Skip to content

Commit 5f8d3bf

Browse files
jbrjbr
committed
feat: add Verifier::set_provider and Verifier::with_provider
1 parent b6f6334 commit 5f8d3bf

File tree

4 files changed

+55
-19
lines changed

4 files changed

+55
-19
lines changed

‎rustls-platform-verifier/src/verification/android.rs

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ pub struct Verifier {
4747
/// Testing only: The root CA certificate to trust.
4848
#[cfg(any(test, feature = "ffi-testing"))]
4949
test_only_root_ca_override: Option<Vec<u8>>,
50-
default_provider: OnceCell<Arc<CryptoProvider>>,
50+
pub(super) crypto_provider: OnceCell<Arc<CryptoProvider>>,
5151
}
5252

5353
impl Default for Verifier {
@@ -71,13 +71,16 @@ impl Drop for Verifier {
7171

7272
impl Verifier {
7373
/// Creates a new instance of a TLS certificate verifier that utilizes the
74-
/// Android certificate facilities. The rustls default [`CryptoProvider`]
75-
/// must be set before the verifier can be used.
74+
/// Android certificate facilities.
75+
///
76+
/// A [`CryptoProvider`] must be set with
77+
/// [`set_provider`][Verifier::set_provider]/[`with_provider`][Verifier::with_provider] or
78+
/// [`CryptoProvider::install_default`] before the verifier can be used.
7679
pub fn new() -> Self {
7780
Self {
7881
#[cfg(any(test, feature = "ffi-testing"))]
7982
test_only_root_ca_override: None,
80-
default_provider: OnceCell::new(),
83+
crypto_provider: OnceCell::new(),
8184
}
8285
}
8386

@@ -86,12 +89,12 @@ impl Verifier {
8689
pub(crate) fn new_with_fake_root(root: &[u8]) -> Self {
8790
Self {
8891
test_only_root_ca_override: Some(root.into()),
89-
default_provider: OnceCell::new(),
92+
crypto_provider: OnceCell::new(),
9093
}
9194
}
9295

9396
fn get_provider(&self) -> &CryptoProvider {
94-
self.default_provider
97+
self.crypto_provider
9598
.get_or_init(|| {
9699
rustls::crypto::CryptoProvider::get_default()
97100
.expect("rustls default CryptoProvider not set")

‎rustls-platform-verifier/src/verification/apple.rs

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -46,18 +46,21 @@ pub struct Verifier {
4646
/// Testing only: The root CA certificate to trust.
4747
#[cfg(any(test, feature = "ffi-testing", feature = "dbg"))]
4848
test_only_root_ca_override: Option<Vec<u8>>,
49-
default_provider: OnceCell<Arc<CryptoProvider>>,
49+
pub(super) crypto_provider: OnceCell<Arc<CryptoProvider>>,
5050
}
5151

5252
impl Verifier {
53-
/// Creates a new instance of a TLS certificate verifier that utilizes the
54-
/// macOS certificate facilities. The rustls default [`CryptoProvider`]
55-
/// must be set before the verifier can be used.
53+
/// Creates a new instance of a TLS certificate verifier that utilizes the macOS certificate
54+
/// facilities.
55+
///
56+
/// A [`CryptoProvider`] must be set with
57+
/// [`set_provider`][Verifier::set_provider]/[`with_provider`][Verifier::with_provider] or
58+
/// [`CryptoProvider::install_default`] before the verifier can be used.
5659
pub fn new() -> Self {
5760
Self {
5861
#[cfg(any(test, feature = "ffi-testing", feature = "dbg"))]
5962
test_only_root_ca_override: None,
60-
default_provider: OnceCell::new(),
63+
crypto_provider: OnceCell::new(),
6164
}
6265
}
6366

@@ -66,12 +69,12 @@ impl Verifier {
6669
pub(crate) fn new_with_fake_root(root: &[u8]) -> Self {
6770
Self {
6871
test_only_root_ca_override: Some(root.into()),
69-
default_provider: OnceCell::new(),
72+
crypto_provider: OnceCell::new(),
7073
}
7174
}
7275

7376
fn get_provider(&self) -> &CryptoProvider {
74-
self.default_provider
77+
self.crypto_provider
7578
.get_or_init(|| {
7679
rustls::crypto::CryptoProvider::get_default()
7780
.expect("rustls default CryptoProvider not set")

‎rustls-platform-verifier/src/verification/mod.rs

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,3 +77,30 @@ fn invalid_certificate(reason: impl Into<String>) -> rustls::Error {
7777
/// - id-kp-serverAuth
7878
// TODO: Chromium also allows for `OID_ANY_EKU` on Android.
7979
pub const ALLOWED_EKUS: &[&str] = &["1.3.6.1.5.5.7.3.1"];
80+
81+
#[cfg(any(target_os = "macos", target_os = "ios", target_os = "android", windows))]
82+
83+
impl Verifier {
84+
/// Chainable setter to configure the [`CryptoProvider`][rustls::crypto::CryptoProvider] for this `Verifier`.
85+
///
86+
/// This will be used instead of the rustls processs-default `CryptoProvider`, even if one has
87+
/// been installed.
88+
pub fn with_provider(
89+
mut self,
90+
crypto_provider: std::sync::Arc<rustls::crypto::CryptoProvider>,
91+
) -> Self {
92+
self.set_provider(crypto_provider);
93+
self
94+
}
95+
96+
/// Configures the [`CryptoProvider`][rustls::crypto::CryptoProvider] for this `Verifier`.
97+
///
98+
/// This will be used instead of the rustls processs-default `CryptoProvider`, even if one has
99+
/// been installed.
100+
pub fn set_provider(
101+
&mut self,
102+
crypto_provider: std::sync::Arc<rustls::crypto::CryptoProvider>,
103+
) {
104+
self.crypto_provider = crypto_provider.into();
105+
}
106+
}

‎rustls-platform-verifier/src/verification/windows.rs

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -421,18 +421,21 @@ pub struct Verifier {
421421
/// Testing only: The root CA certificate to trust.
422422
#[cfg(any(test, feature = "ffi-testing", feature = "dbg"))]
423423
test_only_root_ca_override: Option<Vec<u8>>,
424-
default_provider: OnceCell<Arc<CryptoProvider>>,
424+
pub(super) crypto_provider: OnceCell<Arc<CryptoProvider>>,
425425
}
426426

427427
impl Verifier {
428428
/// Creates a new instance of a TLS certificate verifier that utilizes the
429-
/// Windows certificate facilities. The rustls default [`CryptoProvider`]
430-
/// must be set before the verifier can be used.
429+
/// Windows certificate facilities.
430+
///
431+
/// A [`CryptoProvider`] must be set with
432+
/// [`set_provider`][Verifier::set_provider]/[`with_provider`][Verifier::with_provider] or
433+
/// [`CryptoProvider::install_default`] before the verifier can be used.
431434
pub fn new() -> Self {
432435
Self {
433436
#[cfg(any(test, feature = "ffi-testing", feature = "dbg"))]
434437
test_only_root_ca_override: None,
435-
default_provider: OnceCell::new(),
438+
crypto_provider: OnceCell::new(),
436439
}
437440
}
438441

@@ -441,12 +444,12 @@ impl Verifier {
441444
pub(crate) fn new_with_fake_root(root: &[u8]) -> Self {
442445
Self {
443446
test_only_root_ca_override: Some(root.into()),
444-
default_provider: OnceCell::new(),
447+
crypto_provider: OnceCell::new(),
445448
}
446449
}
447450

448451
fn get_provider(&self) -> &CryptoProvider {
449-
self.default_provider
452+
self.crypto_provider
450453
.get_or_init(|| {
451454
rustls::crypto::CryptoProvider::get_default()
452455
.expect("rustls default CryptoProvider not set")

0 commit comments

Comments
 (0)