Goal

Add rust binding for s2n_config_disable_x509_intent_verification() API

Why

Verifying certificate intent is a breaking change for some users. This disabling API serves as a workaround if impacted users can not update their invalid certs.

How

Invoke the FFI of the C function. I also added a ca_cert field to the CertKeyPair struct. Most of the unit tests pass the same cert/pem file to load_pem() and trust_pem(). However, we can not catch the CERT_INTENT_INVALID error in this way because our intent validation excludes the trust anchor. The unit test passed after I specified the correct CA cert.

Testing

Created a unit test to verify that given a certificate with invalid extensions,

• handshake succeeded by calling the rust binding API
• handshake failed due to CERT_INTENT_INVALID without the disabling API

Related

#5657

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.