Skip to content

Commit 52b8b61

Browse files
cpucomplexspaces
cpu
authored and
complexspaces
committed
proj: relax cfg gates to allow FreeBSD
This commit relaxes the cfg gates that previously were Linux specific to allow Unix generally. Care is taken to ensure we still handle MacOS/iOS/Android specially where required. FreeBSD in CI seems to be unable to use openssl-probe to find the system CA bundle, so we also add a BSD-specific dev-dependency on webpki-roots and update the real world verification suite to conditionally use the `Verifier::new_with_extra_roots` constructor to provide extra CA certs from webpki-roots. It might be possible to fix the FreeBSD runner so that openssl-probe works (e.g. by `curl`ing a CA bundle into a different location, or setting the `SSL_CERT_FILE` env var) but this approach has the benefit of adding coverage for `new_with_extra_roots`.
1 parent abb3710 commit 52b8b61

File tree

4 files changed

+50
-24
lines changed

4 files changed

+50
-24
lines changed

‎rustls-platform-verifier/Cargo.toml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ base64 = { version = "0.21", optional = true } # Only used when the `cert-loggin
3535
jni = { version = "0.19", default-features = false, optional = true } # Only used during doc generation
3636
once_cell = { version = "1.9", optional = true } # Only used during doc generation.
3737

38-
[target.'cfg(target_os = "linux")'.dependencies]
38+
[target.'cfg(all(unix, not(target_os = "android"), not(target_os = "macos"), not(target_os = "ios")))'.dependencies]
3939
rustls-native-certs = "0.6"
4040
once_cell = "1.9"
4141
webpki = { package = "rustls-webpki", version = "0.101", features = ["alloc", "std"] }
@@ -51,6 +51,10 @@ android_logger = { version = "0.13", optional = true } # Only used during testin
5151
once_cell = "1.9"
5252
webpki-roots = "0.25"
5353

54+
# BSD targets require webpki-roots for the real-world verification tests.
55+
[target.'cfg(target_os = "freebsd")'.dev-dependencies]
56+
webpki-roots = "0.25"
57+
5458
[target.'cfg(any(target_os = "macos", target_os = "ios"))'.dependencies]
5559
core-foundation = "0.9"
5660
core-foundation-sys = "0.8"

‎rustls-platform-verifier/src/tests/verification_mock/mod.rs‎

Lines changed: 16 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -13,12 +13,7 @@
1313
//! any parts of the system outside of these tests. See the `#![cfg(...)]`
1414
//! immediately below to see which platforms run these tests.
1515
16-
#![cfg(any(
17-
windows,
18-
target_os = "android",
19-
target_os = "macos",
20-
target_os = "linux"
21-
))]
16+
#![cfg(all(any(windows, unix, target_os = "android"), not(target_os = "ios")))]
2217

2318
use super::TestCase;
2419
use crate::tests::{assert_cert_error_eq, verification_time};
@@ -116,47 +111,47 @@ fn test_verification_without_mock_root() {
116111
// Verifies that our test trust anchor(s) are not trusted when `Verifier::new()`
117112
// is used.
118113
mock_root_test_cases! {
119-
valid_no_stapling_dns [ any(windows, target_os = "android", target_os = "macos", target_os = "linux") ] => TestCase {
114+
valid_no_stapling_dns [ any(windows, unix) ] => TestCase {
120115
reference_id: EXAMPLE_COM,
121116
chain: &[ROOT1_INT1_EXAMPLE_COM_GOOD, ROOT1_INT1],
122117
stapled_ocsp: None,
123118
verification_time: verification_time(),
124119
expected_result: Ok(()),
125120
other_error: no_error!(),
126121
},
127-
valid_no_stapling_ipv4 [ any(windows, target_os = "android", target_os = "macos", target_os = "linux") ] => TestCase {
122+
valid_no_stapling_ipv4 [ any(windows, unix) ] => TestCase {
128123
reference_id: LOCALHOST_IPV4,
129124
chain: &[ROOT1_INT1_LOCALHOST_IPV4_GOOD, ROOT1_INT1],
130125
stapled_ocsp: None,
131126
verification_time: verification_time(),
132127
expected_result: Ok(()),
133128
other_error: no_error!(),
134129
},
135-
valid_no_stapling_ipv6 [ any(windows, target_os = "android", target_os = "macos", target_os = "linux") ] => TestCase {
130+
valid_no_stapling_ipv6 [ any(windows, unix) ] => TestCase {
136131
reference_id: LOCALHOST_IPV6,
137132
chain: &[ROOT1_INT1_LOCALHOST_IPV6_GOOD, ROOT1_INT1],
138133
stapled_ocsp: None,
139134
verification_time: verification_time(),
140135
expected_result: Ok(()),
141136
other_error: no_error!(),
142137
},
143-
valid_stapled_good_dns [ any(windows, target_os = "android", target_os = "android", target_os = "macos", target_os = "linux") ] => TestCase {
138+
valid_stapled_good_dns [ any(windows, unix) ] => TestCase {
144139
reference_id: EXAMPLE_COM,
145140
chain: &[ROOT1_INT1_EXAMPLE_COM_GOOD, ROOT1_INT1],
146141
stapled_ocsp: Some(include_bytes!("root1-int1-ee_example.com-good.ocsp")),
147142
verification_time: verification_time(),
148143
expected_result: Ok(()),
149144
other_error: no_error!(),
150145
},
151-
valid_stapled_good_ipv4 [ any(windows, target_os = "android", target_os = "macos", target_os = "linux") ] => TestCase {
146+
valid_stapled_good_ipv4 [ any(windows, unix) ] => TestCase {
152147
reference_id: LOCALHOST_IPV4,
153148
chain: &[ROOT1_INT1_LOCALHOST_IPV4_GOOD, ROOT1_INT1],
154149
stapled_ocsp: Some(include_bytes!("root1-int1-ee_127.0.0.1-good.ocsp")),
155150
verification_time: verification_time(),
156151
expected_result: Ok(()),
157152
other_error: no_error!(),
158153
},
159-
valid_stapled_good_ipv6 [ any(windows, target_os = "android", target_os = "macos", target_os = "linux") ] => TestCase {
154+
valid_stapled_good_ipv6 [ any(windows, unix) ] => TestCase {
160155
reference_id: LOCALHOST_IPV6,
161156
chain: &[ROOT1_INT1_LOCALHOST_IPV6_GOOD, ROOT1_INT1],
162157
stapled_ocsp: Some(include_bytes!("root1-int1-ee_1-good.ocsp")),
@@ -197,23 +192,23 @@ mock_root_test_cases! {
197192
// (AIA is an extension that allows downloading of missing data,
198193
// like missing certificates, during validation; see
199194
// https://datatracker.ietf.org/doc/html/rfc5280#section-5.2.7).
200-
ee_only_dns [ any(windows, target_os = "android", target_os = "macos", target_os = "linux") ] => TestCase {
195+
ee_only_dns [ any(windows, unix) ] => TestCase {
201196
reference_id: EXAMPLE_COM,
202197
chain: &[ROOT1_INT1_EXAMPLE_COM_GOOD],
203198
stapled_ocsp: None,
204199
verification_time: verification_time(),
205200
expected_result: Err(TlsError::InvalidCertificate(CertificateError::UnknownIssuer)),
206201
other_error: no_error!(),
207202
},
208-
ee_only_ipv4 [ any(windows, target_os = "android", target_os = "macos", target_os = "linux") ] => TestCase {
203+
ee_only_ipv4 [ any(windows, unix) ] => TestCase {
209204
reference_id: LOCALHOST_IPV4,
210205
chain: &[ROOT1_INT1_LOCALHOST_IPV4_GOOD],
211206
stapled_ocsp: None,
212207
verification_time: verification_time(),
213208
expected_result: Err(TlsError::InvalidCertificate(CertificateError::UnknownIssuer)),
214209
other_error: no_error!(),
215210
},
216-
ee_only_ipv6 [ any(windows, target_os = "android", target_os = "macos", target_os = "linux") ] => TestCase {
211+
ee_only_ipv6 [ any(windows, unix) ] => TestCase {
217212
reference_id: LOCALHOST_IPV6,
218213
chain: &[ROOT1_INT1_LOCALHOST_IPV6_GOOD],
219214
stapled_ocsp: None,
@@ -222,31 +217,31 @@ mock_root_test_cases! {
222217
other_error: no_error!(),
223218
},
224219
// Validation fails when the certificate isn't valid for the reference ID.
225-
domain_mismatch_dns [ any(windows, target_os = "android", target_os = "macos", target_os = "linux") ] => TestCase {
220+
domain_mismatch_dns [ any(windows, unix) ] => TestCase {
226221
reference_id: "example.org",
227222
chain: &[ROOT1_INT1_EXAMPLE_COM_GOOD, ROOT1_INT1],
228223
stapled_ocsp: None,
229224
verification_time: verification_time(),
230225
expected_result: Err(TlsError::InvalidCertificate(CertificateError::NotValidForName)),
231226
other_error: no_error!(),
232227
},
233-
domain_mismatch_ipv4 [ any(windows, target_os = "android", target_os = "macos", target_os = "linux") ] => TestCase {
228+
domain_mismatch_ipv4 [ any(windows, unix) ] => TestCase {
234229
reference_id: "198.168.0.1",
235230
chain: &[ROOT1_INT1_LOCALHOST_IPV4_GOOD, ROOT1_INT1],
236231
stapled_ocsp: None,
237232
verification_time: verification_time(),
238233
expected_result: Err(TlsError::InvalidCertificate(CertificateError::NotValidForName)),
239234
other_error: no_error!(),
240235
},
241-
domain_mismatch_ipv6 [ any(windows, target_os = "android", target_os = "macos", target_os = "linux") ] => TestCase {
236+
domain_mismatch_ipv6 [ any(windows, unix) ] => TestCase {
242237
reference_id: "::ffff:c6a8:1",
243238
chain: &[ROOT1_INT1_LOCALHOST_IPV6_GOOD, ROOT1_INT1],
244239
stapled_ocsp: None,
245240
verification_time: verification_time(),
246241
expected_result: Err(TlsError::InvalidCertificate(CertificateError::NotValidForName)),
247242
other_error: no_error!(),
248243
},
249-
wrong_eku_dns [ any(windows, target_os = "android", target_os = "macos", target_os = "linux") ] => TestCase {
244+
wrong_eku_dns [ any(windows, unix) ] => TestCase {
250245
reference_id: EXAMPLE_COM,
251246
chain: &[include_bytes!("root1-int1-ee_example.com-wrong_eku.crt"), ROOT1_INT1],
252247
stapled_ocsp: None,
@@ -255,7 +250,7 @@ mock_root_test_cases! {
255250
CertificateError::Other(Arc::from(EkuError)))),
256251
other_error: Some(EkuError),
257252
},
258-
wrong_eku_ipv4 [ any(windows, target_os = "android", target_os = "macos", target_os = "linux") ] => TestCase {
253+
wrong_eku_ipv4 [ any(windows, unix) ] => TestCase {
259254
reference_id: LOCALHOST_IPV4,
260255
chain: &[include_bytes!("root1-int1-ee_127.0.0.1-wrong_eku.crt"), ROOT1_INT1],
261256
stapled_ocsp: None,
@@ -264,7 +259,7 @@ mock_root_test_cases! {
264259
CertificateError::Other(Arc::from(EkuError)))),
265260
other_error: Some(EkuError),
266261
},
267-
wrong_eku_ipv6 [ any(windows, target_os = "android", target_os = "macos", target_os = "linux") ] => TestCase {
262+
wrong_eku_ipv6 [ any(windows, unix) ] => TestCase {
268263
reference_id: LOCALHOST_IPV6,
269264
chain: &[include_bytes!("root1-int1-ee_1-wrong_eku.crt"), ROOT1_INT1],
270265
stapled_ocsp: None,

‎rustls-platform-verifier/src/tests/verification_real_world/mod.rs‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,23 @@ macro_rules! no_error {
118118
fn real_world_test<E: std::error::Error>(test_case: &TestCase<E>) {
119119
log::info!("verifying {:?}", test_case.expected_result);
120120

121+
// On BSD systems openssl-probe fails to find the system CA bundle,
122+
// so we must provide extra roots from webpki-roots.
123+
#[cfg(target_os = "freebsd")]
124+
let verifier = Verifier::new_with_extra_roots(
125+
webpki_roots::TLS_SERVER_ROOTS
126+
.iter()
127+
.map(|ta| {
128+
rustls::OwnedTrustAnchor::from_subject_spki_name_constraints(
129+
ta.subject,
130+
ta.spki,
131+
ta.name_constraints,
132+
)
133+
})
134+
.collect::<Vec<_>>(),
135+
);
136+
137+
#[cfg(not(target_os = "freebsd"))]
121138
let verifier = Verifier::new();
122139

123140
let mut chain = test_case

‎rustls-platform-verifier/src/verification/mod.rs‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,17 @@
1-
#[cfg(any(target_os = "linux", target_arch = "wasm32"))]
1+
#[cfg(all(
2+
any(unix, target_arch = "wasm32"),
3+
not(target_os = "android"),
4+
not(target_os = "macos"),
5+
not(target_os = "ios")
6+
))]
27
mod others;
38

4-
#[cfg(any(target_os = "linux", target_arch = "wasm32"))]
9+
#[cfg(all(
10+
any(unix, target_arch = "wasm32"),
11+
not(target_os = "android"),
12+
not(target_os = "macos"),
13+
not(target_os = "ios")
14+
))]
515
pub use others::Verifier;
616

717
#[cfg(any(target_os = "macos", target_os = "ios"))]

0 commit comments

Comments
 (0)