Rel 0.23 root hints

rustls-test/src/lib.rs

@@ -30,8 +30,8 @@ use rustls::internal::msgs::codec::{Codec, Reader};
 use rustls::internal::msgs::message::{Message, OutboundOpaqueMessage, PlainMessage};
 use rustls::pki_types::pem::PemObject;
 use rustls::pki_types::{
-    CertificateDer, CertificateRevocationListDer, PrivateKeyDer, PrivatePkcs8KeyDer, ServerName,
-    SubjectPublicKeyInfoDer, UnixTime,
+    CertificateDer, CertificateRevocationListDer, DnsName, PrivateKeyDer, PrivatePkcs8KeyDer,
+    ServerName, SubjectPublicKeyInfoDer, UnixTime,
 };
 use rustls::server::danger::{ClientCertVerified, ClientCertVerifier};
 use rustls::server::{
@@ -1331,8 +1331,8 @@ impl ClientCertVerifier for MockClientVerifier {
         self.mandatory
     }
 
-    fn root_hint_subjects(&self) -> &[DistinguishedName] {
-        &self.subjects
+    fn root_hint_subjects(&self, _: &Option<DnsName<'static>>) -> Arc<[DistinguishedName]> {
+        Arc::from(self.subjects.clone())
     }
 
     fn verify_client_cert(

rustls/src/client/hs.rs

@@ -239,7 +239,7 @@ fn emit_client_hello_for_retry(
 
     if supported_versions.tls13 {
         if let Some(cas_extension) = config.verifier.root_hint_subjects() {
-            exts.certificate_authority_names = Some(cas_extension.to_owned());
+            exts.certificate_authority_names = Some(cas_extension.to_vec());
         }
     }
 

rustls/src/client/test.rs

@@ -493,8 +493,8 @@ mod tests {
     struct ServerVerifierWithAuthorityNames(Vec<DistinguishedName>);
 
     impl ServerCertVerifier for ServerVerifierWithAuthorityNames {
-        fn root_hint_subjects(&self) -> Option<&[DistinguishedName]> {
-            Some(self.0.as_slice())
+        fn root_hint_subjects(&self) -> Option<Arc<[DistinguishedName]>> {
+            Some(Arc::from(self.0.clone()))
         }
 
         #[cfg_attr(coverage_nightly, coverage(off))]

rustls/src/server/tls12.rs

@@ -34,7 +34,7 @@ use crate::tls12::{self, ConnectionSecrets, Tls12CipherSuite};
 use crate::{ConnectionTrafficSecrets, verify};
 
 mod client_hello {
-    use pki_types::CertificateDer;
+    use pki_types::{CertificateDer, DnsName};
 
     use super::*;
     use crate::common_state::KxState;
@@ -210,7 +210,7 @@ mod client_hello {
                 server_key.get_key(),
                 &self.randoms,
             )?;
-            let doing_client_auth = emit_certificate_req(&mut flight, &self.config)?;
+            let doing_client_auth = emit_certificate_req(&mut flight, &self.config, &cx.data.sni)?;
             emit_server_hello_done(&mut flight);
 
             flight.finish(cx.common);
@@ -400,6 +400,7 @@ mod client_hello {
     fn emit_certificate_req(
         flight: &mut HandshakeFlightTls12<'_>,
         config: &ServerConfig,
+        server_name: &Option<DnsName<'static>>,
     ) -> Result<bool, Error> {
         let client_auth = &config.verifier;
 
@@ -411,7 +412,7 @@ mod client_hello {
 
         let names = config
             .verifier
-            .root_hint_subjects()
+            .root_hint_subjects(server_name)
             .to_vec();
 
         let cr = CertificateRequestPayload {

rustls/src/server/tls13.rs

@@ -38,6 +38,8 @@ use crate::tls13::{
 use crate::{ConnectionTrafficSecrets, compress, rand, verify};
 
 mod client_hello {
+    use pki_types::DnsName;
+
     use super::*;
     use crate::compress::CertCompressor;
     use crate::crypto::SupportedKxGroup;
@@ -378,7 +380,8 @@ mod client_hello {
             )?;
 
             let doing_client_auth = if full_handshake {
-                let client_auth = emit_certificate_req_tls13(&mut flight, &self.config)?;
+                let client_auth =
+                    emit_certificate_req_tls13(&mut flight, &self.config, &cx.data.sni)?;
 
                 if let Some(compressor) = cert_compressor {
                     emit_compressed_certificate_tls13(
@@ -693,6 +696,7 @@ mod client_hello {
     fn emit_certificate_req_tls13(
         flight: &mut HandshakeFlightTls13<'_>,
         config: &ServerConfig,
+        server_name: &Option<DnsName<'static>>,
     ) -> Result<bool, Error> {
         if !config.verifier.offer_client_auth() {
             return Ok(false);
@@ -715,7 +719,11 @@ mod client_hello {
                             .collect(),
                     ),
                 },
-                authority_names: match config.verifier.root_hint_subjects() {
+                authority_names: match config
+                    .verifier
+                    .root_hint_subjects(server_name)
+                    .as_ref()
+                {
                     &[] => None,
                     authorities => Some(authorities.to_vec()),
                 },

rustls/src/verify.rs

@@ -1,7 +1,8 @@
+use alloc::sync::Arc;
 use alloc::vec::Vec;
 use core::fmt::Debug;
 
-use pki_types::{CertificateDer, ServerName, UnixTime};
+use pki_types::{CertificateDer, DnsName, ServerName, UnixTime};
 
 use crate::enums::SignatureScheme;
 use crate::error::{Error, InvalidMessage};
@@ -150,7 +151,7 @@ pub trait ServerCertVerifier: Debug + Send + Sync {
     /// Note that this is only applicable to TLS 1.3.
     ///
     /// [`certificate_authorities`]: https://datatracker.ietf.org/doc/html/rfc8446#section-4.2.4
-    fn root_hint_subjects(&self) -> Option<&[DistinguishedName]> {
+    fn root_hint_subjects(&self) -> Option<Arc<[DistinguishedName]>> {
         None
     }
 }
@@ -200,7 +201,10 @@ pub trait ClientCertVerifier: Debug + Send + Sync {
     /// [RFC 5280 A.1]: https://www.rfc-editor.org/rfc/rfc5280#appendix-A.1
     /// [`CertificateRequest`]: https://datatracker.ietf.org/doc/html/rfc8446#section-4.3.2
     /// [`certificate_authorities`]: https://datatracker.ietf.org/doc/html/rfc8446#section-4.2.4
-    fn root_hint_subjects(&self) -> &[DistinguishedName];
+    fn root_hint_subjects(
+        &self,
+        server_name: &Option<DnsName<'static>>,
+    ) -> Arc<[DistinguishedName]>;
 
     /// Verify the end-entity certificate `end_entity` is valid, acceptable,
     /// and chains to at least one of the trust anchors trusted by
@@ -288,7 +292,7 @@ impl ClientCertVerifier for NoClientAuth {
         false
     }
 
-    fn root_hint_subjects(&self) -> &[DistinguishedName] {
+    fn root_hint_subjects(&self, _: &Option<DnsName<'static>>) -> Arc<[DistinguishedName]> {
         unimplemented!();
     }
 

rustls/src/webpki/client_verifier.rs

@@ -1,5 +1,6 @@
 use alloc::vec::Vec;
 
+use pki_types::DnsName;
 use pki_types::{CertificateDer, CertificateRevocationListDer, UnixTime};
 use webpki::{CertRevocationList, ExpirationPolicy, RevocationCheckDepth, UnknownStatusPolicy};
 
@@ -353,8 +354,8 @@ impl ClientCertVerifier for WebPkiClientVerifier {
         }
     }
 
-    fn root_hint_subjects(&self) -> &[DistinguishedName] {
-        &self.root_hint_subjects
+    fn root_hint_subjects(&self, _: &Option<DnsName<'static>>) -> Arc<[DistinguishedName]> {
+        Arc::from(self.root_hint_subjects.clone())
     }
 
     fn verify_client_cert(

rustls/tests/server_cert_verifier.rs

@@ -332,8 +332,8 @@ impl ServerCertVerifier for ServerCertVerifierWithCasExt {
         self.verifier.requires_raw_public_keys()
     }
 
-    fn root_hint_subjects(&self) -> Option<&[DistinguishedName]> {
+    fn root_hint_subjects(&self) -> Option<Arc<[DistinguishedName]>> {
         println!("ServerCertVerifierWithCasExt::root_hint_subjects() called!");
-        Some(&self.ca_names)
+        Some(Arc::from(self.ca_names.clone()))
     }
 }