Take rustls-platform-verifier 0.6

Handle fallible verifier creation.

Disable miri isolation as the existing tests now touch the
file system (to load root certs).

Author: ctz

.github/workflows/test.yaml

@@ -414,6 +414,9 @@ jobs:
   miri:
     name: Miri
     runs-on: ubuntu-latest
+    env:
+      # allows platform-verifier initialisation to inspect filesystem
+      MIRIFLAGS: -Zmiri-disable-isolation
     steps:
       - name: Checkout sources
         uses: actions/checkout@v4

Cargo.lock

@@ -16,7 +16,7 @@ rustls = { version = "0.23", default-features = false, features = ["std", "tls12
 webpki = { package = "rustls-webpki", version = "0.103", default-features = false, features = ["std"] }
 libc = "0.2"
 log = "0.4.22"
-rustls-platform-verifier = "0.5.3"
+rustls-platform-verifier = "0.6"
 regex = "1.9.6"
 toml = { version = "0.8", default-features = false, features = ["parse"] }
 hickory-resolver = { version = "0.25", features = ["https-aws-lc-rs", "webpki-roots"] }

Cargo.toml

@@ -2795,6 +2795,9 @@ rustls_result rustls_platform_server_cert_verifier(struct rustls_server_cert_ver
  * The verifier can be used in several `rustls_client_config` instances and must be freed by
  * the application using `rustls_server_cert_verifier_free` when no longer needed.
  *
+ * If the initialization of `rustls-platform-verifier` fails, this function returns
+ * `NULL`.
+ *
  * [`rustls-platform-verifier`]: https://github.com/rustls/rustls-platform-verifier
  */
 struct rustls_server_cert_verifier *rustls_platform_server_cert_verifier_with_provider(const struct rustls_crypto_provider *provider);

librustls/src/rustls.h

@@ -666,9 +666,11 @@ impl rustls_server_cert_verifier {
                 Some(provider) => provider,
                 None => return rustls_result::NoDefaultCryptoProvider,
             };
-            let verifier: Arc<dyn ServerCertVerifier> =
-                Arc::new(rustls_platform_verifier::Verifier::new().with_provider(provider));
-            set_boxed_mut_ptr(verifier_out, verifier);
+            let verifier = match rustls_platform_verifier::Verifier::new(provider) {
+                Ok(v) => v,
+                Err(e) => return error::map_error(e),
+            };
+            set_boxed_mut_ptr(verifier_out, Arc::new(verifier));
             rustls_result::Ok
         }
     }
@@ -680,6 +682,9 @@ impl rustls_server_cert_verifier {
     /// The verifier can be used in several `rustls_client_config` instances and must be freed by
     /// the application using `rustls_server_cert_verifier_free` when no longer needed.
     ///
+    /// If the initialization of `rustls-platform-verifier` fails, this function returns
+    /// `NULL`.
+    ///
     /// [`rustls-platform-verifier`]: https://github.com/rustls/rustls-platform-verifier
     #[no_mangle]
     pub extern "C" fn rustls_platform_server_cert_verifier_with_provider(
@@ -688,7 +693,10 @@ impl rustls_server_cert_verifier {
         ffi_panic_boundary! {
             let provider = try_clone_arc!(provider);
             let verifier: Arc<dyn ServerCertVerifier> =
-                Arc::new(rustls_platform_verifier::Verifier::new().with_provider(provider));
+                match rustls_platform_verifier::Verifier::new(provider) {
+                    Ok(v) => Arc::new(v),
+                    Err(_) => return core::ptr::null_mut(),
+                };
             to_boxed_mut_ptr(verifier)
         }
     }

librustls/src/verifier.rs

@@ -14,7 +14,6 @@ use rustls_ffi::rustls_version;
 ///
 /// If this test starts to fail, you probably forgot to update `RUSTLS_CRATE_VERSION` in
 /// `build.rs`.
-#[cfg_attr(miri, ignore)] // Requires file I/O
 #[test]
 fn rustls_version_match() {
     // Parse Cargo.toml as a generic TOML Table.