
@@ -121,14 +122,62 @@ pub fn generate(
     Ok((rustls_certificate, rustls_key))
 }
 
+pub fn generate_with_validity_period(
+    identity_keypair: &identity::Keypair,
+    not_before: OffsetDateTime,
+    not_after: OffsetDateTime,
+) -> Result<
+    (
+        rustls::pki_types::CertificateDer<'static>,
+        rustls::pki_types::PrivateKeyDer<'static>,
+    ),
+    GenError,
+> {
+    // Keypair used to sign the certificate.
+    // SHOULD NOT be related to the host's key.
+    // Endpoints MAY generate a new key and certificate
+    // for every connection attempt, or they MAY reuse the same key
+    // and certificate for multiple connections.
+    let certificate_keypair = rcgen::KeyPair::generate(P2P_SIGNATURE_ALGORITHM)?;
+    let rustls_key = rustls::pki_types::PrivateKeyDer::from(
+        rustls::pki_types::PrivatePkcs8KeyDer::from(certificate_keypair.serialize_der()),
+    );
+
+    let certificate = {
+        let mut params = rcgen::CertificateParams::new(vec![]);
+        params.distinguished_name = rcgen::DistinguishedName::new();
+        params.custom_extensions.push(make_libp2p_extension(
+            identity_keypair,
+            &certificate_keypair,
+        )?);
+        params.alg = P2P_SIGNATURE_ALGORITHM;
+        params.key_pair = Some(certificate_keypair);
+        params.not_before = not_before;
+        params.not_after = not_after;
+        rcgen::Certificate::from_params(params)?
+    };
+
+    let rustls_certificate = rustls::pki_types::CertificateDer::from(certificate.serialize_der()?);
+
+    Ok((rustls_certificate, rustls_key))
+}
+
 /// Attempts to parse the provided bytes as a [`P2pCertificate`].
 ///
 /// For this to succeed, the certificate must contain the specified extension and the signature must
 /// match the embedded public key.
 pub fn parse<'a>(
     certificate: &'a rustls::pki_types::CertificateDer<'a>,
 ) -> Result<P2pCertificate<'a>, ParseError> {
-    let certificate = parse_unverified(certificate.as_ref())?;
+    parse_binary(certificate.as_ref())
+}
+
+/// Attempts to parse the provided bytes as a [`P2pCertificate`].
+///
+/// For this to succeed, the certificate must contain the specified extension and the signature must
+/// match the embedded public key.
+pub fn parse_binary(der_input: &[u8]) -> Result<P2pCertificate, ParseError> {
+    let certificate = parse_unverified(der_input)?;
 
     certificate.verify()?;