squash: inject TimeProvider into top of config builder construction

rustls/src/builder.rs

@@ -1,4 +1,5 @@
 use crate::error::Error;
+use crate::time_provider::TimeProvider;
 use crate::versions;
 use crate::{crypto::CryptoProvider, msgs::handshake::ALL_KEY_EXCHANGE_ALGORITHMS};
 
@@ -184,6 +185,7 @@ impl<Side: ConfigSide, State: fmt::Debug> fmt::Debug for ConfigBuilder<Side, Sta
 #[derive(Clone, Debug)]
 pub struct WantsVersions {
     pub(crate) provider: Arc<CryptoProvider>,
+    pub(crate) time_provider: Arc<dyn TimeProvider>,
 }
 
 impl<S: ConfigSide> ConfigBuilder<S, WantsVersions> {
@@ -248,6 +250,7 @@ impl<S: ConfigSide> ConfigBuilder<S, WantsVersions> {
             state: WantsVerifier {
                 provider: self.state.provider,
                 versions: versions::EnabledVersions::new(versions),
+                time_provider: self.state.time_provider,
             },
             side: self.side,
         })
@@ -261,6 +264,7 @@ impl<S: ConfigSide> ConfigBuilder<S, WantsVersions> {
 pub struct WantsVerifier {
     pub(crate) provider: Arc<CryptoProvider>,
     pub(crate) versions: versions::EnabledVersions,
+    pub(crate) time_provider: Arc<dyn TimeProvider>,
 }
 
 /// Helper trait to abstract [`ConfigBuilder`] over building a [`ClientConfig`] or [`ServerConfig`].

rustls/src/client/builder.rs

@@ -5,8 +5,7 @@ use crate::crypto::CryptoProvider;
 use crate::error::Error;
 use crate::key_log::NoKeyLog;
 use crate::msgs::handshake::CertificateChain;
-#[cfg(feature = "std")]
-use crate::time_provider::DefaultTimeProvider;
+use crate::time_provider::TimeProvider;
 use crate::webpki::{self, WebPkiServerVerifier};
 use crate::{verify, versions};
 
@@ -58,6 +57,7 @@ impl ConfigBuilder<ClientConfig, WantsVerifier> {
                 provider: self.state.provider,
                 versions: self.state.versions,
                 verifier,
+                time_provider: self.state.time_provider,
             },
             side: PhantomData,
         }
@@ -96,6 +96,7 @@ pub(super) mod danger {
                     provider: self.cfg.state.provider,
                     versions: self.cfg.state.versions,
                     verifier,
+                    time_provider: self.cfg.state.time_provider,
                 },
                 side: PhantomData,
             }
@@ -112,11 +113,9 @@ pub struct WantsClientCert {
     provider: Arc<CryptoProvider>,
     versions: versions::EnabledVersions,
     verifier: Arc<dyn verify::ServerCertVerifier>,
+    time_provider: Arc<dyn TimeProvider>,
 }
 
-// When the std feature is enabled we use the default time provider and move directly from
-// WantsClientCert to ClientConfig.
-#[cfg(feature = "std")]
 impl ConfigBuilder<ClientConfig, WantsClientCert> {
     /// Sets a single certificate chain and matching private key for use
     /// in client authentication.
@@ -166,97 +165,7 @@ impl ConfigBuilder<ClientConfig, WantsClientCert> {
             enable_early_data: false,
             #[cfg(feature = "tls12")]
             require_ems: cfg!(feature = "fips"),
-            time_provider: Arc::new(DefaultTimeProvider),
-        }
-    }
-}
-
-// When the std feature is not enabled we have an extra state in the config builder process
-// for providing a time provider.
-#[cfg(not(feature = "std"))]
-impl ConfigBuilder<ClientConfig, WantsClientCert> {
-    /// Sets a single certificate chain and matching private key for use
-    /// in client authentication.
-    ///
-    /// `cert_chain` is a vector of DER-encoded certificates.
-    /// `key_der` is a DER-encoded private key as PKCS#1, PKCS#8, or SEC1. The
-    /// `aws-lc-rs` and `ring` [`CryptoProvider`]s support all three encodings,
-    /// but other `CryptoProviders` may not.
-    ///
-    /// This function fails if `key_der` is invalid.
-    pub fn with_client_auth_cert(
-        self,
-        cert_chain: Vec<CertificateDer<'static>>,
-        key_der: PrivateKeyDer<'static>,
-    ) -> Result<ConfigBuilder<ClientConfig, WantsTimeProvider>, Error> {
-        let private_key = self
-            .state
-            .provider
-            .key_provider
-            .load_private_key(key_der)?;
-        let resolver =
-            handy::AlwaysResolvesClientCert::new(private_key, CertificateChain(cert_chain))?;
-        Ok(self.with_client_cert_resolver(Arc::new(resolver)))
-    }
-
-    /// Do not support client auth.
-    pub fn with_no_client_auth(self) -> ConfigBuilder<ClientConfig, WantsTimeProvider> {
-        self.with_client_cert_resolver(Arc::new(handy::FailResolveClientCert {}))
-    }
-
-    /// Sets a custom [`ResolvesClientCert`].
-    pub fn with_client_cert_resolver(
-        self,
-        client_auth_cert_resolver: Arc<dyn ResolvesClientCert>,
-    ) -> ConfigBuilder<ClientConfig, WantsTimeProvider> {
-        ConfigBuilder {
-            state: WantsTimeProvider {
-                provider: self.state.provider,
-                versions: self.state.versions,
-                verifier: self.state.verifier,
-                client_auth_cert_resolver,
-            },
-            side: PhantomData,
-        }
-    }
-}
-
-/// A config builder state where the caller needs to supply a [`TimeProvider`].
-///
-/// For more information, see the [`ConfigBuilder`] documentation.
-///
-/// [`TimeProvider`]: crate::time_provider::TimeProvider
-#[cfg(not(feature = "std"))]
-#[derive(Clone)]
-pub struct WantsTimeProvider {
-    provider: Arc<CryptoProvider>,
-    versions: versions::EnabledVersions,
-    verifier: Arc<dyn verify::ServerCertVerifier>,
-    client_auth_cert_resolver: Arc<dyn ResolvesClientCert>,
-}
-
-#[cfg(not(feature = "std"))]
-impl ConfigBuilder<ClientConfig, WantsTimeProvider> {
-    /// Sets a custom [`crate::time_provider::TimeProvider`].
-    pub fn with_time_provider(
-        self,
-        time_provider: Arc<dyn crate::time_provider::TimeProvider>,
-    ) -> ClientConfig {
-        ClientConfig {
-            provider: self.state.provider,
-            alpn_protocols: Vec::new(),
-            resumption: Resumption::default(),
-            max_fragment_size: None,
-            client_auth_cert_resolver: self.state.client_auth_cert_resolver,
-            versions: self.state.versions,
-            enable_sni: true,
-            verifier: self.state.verifier,
-            key_log: Arc::new(NoKeyLog {}),
-            enable_secret_extraction: false,
-            enable_early_data: false,
-            #[cfg(feature = "tls12")]
-            require_ems: cfg!(feature = "fips"),
-            time_provider,
+            time_provider: self.state.time_provider,
         }
     }
 }

rustls/src/client/client_conn.rs

@@ -11,11 +11,15 @@ use crate::msgs::handshake::ClientExtension;
 use crate::msgs::persist;
 use crate::sign;
 use crate::suites::SupportedCipherSuite;
+#[cfg(feature = "std")]
+use crate::time_provider::DefaultTimeProvider;
 use crate::time_provider::TimeProvider;
 use crate::unbuffered::{EncryptError, TransmitTlsData};
 use crate::versions;
 use crate::KeyLog;
-use crate::{verify, WantsVerifier, WantsVersions};
+#[cfg(feature = "std")]
+use crate::WantsVerifier;
+use crate::{verify, WantsVersions};
 
 use super::handy::NoClientSessionStorage;
 use super::hs;
@@ -225,6 +229,7 @@ impl ClientConfig {
     /// and safe protocol version defaults.
     ///
     /// For more information, see the [`ConfigBuilder`] documentation.
+    #[cfg(feature = "std")]
     pub fn builder() -> ConfigBuilder<Self, WantsVerifier> {
         Self::builder_with_protocol_versions(versions::DEFAULT_VERSIONS)
     }
@@ -241,6 +246,7 @@ impl ClientConfig {
     ///   the crate features and process default.
     ///
     /// For more information, see the [`ConfigBuilder`] documentation.
+    #[cfg(feature = "std")]
     pub fn builder_with_protocol_versions(
         versions: &[&'static versions::SupportedProtocolVersion],
     ) -> ConfigBuilder<Self, WantsVerifier> {
@@ -262,11 +268,41 @@ impl ClientConfig {
     /// version is not supported by the provider's ciphersuites.
     ///
     /// For more information, see the [`ConfigBuilder`] documentation.
+    #[cfg(feature = "std")]
     pub fn builder_with_provider(
         provider: Arc<CryptoProvider>,
     ) -> ConfigBuilder<Self, WantsVersions> {
         ConfigBuilder {
-            state: WantsVersions { provider },
+            state: WantsVersions {
+                provider,
+                time_provider: Arc::new(DefaultTimeProvider),
+            },
+            side: PhantomData,
+        }
+    }
+    /// Create a builder for a client configuration with no default implementation details.
+    ///
+    /// This API must be used by `no_std` users.
+    ///
+    /// You must provide a specific [`TimeProvider`].
+    ///
+    /// You must provide a specific [`CryptoProvider`].
+    ///
+    /// This will use the provider's configured ciphersuites. You must additionally choose
+    /// which protocol versions to enable, using `with_protocol_versions` or
+    /// `with_safe_default_protocol_versions` and handling the `Result` in case a protocol
+    /// version is not supported by the provider's ciphersuites.
+    ///
+    /// For more information, see the [`ConfigBuilder`] documentation.
+    pub fn builder_with_details(
+        provider: Arc<CryptoProvider>,
+        time_provider: Arc<dyn TimeProvider>,
+    ) -> ConfigBuilder<Self, WantsVersions> {
+        ConfigBuilder {
+            state: WantsVersions {
+                provider,
+                time_provider,
+            },
             side: PhantomData,
         }
     }