fix(iroh)!: Update dependencies & fix 0-RTT with newer rustls by pulling the expected NodeId out of the ServerName in verifiers

[matheus23]

Description

This is code that will both update deps like #3288 but also makes 0-RTT tests pass again.

They were failing due to a change in rustls:

Behavior change: Clients no longer offer resumption between different ClientConfigs that share a resumption store but do not share server certificate verification and client authentication credentials. If you share a resumption store between multiple ClientConfigs, please ensure their server certificate verification and client authentication credentials are also shared. Please read the new documentation on the ClientConfig::resumption item for details.

Additionally, if you share a resumption store or ticketer between multiple ServerConfigs, please see the new documentation on ServerConfig about this.

Essentially what they're doing is checking that the certificate verifiers are Arc::prt_eq and depending on that allow or disallow 0-RTT.

When running the tests with rustls logging enabled, I confirmed that this is indeed what's happening:

[TRACE rustls::msgs::persist] resumption not allowed between different ServerCertVerifiers

---

The fix isn't straight-forward.
The reason we're creating new ServerVerifiers every time is that we're passing in the expected remote node ID every time.

There used to be no other way of grabbing the other node's ID in the verifier, until, coincidentally #3146 landed, which changed the server name that's set when connecting from always being localhost to <base32 NodeId>.iroh.invalid.

I'm now pulling in that value from the ServerName that's passed to the ServerCertificateVerifier in verify_server_cert.
As far as I understand that value should be a client-set value not a value we get over the network.

The downside of doing this is that we'll not be compatible with iroh versions that don't use the <base32 NodeId>.iroh.invalid server names.

---

There's an unrelated change in here that's changing make_client_config and make_server_config infallible, as was done in #3161, which will definitely also have merge conflicts with this PR.

Breaking Changes

• Router::spawn is now a plain function instead of an async fn
• Router::spawn is now infallible, instead of returning anyhow::Result<()>

Change checklist

• Self-review.
• Documentation updates following the style guide, if relevant.
• All breaking changes documented.
  • List all breaking changes in the above "Breaking Changes" section.

[github-actions]

Documentation for this PR has been generated and is available at: https://n0-computer.github.io/iroh/pr/3290/docs/iroh/

Last updated: 2025-05-07T11:37:57Z

[Frando]

Cannot connect to iroh nodes of versions 0.32 or below due to changes in how the TLS setup works. (Accepting incoming connections should keep working just fine.)

Deltachat only updated to 0.33 ~2 months ago, so I presume that this change would mean that Deltachat cannot update to 0.35 because this would be a wire-level breaking change towards all Deltachat versions which are older than 2 months. AFAIK deltachat so far intended to update to 0.35 as a last update before iroh 1.0.

[matheus23]

Yeah honestly, I think this PR should probably not go into this release.

Regressing 0-RTT in this release vs. what is effectively a soft wire-breaking change makes me choose regressing 0-RTT.

This is all incorrect. See the comment below.

[matheus23]

Actually @flub correctly pointed out: It's not actually a wire-breaking change! As I write in the PR review comment, the server_name that's checked isn't the one that's set from the remote node, it's the server name that we set. Thus, there's no breaking change concerns.

This is easy enough to test, so I pulled out the echo.rs example at tag v0.32.0 and this branch's echo.rs example, and let them connect to each other via a small modification so I could enter a NodeTicket, and yeah, it works.

I didn't test 0-RTT, since (1) the changes in this PR are actually only tangentially relevant to 0-RTT and are more changes to how we configure rustls' client authentication/server authentication, and (2) because version 0.32 didn't have 0-RTT support.

[github-actions]

Netsim report & logs for this PR have been generated and is available at: LOGS
This report will remain available for 3 days.

Last updated for commit: 6d2e4c6

[matheus23]

Not updating redb as that'd be MSRV breaking