Remove lifetime from TlsVerifier, and change webpki to hold hostname as an owned heapless String

Author: MathiasKoch

CHANGELOG.md

@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## Unreleased
 
+- Add missing implementation to support Client Certificate Authorization (#135)
+
 ## 0.17.0 - 2024-01-06
 
 - Update to stable rust

examples/blocking/src/main.rs

@@ -6,12 +6,12 @@ use rand::rngs::OsRng;
 use std::net::TcpStream;
 use std::time::SystemTime;
 
-struct Provider<'a> {
+struct Provider {
     rng: OsRng,
-    verifier: CertVerifier<'a, Aes128GcmSha256, SystemTime, 4096>,
+    verifier: CertVerifier<Aes128GcmSha256, SystemTime, 4096>,
 }
 
-impl<'a> CryptoProvider for Provider<'a> {
+impl CryptoProvider for Provider {
     type CipherSuite = Aes128GcmSha256;
 
     type Signature = &'static [u8];
@@ -22,7 +22,7 @@ impl<'a> CryptoProvider for Provider<'a> {
 
     fn verifier(
         &mut self,
-    ) -> Result<&mut impl TlsVerifier<'_, Self::CipherSuite>, embedded_tls::TlsError> {
+    ) -> Result<&mut impl TlsVerifier<Self::CipherSuite>, embedded_tls::TlsError> {
         Ok(&mut self.verifier)
     }
 }

src/asynch.rs

@@ -78,8 +78,11 @@ where
         Provider: CryptoProvider<CipherSuite = CipherSuite>,
     {
         let mut handshake: Handshake<CipherSuite> = Handshake::new();
-        if let Ok(verifier) = context.crypto_provider.verifier() {
-            verifier.set_hostname_verification(context.config.server_name)?;
+        if let (Ok(verifier), Some(server_name)) = (
+            context.crypto_provider.verifier(),
+            context.config.server_name,
+        ) {
+            verifier.set_hostname_verification(server_name)?;
         }
         let mut state = State::ClientHello;
 

src/blocking.rs

@@ -77,8 +77,11 @@ where
         Provider: CryptoProvider<CipherSuite = CipherSuite>,
     {
         let mut handshake: Handshake<CipherSuite> = Handshake::new();
-        if let Ok(verifier) = context.crypto_provider.verifier() {
-            verifier.set_hostname_verification(context.config.server_name)?;
+        if let (Ok(verifier), Some(server_name)) = (
+            context.crypto_provider.verifier(),
+            context.config.server_name,
+        ) {
+            verifier.set_hostname_verification(server_name)?;
         }
         let mut state = State::ClientHello;
 

src/config.rs

@@ -70,15 +70,12 @@ impl TlsCipherSuite for Aes256GcmSha384 {
 /// The verifier is responsible for verifying certificates and signatures. Since certificate verification is
 /// an expensive process, this trait allows clients to choose how much verification should take place,
 /// and also to skip the verification if the server is verified through other means (I.e. a pre-shared key).
-pub trait TlsVerifier<'a, CipherSuite>
+pub trait TlsVerifier<CipherSuite>
 where
     CipherSuite: TlsCipherSuite,
 {
     /// Host verification is enabled by passing a server hostname.
-    fn set_hostname_verification(
-        &mut self,
-        hostname: Option<&'a str>,
-    ) -> Result<(), crate::TlsError>;
+    fn set_hostname_verification(&mut self, hostname: &str) -> Result<(), crate::TlsError>;
 
     /// Verify a certificate.
     ///
@@ -100,14 +97,11 @@ where
 
 pub struct NoVerify;
 
-impl<'a, CipherSuite> TlsVerifier<'a, CipherSuite> for NoVerify
+impl<CipherSuite> TlsVerifier<CipherSuite> for NoVerify
 where
     CipherSuite: TlsCipherSuite,
 {
-    fn set_hostname_verification(
-        &mut self,
-        _hostname: Option<&'a str>,
-    ) -> Result<(), crate::TlsError> {
+    fn set_hostname_verification(&mut self, _hostname: &str) -> Result<(), crate::TlsError> {
         Ok(())
     }
 
@@ -156,9 +150,7 @@ pub trait CryptoProvider {
 
     fn rng(&mut self) -> impl CryptoRngCore;
 
-    fn verifier(
-        &mut self,
-    ) -> Result<&mut impl TlsVerifier<'_, Self::CipherSuite>, crate::TlsError> {
+    fn verifier(&mut self) -> Result<&mut impl TlsVerifier<Self::CipherSuite>, crate::TlsError> {
         Err::<&mut NoVerify, _>(crate::TlsError::Unimplemented)
     }
 
@@ -181,9 +173,7 @@ impl<T: CryptoProvider> CryptoProvider for &mut T {
         T::rng(self)
     }
 
-    fn verifier(
-        &mut self,
-    ) -> Result<&mut impl TlsVerifier<'_, Self::CipherSuite>, crate::TlsError> {
+    fn verifier(&mut self) -> Result<&mut impl TlsVerifier<Self::CipherSuite>, crate::TlsError> {
         T::verifier(self)
     }
 

src/webpki.rs

@@ -89,18 +89,18 @@ static ALL_SIGALGS: &[&webpki::SignatureAlgorithm] = &[
     &webpki::ED25519,
 ];
 
-pub struct CertVerifier<'a, CipherSuite, Clock, const CERT_SIZE: usize>
+pub struct CertVerifier<CipherSuite, Clock, const CERT_SIZE: usize>
 where
     Clock: TlsClock,
     CipherSuite: TlsCipherSuite,
 {
-    host: Option<&'a str>,
+    host: Option<heapless::String<64>>,
     certificate_transcript: Option<CipherSuite::Hash>,
     certificate: Option<OwnedCertificate<CERT_SIZE>>,
     _clock: PhantomData<Clock>,
 }
 
-impl<'a, CipherSuite, Clock, const CERT_SIZE: usize> CertVerifier<'a, CipherSuite, Clock, CERT_SIZE>
+impl<CipherSuite, Clock, const CERT_SIZE: usize> CertVerifier<CipherSuite, Clock, CERT_SIZE>
 where
     Clock: TlsClock,
     CipherSuite: TlsCipherSuite,
@@ -115,17 +115,16 @@ where
     }
 }
 
-impl<'a, CipherSuite, Clock, const CERT_SIZE: usize> TlsVerifier<'a, CipherSuite>
-    for CertVerifier<'a, CipherSuite, Clock, CERT_SIZE>
+impl<CipherSuite, Clock, const CERT_SIZE: usize> TlsVerifier<CipherSuite>
+    for CertVerifier<CipherSuite, Clock, CERT_SIZE>
 where
     CipherSuite: TlsCipherSuite,
     Clock: TlsClock,
 {
-    fn set_hostname_verification(
-        &mut self,
-        hostname: Option<&'a str>,
-    ) -> Result<(), crate::TlsError> {
-        self.host = hostname;
+    fn set_hostname_verification(&mut self, hostname: &str) -> Result<(), TlsError> {
+        self.host.replace(
+            heapless::String::try_from(hostname).map_err(|_| TlsError::InsufficientSpace)?,
+        );
         Ok(())
     }
 
@@ -135,7 +134,7 @@ where
         ca: &Option<Certificate>,
         cert: ServerCertificate,
     ) -> Result<(), TlsError> {
-        verify_certificate(self.host.clone(), ca, &cert, Clock::now())?;
+        verify_certificate(self.host.as_deref(), ca, &cert, Clock::now())?;
         self.certificate.replace(cert.try_into()?);
         self.certificate_transcript.replace(transcript.clone());
         Ok(())