Expose the RFC 9266 tls-exporter channel binding via TlsInfo

[mike-marcacci]

Adds TlsInfo::tls_exporter_channel_binding(), returning the RFC 9266 tls-exporter channel binding for a connection (the TLS exporter with label EXPORTER-Channel-Binding, empty context, 32 bytes).

The channel binding lets applications cryptographically tie higher-layer authentication to the underlying TLS session to detect a man-in-the-middle that terminates and re-originates TLS, etc. This change simply exposes the value that rustls already computes.

A few caveats:

• Populated for the rustls backend; None for native-tls (no keying-material export is exposed).
• Gated to TLS 1.3. The exporter is only sound for channel binding on TLS 1.3 or TLS 1.2 with Extended Master Secret (RFC 7627), and the state of EMS cannot be known here. This returns None on anything below 1.3 rather than risk handing back a potentially unsound Some(_).

[mike-marcacci]

I want to elaborate on the TLS 1.3+ decision. I'm not particularly experienced in the underlying details of the various TLS versions, but here's my general understanding:

• TLS 1.3 has tls-exporter built in; any Some(value) provides a sound value, while None() indicated an anomaly
• TLS 1.2 without EMS available does not support tls-exporter channel blinding; None() is expected and Some(_) should be impossible
• TLS 1.2 with EMS available is the complicated scenario:
  • EMS gets negotiated per-connection, but rustls provides no mechanism for us to determine the negotiation's resolution for the current connection
  • If EMS was used, the value returned is sound
  • If EMS was not used, it's my understanding that the value is not sound

The approach I took here avoids ever returning an unsound value. However, I want to highlight that even when a sound value was used in TLS 1.2 with EMS, None() will be returned.

I believe this is the right approach.

[mike-marcacci]

I submitted an upstream PR to rustls to expose the EMS state, which would allow safe channel binding under TLS 1.2 with EMS: the conn.protocol_version() check can be augmented with a check for conn.extended_master_secret() once that lands.