proto: upgrade to rustls-platform-verifier 0.6

Author: djc

Cargo.lock

@@ -39,7 +39,7 @@ ring = "0.17"
 rustc-hash = "2"
 rustls = { version = "0.23.5", default-features = false, features = ["std"] }
 rustls-pemfile = "2"
-rustls-platform-verifier = "0.5"
+rustls-platform-verifier = "0.6"
 rustls-pki-types = "1.7"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1"

Cargo.toml

@@ -3,9 +3,9 @@ allow = [
     "Apache-2.0",
     "BSD-2-Clause",
     "BSD-3-Clause",
+    "CDLA-Permissive-2.0",
     "ISC",
     "MIT",
-    "MPL-2.0",
     "NCSA",
     "OpenSSL",
     "Unicode-3.0",

deny.toml

@@ -18,7 +18,7 @@ fn main() {
     let (self_signed_certs, self_signed_key) = generate_self_signed_cert().unwrap();
     let (certs, key) = read_certs_from_file().unwrap();
     let server_config = quinn::ServerConfig::with_single_cert(certs, key);
-    let client_config = quinn::ClientConfig::with_platform_verifier();
+    let client_config = quinn::ClientConfig::try_with_platform_verifier().unwrap();
 }
 
 #[allow(dead_code)] // Included in `certificate.md`

docs/book/src/bin/certificate.rs

@@ -1,6 +1,6 @@
 [package]
 name = "quinn-proto"
-version = "0.11.12"
+version = "0.11.13"
 edition.workspace = true
 rust-version.workspace = true
 license.workspace = true

quinn-proto/Cargo.toml

@@ -615,11 +615,18 @@ impl ClientConfig {
 #[cfg(any(feature = "rustls-aws-lc-rs", feature = "rustls-ring"))]
 impl ClientConfig {
     /// Create a client configuration that trusts the platform's native roots
+    #[deprecated(since = "0.11.13", note = "use `try_with_platform_verifier()` instead")]
     #[cfg(feature = "platform-verifier")]
     pub fn with_platform_verifier() -> Self {
-        Self::new(Arc::new(crypto::rustls::QuicClientConfig::new(Arc::new(
-            rustls_platform_verifier::Verifier::new(),
-        ))))
+        Self::try_with_platform_verifier().expect("use try_with_platform_verifier() instead")
+    }
+
+    /// Create a client configuration that trusts the platform's native roots
+    #[cfg(feature = "platform-verifier")]
+    pub fn try_with_platform_verifier() -> Result<Self, rustls::Error> {
+        Ok(Self::new(Arc::new(
+            crypto::rustls::QuicClientConfig::with_platform_verifier()?,
+        )))
     }
 
     /// Create a client configuration that trusts specified trust anchors

quinn-proto/src/config/mod.rs

@@ -12,6 +12,8 @@ use rustls::{
     pki_types::{CertificateDer, PrivateKeyDer, ServerName},
     quic::{Connection, HeaderProtectionKey, KeyChange, PacketKey, Secrets, Suite, Version},
 };
+#[cfg(feature = "platform-verifier")]
+use rustls_platform_verifier::BuilderVerifierExt;
 
 use crate::{
     ConnectError, ConnectionId, Side, TransportError, TransportErrorCode,
@@ -281,6 +283,24 @@ pub struct QuicClientConfig {
 }
 
 impl QuicClientConfig {
+    #[cfg(feature = "platform-verifier")]
+    pub(crate) fn with_platform_verifier() -> Result<Self, Error> {
+        // Keep in sync with `inner()` below
+        let mut inner = rustls::ClientConfig::builder_with_provider(configured_provider())
+            .with_protocol_versions(&[&rustls::version::TLS13])
+            .unwrap() // The default providers support TLS 1.3
+            .with_platform_verifier()?
+            .with_no_client_auth();
+
+        inner.enable_early_data = true;
+        Ok(Self {
+            // We're confident that the *ring* default provider contains TLS13_AES_128_GCM_SHA256
+            initial: initial_suite_from_provider(inner.crypto_provider())
+                .expect("no initial cipher suite found"),
+            inner: Arc::new(inner),
+        })
+    }
+
     /// Initialize a sane QUIC-compatible TLS client configuration
     ///
     /// QUIC requires that TLS 1.3 be enabled. Advanced users can use any [`rustls::ClientConfig`] that
@@ -309,6 +329,7 @@ impl QuicClientConfig {
     }
 
     pub(crate) fn inner(verifier: Arc<dyn ServerCertVerifier>) -> rustls::ClientConfig {
+        // Keep in sync with `with_platform_verifier()` above
         let mut config = rustls::ClientConfig::builder_with_provider(configured_provider())
             .with_protocol_versions(&[&rustls::version::TLS13])
             .unwrap() // The default providers support TLS 1.3