From 8ca1995761f2e989d1ebbdcbd70b89feaee233fe Mon Sep 17 00:00:00 2001 From: stormshield-gt Date: Fri, 5 Jun 2026 18:00:26 +0200 Subject: [PATCH 1/2] backport root_hint_subjects signature from rustls 0.24 --- rustls-test/src/lib.rs | 4 ++-- rustls/src/client/hs.rs | 2 +- rustls/src/client/test.rs | 4 ++-- rustls/src/server/tls13.rs | 6 +++++- rustls/src/verify.rs | 7 ++++--- rustls/src/webpki/client_verifier.rs | 4 ++-- rustls/tests/server_cert_verifier.rs | 4 ++-- 7 files changed, 18 insertions(+), 13 deletions(-) diff --git a/rustls-test/src/lib.rs b/rustls-test/src/lib.rs index e47b3502696..1b749417342 100644 --- a/rustls-test/src/lib.rs +++ b/rustls-test/src/lib.rs @@ -1331,8 +1331,8 @@ impl ClientCertVerifier for MockClientVerifier { self.mandatory } - fn root_hint_subjects(&self) -> &[DistinguishedName] { - &self.subjects + fn root_hint_subjects(&self) -> Arc<[DistinguishedName]> { + Arc::from(self.subjects.clone()) } fn verify_client_cert( diff --git a/rustls/src/client/hs.rs b/rustls/src/client/hs.rs index 12e885ee1c9..c17e3f4472b 100644 --- a/rustls/src/client/hs.rs +++ b/rustls/src/client/hs.rs @@ -239,7 +239,7 @@ fn emit_client_hello_for_retry( if supported_versions.tls13 { if let Some(cas_extension) = config.verifier.root_hint_subjects() { - exts.certificate_authority_names = Some(cas_extension.to_owned()); + exts.certificate_authority_names = Some(cas_extension.to_vec()); } } diff --git a/rustls/src/client/test.rs b/rustls/src/client/test.rs index e4051d61b67..064c4402fc9 100644 --- a/rustls/src/client/test.rs +++ b/rustls/src/client/test.rs @@ -493,8 +493,8 @@ mod tests { struct ServerVerifierWithAuthorityNames(Vec); impl ServerCertVerifier for ServerVerifierWithAuthorityNames { - fn root_hint_subjects(&self) -> Option<&[DistinguishedName]> { - Some(self.0.as_slice()) + fn root_hint_subjects(&self) -> Option> { + Some(Arc::from(self.0.clone())) } #[cfg_attr(coverage_nightly, coverage(off))] diff --git a/rustls/src/server/tls13.rs b/rustls/src/server/tls13.rs index b8b70e721a7..a99179fdbd7 100644 --- a/rustls/src/server/tls13.rs +++ b/rustls/src/server/tls13.rs @@ -715,7 +715,11 @@ mod client_hello { .collect(), ), }, - authority_names: match config.verifier.root_hint_subjects() { + authority_names: match config + .verifier + .root_hint_subjects() + .as_ref() + { &[] => None, authorities => Some(authorities.to_vec()), }, diff --git a/rustls/src/verify.rs b/rustls/src/verify.rs index 46731548ad7..6f95b5d909d 100644 --- a/rustls/src/verify.rs +++ b/rustls/src/verify.rs @@ -1,3 +1,4 @@ +use alloc::sync::Arc; use alloc::vec::Vec; use core::fmt::Debug; @@ -150,7 +151,7 @@ pub trait ServerCertVerifier: Debug + Send + Sync { /// Note that this is only applicable to TLS 1.3. /// /// [`certificate_authorities`]: https://datatracker.ietf.org/doc/html/rfc8446#section-4.2.4 - fn root_hint_subjects(&self) -> Option<&[DistinguishedName]> { + fn root_hint_subjects(&self) -> Option> { None } } @@ -200,7 +201,7 @@ pub trait ClientCertVerifier: Debug + Send + Sync { /// [RFC 5280 A.1]: https://www.rfc-editor.org/rfc/rfc5280#appendix-A.1 /// [`CertificateRequest`]: https://datatracker.ietf.org/doc/html/rfc8446#section-4.3.2 /// [`certificate_authorities`]: https://datatracker.ietf.org/doc/html/rfc8446#section-4.2.4 - fn root_hint_subjects(&self) -> &[DistinguishedName]; + fn root_hint_subjects(&self) -> Arc<[DistinguishedName]>; /// Verify the end-entity certificate `end_entity` is valid, acceptable, /// and chains to at least one of the trust anchors trusted by @@ -288,7 +289,7 @@ impl ClientCertVerifier for NoClientAuth { false } - fn root_hint_subjects(&self) -> &[DistinguishedName] { + fn root_hint_subjects(&self) -> Arc<[DistinguishedName]> { unimplemented!(); } diff --git a/rustls/src/webpki/client_verifier.rs b/rustls/src/webpki/client_verifier.rs index 060f0f77937..9e280d237e2 100644 --- a/rustls/src/webpki/client_verifier.rs +++ b/rustls/src/webpki/client_verifier.rs @@ -353,8 +353,8 @@ impl ClientCertVerifier for WebPkiClientVerifier { } } - fn root_hint_subjects(&self) -> &[DistinguishedName] { - &self.root_hint_subjects + fn root_hint_subjects(&self) -> Arc<[DistinguishedName]> { + Arc::from(self.root_hint_subjects.clone()) } fn verify_client_cert( diff --git a/rustls/tests/server_cert_verifier.rs b/rustls/tests/server_cert_verifier.rs index 30a5600d590..86eef7b1acd 100644 --- a/rustls/tests/server_cert_verifier.rs +++ b/rustls/tests/server_cert_verifier.rs @@ -332,8 +332,8 @@ impl ServerCertVerifier for ServerCertVerifierWithCasExt { self.verifier.requires_raw_public_keys() } - fn root_hint_subjects(&self) -> Option<&[DistinguishedName]> { + fn root_hint_subjects(&self) -> Option> { println!("ServerCertVerifierWithCasExt::root_hint_subjects() called!"); - Some(&self.ca_names) + Some(Arc::from(self.ca_names.clone())) } } From 3e6f12d0a7f83e09b2cc0ec48e9bb1c1bae80ea8 Mon Sep 17 00:00:00 2001 From: stormshield-gt Date: Mon, 8 Jun 2026 18:27:21 +0200 Subject: [PATCH 2/2] add server name to root hints trait, while waiting for quinn 2671 --- rustls-test/src/lib.rs | 6 +++--- rustls/src/server/tls12.rs | 7 ++++--- rustls/src/server/tls13.rs | 8 ++++++-- rustls/src/verify.rs | 9 ++++++--- rustls/src/webpki/client_verifier.rs | 3 ++- 5 files changed, 21 insertions(+), 12 deletions(-) diff --git a/rustls-test/src/lib.rs b/rustls-test/src/lib.rs index 1b749417342..1251acbdad4 100644 --- a/rustls-test/src/lib.rs +++ b/rustls-test/src/lib.rs @@ -30,8 +30,8 @@ use rustls::internal::msgs::codec::{Codec, Reader}; use rustls::internal::msgs::message::{Message, OutboundOpaqueMessage, PlainMessage}; use rustls::pki_types::pem::PemObject; use rustls::pki_types::{ - CertificateDer, CertificateRevocationListDer, PrivateKeyDer, PrivatePkcs8KeyDer, ServerName, - SubjectPublicKeyInfoDer, UnixTime, + CertificateDer, CertificateRevocationListDer, DnsName, PrivateKeyDer, PrivatePkcs8KeyDer, + ServerName, SubjectPublicKeyInfoDer, UnixTime, }; use rustls::server::danger::{ClientCertVerified, ClientCertVerifier}; use rustls::server::{ @@ -1331,7 +1331,7 @@ impl ClientCertVerifier for MockClientVerifier { self.mandatory } - fn root_hint_subjects(&self) -> Arc<[DistinguishedName]> { + fn root_hint_subjects(&self, _: &Option>) -> Arc<[DistinguishedName]> { Arc::from(self.subjects.clone()) } diff --git a/rustls/src/server/tls12.rs b/rustls/src/server/tls12.rs index d3dfa5c83dd..c466eb69cf0 100644 --- a/rustls/src/server/tls12.rs +++ b/rustls/src/server/tls12.rs @@ -34,7 +34,7 @@ use crate::tls12::{self, ConnectionSecrets, Tls12CipherSuite}; use crate::{ConnectionTrafficSecrets, verify}; mod client_hello { - use pki_types::CertificateDer; + use pki_types::{CertificateDer, DnsName}; use super::*; use crate::common_state::KxState; @@ -210,7 +210,7 @@ mod client_hello { server_key.get_key(), &self.randoms, )?; - let doing_client_auth = emit_certificate_req(&mut flight, &self.config)?; + let doing_client_auth = emit_certificate_req(&mut flight, &self.config, &cx.data.sni)?; emit_server_hello_done(&mut flight); flight.finish(cx.common); @@ -400,6 +400,7 @@ mod client_hello { fn emit_certificate_req( flight: &mut HandshakeFlightTls12<'_>, config: &ServerConfig, + server_name: &Option>, ) -> Result { let client_auth = &config.verifier; @@ -411,7 +412,7 @@ mod client_hello { let names = config .verifier - .root_hint_subjects() + .root_hint_subjects(server_name) .to_vec(); let cr = CertificateRequestPayload { diff --git a/rustls/src/server/tls13.rs b/rustls/src/server/tls13.rs index a99179fdbd7..981237de586 100644 --- a/rustls/src/server/tls13.rs +++ b/rustls/src/server/tls13.rs @@ -38,6 +38,8 @@ use crate::tls13::{ use crate::{ConnectionTrafficSecrets, compress, rand, verify}; mod client_hello { + use pki_types::DnsName; + use super::*; use crate::compress::CertCompressor; use crate::crypto::SupportedKxGroup; @@ -378,7 +380,8 @@ mod client_hello { )?; let doing_client_auth = if full_handshake { - let client_auth = emit_certificate_req_tls13(&mut flight, &self.config)?; + let client_auth = + emit_certificate_req_tls13(&mut flight, &self.config, &cx.data.sni)?; if let Some(compressor) = cert_compressor { emit_compressed_certificate_tls13( @@ -693,6 +696,7 @@ mod client_hello { fn emit_certificate_req_tls13( flight: &mut HandshakeFlightTls13<'_>, config: &ServerConfig, + server_name: &Option>, ) -> Result { if !config.verifier.offer_client_auth() { return Ok(false); @@ -717,7 +721,7 @@ mod client_hello { }, authority_names: match config .verifier - .root_hint_subjects() + .root_hint_subjects(server_name) .as_ref() { &[] => None, diff --git a/rustls/src/verify.rs b/rustls/src/verify.rs index 6f95b5d909d..c074690a0be 100644 --- a/rustls/src/verify.rs +++ b/rustls/src/verify.rs @@ -2,7 +2,7 @@ use alloc::sync::Arc; use alloc::vec::Vec; use core::fmt::Debug; -use pki_types::{CertificateDer, ServerName, UnixTime}; +use pki_types::{CertificateDer, DnsName, ServerName, UnixTime}; use crate::enums::SignatureScheme; use crate::error::{Error, InvalidMessage}; @@ -201,7 +201,10 @@ pub trait ClientCertVerifier: Debug + Send + Sync { /// [RFC 5280 A.1]: https://www.rfc-editor.org/rfc/rfc5280#appendix-A.1 /// [`CertificateRequest`]: https://datatracker.ietf.org/doc/html/rfc8446#section-4.3.2 /// [`certificate_authorities`]: https://datatracker.ietf.org/doc/html/rfc8446#section-4.2.4 - fn root_hint_subjects(&self) -> Arc<[DistinguishedName]>; + fn root_hint_subjects( + &self, + server_name: &Option>, + ) -> Arc<[DistinguishedName]>; /// Verify the end-entity certificate `end_entity` is valid, acceptable, /// and chains to at least one of the trust anchors trusted by @@ -289,7 +292,7 @@ impl ClientCertVerifier for NoClientAuth { false } - fn root_hint_subjects(&self) -> Arc<[DistinguishedName]> { + fn root_hint_subjects(&self, _: &Option>) -> Arc<[DistinguishedName]> { unimplemented!(); } diff --git a/rustls/src/webpki/client_verifier.rs b/rustls/src/webpki/client_verifier.rs index 9e280d237e2..a5309745d2a 100644 --- a/rustls/src/webpki/client_verifier.rs +++ b/rustls/src/webpki/client_verifier.rs @@ -1,5 +1,6 @@ use alloc::vec::Vec; +use pki_types::DnsName; use pki_types::{CertificateDer, CertificateRevocationListDer, UnixTime}; use webpki::{CertRevocationList, ExpirationPolicy, RevocationCheckDepth, UnknownStatusPolicy}; @@ -353,7 +354,7 @@ impl ClientCertVerifier for WebPkiClientVerifier { } } - fn root_hint_subjects(&self) -> Arc<[DistinguishedName]> { + fn root_hint_subjects(&self, _: &Option>) -> Arc<[DistinguishedName]> { Arc::from(self.root_hint_subjects.clone()) }