Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for rustls-platform-verifier #2286

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

djc
Copy link
Contributor

@djc djc commented May 12, 2024

Fixes #2159. Consider that issue for more context.

@seanmonstar
Copy link
Owner

CI failure seems legit, looks like a type no longer implements the needed ServerCertVerifier. Does it no longer need to be Arc? Or something else?

@djc djc force-pushed the rustls-platform-verifier branch 3 times, most recently from 4a982ef to ad5e037 Compare May 14, 2024 11:03
#[cfg(feature = "rustls-tls-platform-verifier")]
let verifier = Arc::new(rustls_platform_verifier::Verifier::new());
#[cfg(not(feature = "rustls-tls-platform-verifier"))]
let verifier =
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The WebPkiServerVerifierBuilder::build() step yields Err if no roots have been passed in, meaning that a whole bunch of tests now panic when testing under rustls-tls-manual-roots (without specifying any roots). I've just disabled these tests when testing with this particular feature, which seems like the easiest approach?

Alternatively, we could have slightly more complex setup here which would avoid the error at builder time, but failing earlier actually seems desirable to me.

@djc djc force-pushed the rustls-platform-verifier branch from ad5e037 to afb4788 Compare May 14, 2024 11:06
@djc
Copy link
Contributor Author

djc commented May 21, 2024

@seanmonstar friendly ping, want to take another look? (Let me know if you'd prefer fewer reminders.)

@@ -1,4 +1,4 @@
#![cfg(not(target_arch = "wasm32"))]
#![cfg(not(any(target_arch = "wasm32", feature = "rustls-tls-manual-roots")))]
Copy link
Owner

@seanmonstar seanmonstar May 21, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hm, I guess I haven't fully internalized the difference. Looking at the rest of this test file, it seems to just make a "normal" client. Why would that fail?

Is it that if only manual roots are enabled, but none are added, that's an error?

And, what if other rustls features are enabled too? It should work, then?

Copy link
Contributor Author

@djc djc May 21, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hm, I guess I haven't fully internalized the difference. Looking at the rest of this test file, it seems to just make a "normal" client. Why would that fail?

Is it that if only manual roots are enabled, but none are added, that's an error?

Yes, that's the problem.

And, what if other rustls features are enabled too? It should work, then?

Because we can't use the rustls-platform-verifier in conjunction with otherwise-supplied roots on many platforms (only on non-Apple Unix, see rustls/rustls-platform-verifier#58), this PR chooses to skip gathering roots on all platforms in favor of exclusively using the platform verifier (which comes down to using rustls-native certs on non-Apple Unix).

Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This seems to disrupt the additivity of the features. If anywhere in the dependency tree enables this feature, everywhere else that was depending on detecting native roots will now start erroring. That doesn't sound like a great experience for users.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, as discussed previously in #2159. Do you want to block this addition on rustls/rustls-platform-verifier#58, which would enable making it additive?

Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thinking from the point of view of users, I believe that is something they would expect to work. So yea, that seems like a requirement.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Add support for rustls-platform-verifier
2 participants