feat(tls): honor a process-installed rustls CryptoProvider; harden the rustls backend - #446
Open
MattJackson wants to merge 4 commits into
Open
MattJackson wants to merge 4 commits into
MattJackson wants to merge 4 commits into
Conversation
MattJackson
force-pushed
the
stack/s7
branch
2 times, most recently
from
September 2, 2026 20:24
a0836ca to
607ddba
Compare
MattJackson
force-pushed
the
stack/s7
branch
from
September 2, 2026 21:17
607ddba to
47a7055
Compare
MattJackson
force-pushed
the
stack/s7
branch
2 times, most recently
from
September 2, 2026 23:06
5bda77d to
c9b2719
Compare
MattJackson
force-pushed
the
stack/s7
branch
from
September 2, 2026 23:54
c9b2719 to
b8bd1b8
Compare
MattJackson
force-pushed
the
stack/s7
branch
from
September 3, 2026 00:01
b8bd1b8 to
1687f19
Compare
MattJackson
force-pushed
the
stack/s7
branch
from
September 3, 2026 00:50
1687f19 to
bd9167c
Compare
MattJackson
force-pushed
the
stack/s7
branch
from
September 3, 2026 01:10
bd9167c to
9591085
Compare
MattJackson
force-pushed
the
stack/s7
branch
from
September 3, 2026 15:05
ea5bc1a to
0387287
Compare
MattJackson
force-pushed
the
stack/s7
branch
from
September 4, 2026 20:43
0387287 to
491c106
Compare
Contributor
Author
|
@aqrln rebased onto the merged main, all green and MERGEABLE — ready for review whenever you get a chance. Thanks! |
MattJackson
force-pushed
the
stack/s7
branch
from
September 6, 2026 17:27
491c106 to
04a92b6
Compare
MattJackson
force-pushed
the
stack/s7
branch
from
September 7, 2026 00:01
04a92b6 to
1f9a72c
Compare
Contributor
Author
|
Rebased onto the updated stack; green. Added unit coverage for the rustls private-key / cert-chain error paths (missing file, DER branch, unsupported extension, malformed PEM, zero-cert rejection). |
MattJackson
force-pushed
the
stack/s7
branch
from
September 8, 2026 18:07
1f9a72c to
72db213
Compare
MattJackson
force-pushed
the
stack/s7
branch
from
September 15, 2026 23:02
72db213 to
73f9648
Compare
Use CryptoProvider::get_default() when the application has installed a process-wide provider (via install_default), falling back to aws-lc-rs otherwise. Lets callers choose their own backend (ring, a FIPS provider, ...) instead of being forced onto aws-lc-rs. Suggested by @SimSmith while reviewing the rustls 0.23 migration (#439).
Review-driven follow-ups found while adding CryptoProvider support: - fix(HIGH): trust_cert_ca now trusts the supplied CA *in addition to* the system trust store (best-effort), matching its documented contract and the native-tls backend. Previously the rustls path built RootCertStore::empty() with only the custom CA, so connections to public-CA servers failed. The native-root load is best-effort (an empty/unreadable OS store no longer breaks an explicit-CA-only deployment). - fix: CA-cert read failures now preserve the underlying io::Error in the message (missing vs permission vs parse) instead of a generic string. - refactor: extract read_cert_chain (shared by the CA and client-cert paths, removing duplicated pem/der extension parsing) and resolve_crypto_provider (pure, unit-testable; logs which provider was selected). - docs: explain the TLS 1.2 pin (a macOS-CI workaround, tracked for removal in the macOS-parity follow-up), the NoCertVerifier scheme list, and the TrustAll placeholder SNI. - test: add unit coverage for provider selection, get_server_name, cert-chain reading, the additive CA store, and client-auth loading (previously zero unit tests in this file). No behavior change to TrustAll/Default paths. Gate: fmt + clippy --features=all -D warnings + new unit tests all green.
- shorten the augment-not-replace test comment to one line - drop history/testability narration in with_native_roots and resolve_crypto_provider - reduce the signature-schemes comment (it over-explained and contradicted the hardcoded list) - trim the load_native_roots_into doc to behavior + return value
…ackend read_cert_chain had direct tests for missing-file/DER/unsupported-extension/ malformed cases but its sibling read_private_key and the zero-cert PEM branch of build_ca_trust_store/read_cert_chain did not.
MattJackson
force-pushed
the
stack/s7
branch
from
September 16, 2026 02:51
73f9648 to
b60ba35
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of the sync stack — slice s7, based on #444 (
stack/s6).What
CryptoProvider. The rustls backend now usesCryptoProvider::get_default()when an application has installed one, falling back toaws-lc-rsotherwise (previously it always constructedaws-lc-rs). Raised by @SimSmith in review of fix(security): upgrade rustls stack to 0.23 — clear RUSTSEC-2026-0098/-0099/-0104 #439.rustls_tls_stream.rs(boy-scout, while adding the above):trust_cert_cais now additive — a custom CA is added alongside the system roots instead of replacing them (previously a custom CA silently dropped all other trust anchors).resolve_crypto_provider,read_cert_chain,read_private_key,load_native_roots_into,build_ca_trust_store.Validation
cargo fmt --checkclean;cargo clippygreen on both--features=alland the rustls feature set; unit tests pass (including the new rustls tests).Please rebase-merge (not squash) to preserve commit attribution.