maxlambrecht / rust-spiffe / 29654469186

84%

Build Type

push

github

Committed by web-flow

Commit Message

fix(rustls): harden material validation, watcher lifecycle, and resumption defaults (#370)

- certified_key_from_chain_and_key now verifies the private key matches
  the leaf certificate via CertifiedKey::from_der, failing at
  material-build time instead of opaquely at TLS signing time
- dedupe cert_chain_from_der_bytes/certs_from_der_bytes into a shared
  owned_certs_from_der_bytes helper
- MaterialWatcher now subscribes to X509Source updates before building
  its initial snapshot, closing a missed-rotation window; logs at error
  (was info) and tracks liveness when the source closes and the watcher
  freezes on its last known-good snapshot
- make the watcher loop testable via new SourceUpdates/X509WatchSource
  traits and a FakeSource; add tests for update, rebuild failure, and
  source-close behavior
- fix the verifier single-flight build cache wedging in Building
  forever if a build panics or returns early; add an RAII guard that
  resets state and wakes waiters on drop
- disable TLS session resumption by default in mtls_server/mtls_client,
  since rustls skips re-verification on resumed handshakes; matches
  SPIRE's own mitigation (spiffe/spire#6715)

Signed-off-by: Max Lambrecht <maxlambrecht@gmail.com>

Coverage Stats

235 of 243 new or added lines in 5 files covered. (96.71%)

1 existing line in 1 file now uncovered.

6547 of 7760 relevant lines covered (84.37%)

726.33 hits per line