Add staged ClientHello acceptor for ServerConfig selection

.github/workflows/rust.yml

@@ -142,7 +142,7 @@ jobs:
 
       - run: cargo test --locked -p quinn-proto --target wasm32-unknown-unknown --no-run
       - run: cargo check --locked -p quinn-udp --target wasm32-unknown-unknown --no-default-features --features=tracing,log
-      - run: cargo rustc --locked -p quinn --target wasm32-unknown-unknown --no-default-features --features=tracing-log,platform-verifier,rustls-ring --crate-type=cdylib
+      - run: cargo rustc --locked -p quinn --target wasm32-unknown-unknown --no-default-features --features=tracing-log,rustls-ring --crate-type=cdylib
 
       # If the Wasm file contains any 'import "env"' declarations, then
       # some non-Wasm-compatible code made it into the final code.

Cargo.toml

@@ -35,8 +35,11 @@ rand = "0.10.1"
 rcgen = "0.14"
 ring = "0.17"
 rustc-hash = "2"
-rustls = { version = "0.23.5", default-features = false, features = ["std"] }
-rustls-platform-verifier = "0.7"
+rustls = { version = "0.24.0-dev.0", git = "https://github.com/rustls/rustls.git", branch = "main", default-features = false, features = ["webpki"] }
+rustls-aws-lc-rs = { version = "0.1.0-dev.0", git = "https://github.com/rustls/rustls.git", branch = "main", default-features = false, features = ["aws-lc-sys", "std"] }
+rustls-platform-verifier = { version = "0.8.0", git = "https://github.com/iadev09/rustls-platform-verifier.git", rev = "05cefce8d045ca21010f2f9aa952d7a821c1f429", default-features = false }
+rustls-ring = { version = "0.1.0-dev.0", git = "https://github.com/rustls/rustls.git", branch = "main", default-features = false, features = ["std"] }
+rustls-util = { version = "0.1.0", git = "https://github.com/rustls/rustls.git", branch = "main" }
 rustls-pki-types = "1.7"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1"

bench/Cargo.toml

@@ -10,9 +10,10 @@ anyhow = { workspace = true }
 bytes = { workspace = true }
 clap = { workspace = true }
 hdrhistogram = { workspace = true }
-quinn = { path = "../quinn", features = ["ring"] }
+quinn = { path = "../quinn" }
 rcgen = { workspace = true }
 rustls = { workspace = true }
+rustls-aws-lc-rs = { workspace = true }
 tokio = { workspace = true, features = ["rt"] }
 tracing = { workspace = true }
 tracing-subscriber = { workspace = true }

bench/src/lib.rs

@@ -63,17 +63,12 @@ pub async fn connect_client(
     let mut roots = RootCertStore::empty();
     roots.add(server_cert)?;
 
-    let default_provider = rustls::crypto::ring::default_provider();
-    let provider = rustls::crypto::CryptoProvider {
-        cipher_suites: vec![opt.cipher.as_rustls()],
-        ..default_provider
-    };
+    let mut provider = rustls_aws_lc_rs::DEFAULT_PROVIDER;
+    provider.tls13_cipher_suites = vec![opt.cipher.as_rustls()].into();
 
-    let crypto = rustls::ClientConfig::builder_with_provider(provider.into())
-        .with_protocol_versions(&[&rustls::version::TLS13])
-        .unwrap()
+    let crypto = rustls::ClientConfig::builder(Arc::new(provider))
         .with_root_certificates(roots)
-        .with_no_client_auth();
+        .with_no_client_auth()?;
 
     let mut client_config = quinn::ClientConfig::new(Arc::new(QuicClientConfig::try_from(crypto)?));
     client_config.transport_config(Arc::new(transport_config(&opt)));
@@ -230,8 +225,8 @@ pub enum CipherSuite {
 }
 
 impl CipherSuite {
-    pub fn as_rustls(self) -> rustls::SupportedCipherSuite {
-        use rustls::crypto::ring::cipher_suite;
+    pub fn as_rustls(self) -> &'static rustls::Tls13CipherSuite {
+        use rustls_aws_lc_rs::cipher_suite;
         match self {
             Self::Aes128 => cipher_suite::TLS13_AES_128_GCM_SHA256,
             Self::Aes256 => cipher_suite::TLS13_AES_256_GCM_SHA384,

docs/book/Cargo.toml

@@ -14,3 +14,4 @@ bytes = { workspace = true }
 quinn = { version = "0.12.0", path = "../../quinn" }
 rcgen.workspace = true
 rustls.workspace = true
+rustls-aws-lc-rs.workspace = true

docs/book/src/bin/certificate.rs

@@ -1,90 +1,75 @@
 use std::{error::Error, sync::Arc};
 
-use quinn::{
-    ClientConfig,
-    crypto::rustls::{NoInitialCipherSuite, QuicClientConfig},
-};
+use quinn::{ClientConfig, crypto::rustls::QuicClientConfig};
 use rustls::{
-    DigitallySignedStruct, SignatureScheme,
     client::danger,
     crypto::{CryptoProvider, verify_tls12_signature, verify_tls13_signature},
-    pki_types::{
-        CertificateDer, PrivateKeyDer, PrivatePkcs8KeyDer, ServerName, UnixTime, pem::PemObject,
-    },
+    pki_types::{CertificateDer, PrivateKeyDer, PrivatePkcs8KeyDer, pem::PemObject},
 };
 
 #[allow(unused_variables)]
 fn main() {
     let (self_signed_certs, self_signed_key) = generate_self_signed_cert().unwrap();
     let (certs, key) = read_certs_from_file().unwrap();
     let server_config = quinn::ServerConfig::with_single_cert(certs, key);
-    let client_config = quinn::ClientConfig::try_with_platform_verifier().unwrap();
+    let mut roots = rustls::RootCertStore::empty();
+    roots.add(self_signed_certs).unwrap();
+    let client_config = quinn::ClientConfig::with_root_certificates(Arc::new(roots)).unwrap();
 }
 
 #[allow(dead_code)] // Included in `certificate.md`
-fn configure_client() -> Result<ClientConfig, NoInitialCipherSuite> {
-    let crypto = rustls::ClientConfig::builder()
+fn configure_client() -> Result<ClientConfig, Box<dyn Error>> {
+    let crypto = rustls::ClientConfig::builder(Arc::new(rustls_aws_lc_rs::DEFAULT_PROVIDER))
         .dangerous()
         .with_custom_certificate_verifier(SkipServerVerification::new())
-        .with_no_client_auth();
+        .with_no_client_auth()?;
 
     Ok(ClientConfig::new(Arc::new(QuicClientConfig::try_from(
         crypto,
     )?)))
 }
 
-// Implementation of `ServerCertVerifier` that verifies everything as trustworthy.
+// Implementation of `ServerVerifier` that verifies everything as trustworthy.
 #[derive(Debug)]
 struct SkipServerVerification(Arc<CryptoProvider>);
 
 impl SkipServerVerification {
     fn new() -> Arc<Self> {
-        Arc::new(Self(Arc::new(rustls::crypto::ring::default_provider())))
+        Arc::new(Self(Arc::new(rustls_aws_lc_rs::DEFAULT_PROVIDER)))
     }
 }
 
-impl danger::ServerCertVerifier for SkipServerVerification {
-    fn verify_server_cert(
+impl danger::ServerVerifier for SkipServerVerification {
+    fn verify_identity(
         &self,
-        _end_entity: &CertificateDer<'_>,
-        _intermediates: &[CertificateDer<'_>],
-        _server_name: &ServerName<'_>,
-        _ocsp: &[u8],
-        _now: UnixTime,
-    ) -> Result<danger::ServerCertVerified, rustls::Error> {
-        Ok(danger::ServerCertVerified::assertion())
+        _identity: &danger::ServerIdentity<'_>,
+    ) -> Result<danger::PeerVerified, rustls::Error> {
+        Ok(danger::PeerVerified::assertion())
     }
+
     fn verify_tls12_signature(
         &self,
-        message: &[u8],
-        cert: &CertificateDer<'_>,
-        dss: &DigitallySignedStruct,
+        input: &danger::SignatureVerificationInput<'_>,
     ) -> Result<danger::HandshakeSignatureValid, rustls::Error> {
-        verify_tls12_signature(
-            message,
-            cert,
-            dss,
-            &self.0.signature_verification_algorithms,
-        )
+        verify_tls12_signature(input, &self.0.signature_verification_algorithms)
     }
 
     fn verify_tls13_signature(
         &self,
-        message: &[u8],
-        cert: &CertificateDer<'_>,
-        dss: &DigitallySignedStruct,
+        input: &danger::SignatureVerificationInput<'_>,
     ) -> Result<danger::HandshakeSignatureValid, rustls::Error> {
-        verify_tls13_signature(
-            message,
-            cert,
-            dss,
-            &self.0.signature_verification_algorithms,
-        )
+        verify_tls13_signature(input, &self.0.signature_verification_algorithms)
     }
 
-    fn supported_verify_schemes(&self) -> Vec<SignatureScheme> {
+    fn supported_verify_schemes(&self) -> Vec<rustls::crypto::SignatureScheme> {
         self.0.signature_verification_algorithms.supported_schemes()
     }
+
+    fn request_ocsp_response(&self) -> bool {
+        false
+    }
+
+    fn hash_config(&self, _h: &mut dyn std::hash::Hasher) {}
 }
 
 fn generate_self_signed_cert()