Move, rather than clone, Certificate message

This saves some allocations and copies of relatively large data.

rustls/src/check.rs

@@ -24,7 +24,6 @@ macro_rules! require_handshake_msg(
 );
 
 /// Like require_handshake_msg, but moves the payload out of $m.
-#[cfg(feature = "tls12")]
 macro_rules! require_handshake_msg_move(
   ( $m:expr, $handshake_type:path, $payload_type:path ) => (
     match $m.payload {

rustls/src/client/tls13.rs

@@ -601,12 +601,12 @@ struct ExpectCertificate {
 
 impl State<ClientConnectionData> for ExpectCertificate {
     fn handle(mut self: Box<Self>, cx: &mut ClientContext<'_>, m: Message) -> hs::NextStateOrError {
-        let cert_chain = require_handshake_msg!(
+        self.transcript.add_message(&m);
+        let cert_chain = require_handshake_msg_move!(
             m,
             HandshakeType::Certificate,
             HandshakePayload::CertificateTls13
         )?;
-        self.transcript.add_message(&m);
 
         // This is only non-empty for client auth.
         if !cert_chain.context.0.is_empty() {
@@ -624,9 +624,8 @@ impl State<ClientConnectionData> for ExpectCertificate {
                 PeerMisbehaved::BadCertChainExtensions,
             ));
         }
-
-        let server_cert =
-            ServerCertDetails::new(cert_chain.convert(), cert_chain.get_end_entity_ocsp());
+        let end_entity_ocsp = cert_chain.get_end_entity_ocsp();
+        let server_cert = ServerCertDetails::new(cert_chain.convert(), end_entity_ocsp);
 
         Ok(Box::new(ExpectCertificateVerify {
             config: self.config,

rustls/src/msgs/handshake.rs

@@ -1448,12 +1448,11 @@ impl CertificatePayloadTls13 {
             .unwrap_or_default()
     }
 
-    pub(crate) fn convert(&self) -> CertificatePayload {
-        let mut ret = Vec::new();
-        for entry in &self.entries {
-            ret.push(entry.cert.clone());
-        }
-        ret
+    pub(crate) fn convert(self) -> CertificatePayload {
+        self.entries
+            .into_iter()
+            .map(|e| e.cert)
+            .collect()
     }
 }
 

rustls/src/server/tls13.rs

@@ -881,12 +881,12 @@ struct ExpectCertificate {
 
 impl State<ServerConnectionData> for ExpectCertificate {
     fn handle(mut self: Box<Self>, cx: &mut ServerContext<'_>, m: Message) -> hs::NextStateOrError {
-        let certp = require_handshake_msg!(
+        self.transcript.add_message(&m);
+        let certp = require_handshake_msg_move!(
             m,
             HandshakeType::Certificate,
             HandshakePayload::CertificateTls13
         )?;
-        self.transcript.add_message(&m);
 
         // We don't send any CertificateRequest extensions, so any extensions
         // here are illegal.