feat(bindings): expose context on cert chain #5132
Conversation
| /// This API will override an existing application context set on the Builder. | ||
| /// | ||
| /// Corresponds to [s2n_cert_chain_and_key_set_ctx]. | ||
| pub fn set_application_context<T: Send + Sync + 'static>( |
There was a problem hiding this comment.
This will only work when setting an application context on your own cert chain, right? Is there any reason you might want to set a context on a cert chain owned by s2n-tls? I wonder if this should be an API on the cert chain rather than the builder, similar to Connection::set_application_context()?
There was a problem hiding this comment.
Unfortunately, CertificateChain can be shared across threads, so we can't safely vend mutable access to the context unless we synchronize it/wrap it in a mutex. And even then, the mutex wouldn't be visible from the C side so it's possible that shenanigans in the C library might cause something to break.
There was a problem hiding this comment.
I think we're good because 1) a cert chain owned by s2n-tls is owned by the config, so you could just set config context (if the Rust bindings support that yet?) 2) application-owned certs are kind of soft deprecated, and we recommend they not be used.
Co-authored-by: Sam Clark <[email protected]>
* rename InternalContext to Context * return err if context is set multiple times
* null cert context
Co-authored-by: Sam Clark <[email protected]>
Description of changes:
This PR allows customer to set an application context on the
CertificateChainobject. This PR largely follows the approach that is used forConnectionand it's associated context object.Callouts
Option<Box<dyn Any>>on the actual builder struct and then only associate it with the connection during the build step. This might make the "override" logic a bit simpler, at the cost of making the builder struct more complicated.Testing:
I added unit tests which cover various context operations.
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.