20260510 增加strict策略模式并隔离多TA失败

src/validation/from_tal.rs

@@ -57,10 +57,42 @@ pub fn discover_root_ca_instance_from_tal_url(
     discover_root_ca_instance_from_tal(http_fetcher, tal, Some(tal_url.to_string()))
 }
 
+pub fn discover_root_ca_instance_from_tal_url_with_strict_name(
+    http_fetcher: &dyn Fetcher,
+    tal_url: &str,
+) -> Result<DiscoveredRootCaInstance, FromTalError> {
+    let tal_bytes = http_fetcher
+        .fetch(tal_url)
+        .map_err(FromTalError::TalFetch)?;
+    let tal = Tal::decode_bytes(&tal_bytes)?;
+    discover_root_ca_instance_from_tal_with_strict_name(
+        http_fetcher,
+        tal,
+        Some(tal_url.to_string()),
+    )
+}
+
 pub fn discover_root_ca_instance_from_tal(
     http_fetcher: &dyn Fetcher,
     tal: Tal,
     tal_url: Option<String>,
+) -> Result<DiscoveredRootCaInstance, FromTalError> {
+    discover_root_ca_instance_from_tal_impl(http_fetcher, tal, tal_url, false)
+}
+
+pub fn discover_root_ca_instance_from_tal_with_strict_name(
+    http_fetcher: &dyn Fetcher,
+    tal: Tal,
+    tal_url: Option<String>,
+) -> Result<DiscoveredRootCaInstance, FromTalError> {
+    discover_root_ca_instance_from_tal_impl(http_fetcher, tal, tal_url, true)
+}
+
+fn discover_root_ca_instance_from_tal_impl(
+    http_fetcher: &dyn Fetcher,
+    tal: Tal,
+    tal_url: Option<String>,
+    strict_name: bool,
 ) -> Result<DiscoveredRootCaInstance, FromTalError> {
     if tal.ta_uris.is_empty() {
         return Err(FromTalError::NoTaUris);
@@ -76,13 +108,14 @@ pub fn discover_root_ca_instance_from_tal(
             }
         };
 
-        let trust_anchor = match TrustAnchor::bind_der(tal.clone(), &ta_der, Some(ta_uri)) {
-            Ok(ta) => ta,
-            Err(e) => {
-                last_err = Some(format!("bind {ta_uri} failed: {e}"));
-                continue;
-            }
-        };
+        let trust_anchor =
+            match bind_trust_anchor_der(tal.clone(), &ta_der, Some(ta_uri), strict_name) {
+                Ok(ta) => ta,
+                Err(e) => {
+                    last_err = Some(format!("bind {ta_uri} failed: {e}"));
+                    continue;
+                }
+            };
 
         let ca_instance =
             match ca_instance_uris_from_ca_certificate(&trust_anchor.ta_certificate.rc_ca) {
@@ -110,6 +143,37 @@ pub fn discover_root_ca_instance_from_tal_with_fetchers(
     rsync_fetcher: &dyn RsyncFetcher,
     tal: Tal,
     tal_url: Option<String>,
+) -> Result<DiscoveredRootCaInstance, FromTalError> {
+    discover_root_ca_instance_from_tal_with_fetchers_impl(
+        http_fetcher,
+        rsync_fetcher,
+        tal,
+        tal_url,
+        false,
+    )
+}
+
+pub fn discover_root_ca_instance_from_tal_with_fetchers_strict_name(
+    http_fetcher: &dyn Fetcher,
+    rsync_fetcher: &dyn RsyncFetcher,
+    tal: Tal,
+    tal_url: Option<String>,
+) -> Result<DiscoveredRootCaInstance, FromTalError> {
+    discover_root_ca_instance_from_tal_with_fetchers_impl(
+        http_fetcher,
+        rsync_fetcher,
+        tal,
+        tal_url,
+        true,
+    )
+}
+
+fn discover_root_ca_instance_from_tal_with_fetchers_impl(
+    http_fetcher: &dyn Fetcher,
+    rsync_fetcher: &dyn RsyncFetcher,
+    tal: Tal,
+    tal_url: Option<String>,
+    strict_name: bool,
 ) -> Result<DiscoveredRootCaInstance, FromTalError> {
     if tal.ta_uris.is_empty() {
         return Err(FromTalError::NoTaUris);
@@ -127,13 +191,14 @@ pub fn discover_root_ca_instance_from_tal_with_fetchers(
             }
         };
 
-        let trust_anchor = match TrustAnchor::bind_der(tal.clone(), &ta_der, Some(ta_uri)) {
-            Ok(ta) => ta,
-            Err(e) => {
-                last_err = Some(format!("bind {ta_uri} failed: {e}"));
-                continue;
-            }
-        };
+        let trust_anchor =
+            match bind_trust_anchor_der(tal.clone(), &ta_der, Some(ta_uri), strict_name) {
+                Ok(ta) => ta,
+                Err(e) => {
+                    last_err = Some(format!("bind {ta_uri} failed: {e}"));
+                    continue;
+                }
+            };
 
         let ca_instance =
             match ca_instance_uris_from_ca_certificate(&trust_anchor.ta_certificate.rc_ca) {
@@ -168,6 +233,19 @@ fn fetch_ta_der(
     }
 }
 
+fn bind_trust_anchor_der(
+    tal: Tal,
+    ta_der: &[u8],
+    resolved_uri: Option<&Url>,
+    strict_name: bool,
+) -> Result<TrustAnchor, TrustAnchorError> {
+    if strict_name {
+        TrustAnchor::bind_der_with_strict_name(tal, ta_der, resolved_uri)
+    } else {
+        TrustAnchor::bind_der(tal, ta_der, resolved_uri)
+    }
+}
+
 fn fetch_ta_der_via_rsync(
     rsync_fetcher: &dyn RsyncFetcher,
     ta_rsync_uri: &str,
@@ -213,9 +291,26 @@ pub fn discover_root_ca_instance_from_tal_and_ta_der(
     tal_bytes: &[u8],
     ta_der: &[u8],
     resolved_ta_uri: Option<&Url>,
+) -> Result<DiscoveredRootCaInstance, FromTalError> {
+    discover_root_ca_instance_from_tal_and_ta_der_impl(tal_bytes, ta_der, resolved_ta_uri, false)
+}
+
+pub fn discover_root_ca_instance_from_tal_and_ta_der_with_strict_name(
+    tal_bytes: &[u8],
+    ta_der: &[u8],
+    resolved_ta_uri: Option<&Url>,
+) -> Result<DiscoveredRootCaInstance, FromTalError> {
+    discover_root_ca_instance_from_tal_and_ta_der_impl(tal_bytes, ta_der, resolved_ta_uri, true)
+}
+
+fn discover_root_ca_instance_from_tal_and_ta_der_impl(
+    tal_bytes: &[u8],
+    ta_der: &[u8],
+    resolved_ta_uri: Option<&Url>,
+    strict_name: bool,
 ) -> Result<DiscoveredRootCaInstance, FromTalError> {
     let tal = Tal::decode_bytes(tal_bytes)?;
-    let trust_anchor = TrustAnchor::bind_der(tal, ta_der, resolved_ta_uri)?;
+    let trust_anchor = bind_trust_anchor_der(tal, ta_der, resolved_ta_uri, strict_name)?;
     let ca_instance = ca_instance_uris_from_ca_certificate(&trust_anchor.ta_certificate.rc_ca)?;
     Ok(DiscoveredRootCaInstance {
         tal_url: None,