v0.12.0: update to rustls 0.22, address breaking changes

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "rustls-ffi"
-version = "0.11.1"
+version = "0.12.0"
 authors = ["Jacob Hoffman-Andrews <[email protected]>"]
 license = "Apache-2.0/ISC/MIT"
 readme = "README-crates.io.md"
@@ -23,12 +23,11 @@ read_buf = ["rustls/read_buf"]
 
 [dependencies]
 # Keep in sync with RUSTLS_CRATE_VERSION in build.rs
-rustls = { version = "=0.22.0-alpha.6", features = [ "ring" ]}
-pki-types = { package = "rustls-pki-types", version = "0.2.3", features = ["std"] }
-webpki = { package = "rustls-webpki", version = "=0.102.0-alpha.8", features = ["std"] }
+rustls = { version = "0.22", features = [ "ring" ]}
+pki-types = { package = "rustls-pki-types", version = "1", features = ["std"] }
+webpki = { package = "rustls-webpki", version = "0.102.0", features = ["std"] }
 libc = "0.2"
-sct = "0.7"
-rustls-pemfile = "=2.0.0-alpha.2"
+rustls-pemfile = "2"
 log = "0.4.17"
 
 [lib]

build.rs

@@ -3,7 +3,7 @@ use std::io::Write;
 use std::{env, fs, path::PathBuf};
 
 // Keep in sync with Cargo.toml.
-const RUSTLS_CRATE_VERSION: &str = "0.22.0-alpha.6";
+const RUSTLS_CRATE_VERSION: &str = "0.22";
 
 fn main() {
     let out_dir = PathBuf::from(env::var_os("OUT_DIR").unwrap());

src/cipher.rs

@@ -675,7 +675,9 @@ impl rustls_client_cert_verifier {
 /// done configuring settings, call `rustls_web_pki_client_cert_verifier_builder_build`
 /// to turn it into a `rustls_client_cert_verifier`. This object is not safe
 /// for concurrent mutation.
-// TODO(@cpu): Add rustdoc link once available.
+///
+/// See <https://docs.rs/rustls/latest/rustls/server/struct.ClientCertVerifierBuilder.html>
+/// for more information.
 pub struct rustls_web_pki_client_cert_verifier_builder {
     // We use the opaque struct pattern to tell C about our types without
     // telling them what's inside.
@@ -943,7 +945,9 @@ impl rustls_web_pki_client_cert_verifier_builder {
 /// done configuring settings, call `rustls_web_pki_server_cert_verifier_builder_build`
 /// to turn it into a `rustls_server_cert_verifier`. This object is not safe
 /// for concurrent mutation.
-// TODO(@cpu): Add rustdoc link once available.
+///
+/// See <https://docs.rs/rustls/latest/rustls/client/struct.ServerCertVerifierBuilder.html>
+/// for more information.
 pub struct rustls_web_pki_server_cert_verifier_builder {
     // We use the opaque struct pattern to tell C about our types without
     // telling them what's inside.

src/client.rs

@@ -7,7 +7,7 @@ use std::sync::Arc;
 use libc::{c_char, size_t};
 use pki_types::{CertificateDer, UnixTime};
 use rustls::client::danger::{HandshakeSignatureValid, ServerCertVerified, ServerCertVerifier};
-use rustls::client::{ResolvesClientCert, WebPkiServerVerifier};
+use rustls::client::ResolvesClientCert;
 use rustls::crypto::ring::ALL_CIPHER_SUITES;
 use rustls::{
     sign::CertifiedKey, CertificateError, ClientConfig, ClientConnection, DigitallySignedStruct,
@@ -106,7 +106,9 @@ impl ServerCertVerifier for NoneVerifier {
     }
 
     fn supported_verify_schemes(&self) -> Vec<SignatureScheme> {
-        WebPkiServerVerifier::default_supported_verify_schemes()
+        rustls::crypto::ring::default_provider()
+            .signature_verification_algorithms
+            .supported_schemes()
     }
 }
 
@@ -123,7 +125,7 @@ impl rustls_client_config_builder {
     pub extern "C" fn rustls_client_config_builder_new() -> *mut rustls_client_config_builder {
         ffi_panic_boundary! {
             let builder = ClientConfigBuilder {
-                base: rustls::ClientConfig::builder().with_safe_defaults(),
+                base: rustls::ClientConfig::builder(),
                 verifier: Arc::new(NoneVerifier),
                 cert_resolver: None,
                 alpn_protocols: vec![],
@@ -179,7 +181,12 @@ impl rustls_client_config_builder {
                 }
             }
 
-            let result = rustls::ClientConfig::builder().with_cipher_suites(&cs_vec).with_safe_default_kx_groups().with_protocol_versions(&versions);
+            let provider = rustls::crypto::CryptoProvider{
+                cipher_suites: cs_vec,
+                ..rustls::crypto::ring::default_provider()
+            };
+            let result = rustls::ClientConfig::builder_with_provider(provider.into())
+                .with_protocol_versions(&versions);
             let base = match result {
                 Ok(new) => new,
                 Err(_) => return rustls_result::InvalidParameter,
@@ -293,7 +300,12 @@ impl ServerCertVerifier for Verifier {
         cert: &CertificateDer,
         dss: &DigitallySignedStruct,
     ) -> Result<HandshakeSignatureValid, Error> {
-        WebPkiServerVerifier::default_verify_tls12_signature(message, cert, dss)
+        rustls::crypto::verify_tls12_signature(
+            message,
+            cert,
+            dss,
+            &rustls::crypto::ring::default_provider().signature_verification_algorithms,
+        )
     }
 
     fn verify_tls13_signature(
@@ -302,11 +314,18 @@ impl ServerCertVerifier for Verifier {
         cert: &CertificateDer,
         dss: &DigitallySignedStruct,
     ) -> Result<HandshakeSignatureValid, Error> {
-        WebPkiServerVerifier::default_verify_tls13_signature(message, cert, dss)
+        rustls::crypto::verify_tls13_signature(
+            message,
+            cert,
+            dss,
+            &rustls::crypto::ring::default_provider().signature_verification_algorithms,
+        )
     }
 
     fn supported_verify_schemes(&self) -> Vec<SignatureScheme> {
-        WebPkiServerVerifier::default_supported_verify_schemes()
+        rustls::crypto::ring::default_provider()
+            .signature_verification_algorithms
+            .supported_schemes()
     }
 }
 

src/error.rs

@@ -241,6 +241,7 @@ impl rustls_result {
 /// inputs, including Ok, return rustls::Error::General.
 pub(crate) fn cert_result_to_error(result: rustls_result) -> rustls::Error {
     use rustls::Error::*;
+    use rustls::OtherError;
     use rustls_result::*;
     match result {
         CertEncodingBad => InvalidCertificate(CertificateError::BadEncoding),
@@ -257,7 +258,9 @@ pub(crate) fn cert_result_to_error(result: rustls_result) -> rustls::Error {
         CertApplicationVerificationFailure => {
             InvalidCertificate(CertificateError::ApplicationVerificationFailure)
         }
-        CertOtherError => InvalidCertificate(CertificateError::Other(Arc::from(Box::from("")))),
+        CertOtherError => InvalidCertificate(CertificateError::Other(OtherError(Arc::from(
+            Box::from(""),
+        )))),
         _ => rustls::Error::General("".into()),
     }
 }

src/rustls.h

@@ -301,6 +301,9 @@ typedef struct rustls_supported_ciphersuite rustls_supported_ciphersuite;
  * done configuring settings, call `rustls_web_pki_client_cert_verifier_builder_build`
  * to turn it into a `rustls_client_cert_verifier`. This object is not safe
  * for concurrent mutation.
+ *
+ * See <https://docs.rs/rustls/latest/rustls/server/struct.ClientCertVerifierBuilder.html>
+ * for more information.
  */
 typedef struct rustls_web_pki_client_cert_verifier_builder rustls_web_pki_client_cert_verifier_builder;
 
@@ -310,6 +313,9 @@ typedef struct rustls_web_pki_client_cert_verifier_builder rustls_web_pki_client
  * done configuring settings, call `rustls_web_pki_server_cert_verifier_builder_build`
  * to turn it into a `rustls_server_cert_verifier`. This object is not safe
  * for concurrent mutation.
+ *
+ * See <https://docs.rs/rustls/latest/rustls/client/struct.ServerCertVerifierBuilder.html>
+ * for more information.
  */
 typedef struct rustls_web_pki_server_cert_verifier_builder rustls_web_pki_server_cert_verifier_builder;
 

src/server.rs

@@ -83,7 +83,7 @@ impl rustls_server_config_builder {
     pub extern "C" fn rustls_server_config_builder_new() -> *mut rustls_server_config_builder {
         ffi_panic_boundary! {
             let builder = ServerConfigBuilder {
-                           base: rustls::ServerConfig::builder().with_safe_defaults(),
+                           base: rustls::ServerConfig::builder(),
                            verifier: WebPkiClientVerifier::no_client_auth(),
                            cert_resolver: None,
                            session_storage: None,
@@ -138,7 +138,12 @@ impl rustls_server_config_builder {
                 }
             }
 
-            let result = rustls::ServerConfig::builder().with_cipher_suites(&cs_vec).with_safe_default_kx_groups().with_protocol_versions(&versions);
+            let provider = rustls::crypto::CryptoProvider{
+                cipher_suites: cs_vec,
+                ..rustls::crypto::ring::default_provider()
+            };
+            let result = rustls::ServerConfig::builder_with_provider(provider.into())
+                .with_protocol_versions(&versions);
             let base = match result {
                 Ok(new) => new,
                 Err(_) => return rustls_result::InvalidParameter,