feat(tls): make system certificates opt-in for HTTPS discovery (#2748)

Cargo.lock

@@ -2685,6 +2685,7 @@ dependencies = [
  "ring",
  "rustls",
  "rustls-pki-types",
+ "rustls-platform-verifier",
  "serde",
  "serde_json",
  "sha2 0.10.9",

easytier-core/Cargo.toml

@@ -55,6 +55,7 @@ rand.workspace = true
 quanta.workspace = true
 ring = { version = "0.17", optional = true }
 rustls = { workspace = true, features = ["ring", "std", "tls12"], optional = true }
+rustls-platform-verifier = { version = "0.7", optional = true }
 serde = { workspace = true, features = ["derive"] }
 serde_json.workspace = true
 sha2.workspace = true
@@ -121,6 +122,8 @@ endpoint-discovery = [
     "dep:tokio-rustls",
     "dep:webpki-roots",
 ]
+# Opt in to platform trust for HTTPS discovery; excluded from default features.
+system-certificates = ["endpoint-discovery", "dep:rustls-platform-verifier"]
 dhcp-ipv4 = []
 dhcp-ipv6 = []
 public-ipv6-provider = []

easytier-core/src/connectivity/manual/discovery/implementation.rs

@@ -7,6 +7,8 @@ use hyper::{Request, header};
 use hyper_util::rt::TokioIo;
 use rand::{Rng as _, seq::SliceRandom};
 use rustls::pki_types::ServerName;
+#[cfg(feature = "system-certificates")]
+use rustls_platform_verifier::BuilderVerifierExt as _;
 use tokio::io::{AsyncRead, AsyncWrite};
 use tokio_rustls::TlsConnector;
 use tokio_util::task::AbortOnDropHandle;
@@ -184,9 +186,6 @@ where
 
     if request.url.scheme() == "https" {
         let server_name = tls_server_name(&request.url)?;
-        let root_store = rustls::RootCertStore {
-            roots: webpki_roots::TLS_SERVER_ROOTS.to_vec(),
-        };
         // A host application can enable another rustls backend through Cargo
         // feature unification. Select ring explicitly instead of requiring a
         // process-wide provider to have been initialized first (#2607).
@@ -194,9 +193,16 @@ where
             rustls::crypto::ring::default_provider(),
         ))
         .with_safe_default_protocol_versions()
-        .context("selecting HTTPS protocol versions failed")?
-        .with_root_certificates(root_store)
-        .with_no_client_auth();
+        .context("selecting HTTPS protocol versions failed")?;
+        #[cfg(feature = "system-certificates")]
+        let tls_config = tls_config
+            .with_platform_verifier()
+            .context("loading platform TLS verifier failed")?;
+        #[cfg(not(feature = "system-certificates"))]
+        let tls_config = tls_config.with_root_certificates(rustls::RootCertStore {
+            roots: webpki_roots::TLS_SERVER_ROOTS.to_vec(),
+        });
+        let tls_config = tls_config.with_no_client_auth();
         let stream = TlsConnector::from(Arc::new(tls_config))
             .connect(server_name, socket)
             .await

easytier-core/src/lib.rs

@@ -1,3 +1,6 @@
+#[cfg(all(feature = "system-certificates", target_os = "android"))]
+compile_error!("the system-certificates feature is not supported on Android");
+
 pub mod config;
 pub mod connectivity;
 pub mod events;

easytier/Cargo.toml

@@ -426,6 +426,8 @@ endpoint-discovery = [
     "dep:rustls",
     "easytier-core/endpoint-discovery",
 ]
+# Trust policy is opt-in, including when building with full features.
+system-certificates = ["endpoint-discovery", "easytier-core/system-certificates"]
 dhcp-ipv4 = ["easytier-core/dhcp-ipv4"]
 dhcp-ipv6 = ["easytier-core/dhcp-ipv6"]
 public-ipv6-provider = ["linux-netlink", "easytier-core/public-ipv6-provider"]