tree 08e1b2f6a3e1d2bd980ef87520a8f284fc732a84
parent bbe16c18d2fc0ea4bc261b20dbc28fe53e32bf13
author QUICHE team <quiche-dev@google.com> 1747111612 -0700
committer Copybara-Service <copybara-worker@google.com> 1747111671 -0700

Add QUIC client support for Trust Anchor IDs

Design doc: https://docs.google.com/document/d/1aO36iL4lLve7X13j3COPz4D7465m64x8Si8i8W3JDDk/edit?resourcekey=0-x7c0yQk0k-MLysVvy4GI_g&tab=t.0#heading=h.bat9awopsp53

This CL adds QUIC client support for https://tlswg.org/tls-trust-anchor-ids/draft-ietf-tls-trust-anchor-ids.html. It adds a field to QuicSSLConfig that can be optionally be populated with a list of Trust Anchor IDs. If set, this will be used to configure BoringSSL to send the Trust Anchor IDs extension.

To be able to test this, I added some rudimentary server support, namely adding a |trust_anchor_id| to ProofSource::Chain which, if non-empty, is configured alongside the server certificate using the SSL_CREDENTIAL API (see go/ssl-credential). Further work will be needed for true TAI server support, but this (along with a getter to check if the server indicated that the certificate matched the client's TAI list) is enough to test the client code.

Protected by FLAGS_gfe2_reloadable_flag_enable_tls_trust_anchor_ids.

PiperOrigin-RevId: 758041574