server: add rustls_server_config_builder_set_send_tls13_tickets

[mattrobenolt]

Closes #652.

Note

This PR was AI generated using GLM 5.2.

What

Adds rustls_server_config_builder_set_num_tickets(builder, n) to expose ServerConfig::send_tls13_tickets through the C API. Mirrors the existing rustls_server_config_builder_set_ignore_client_order pattern: a new Option<usize> field on ServerConfigBuilder, a setter, and application at build() time. Defaults to None (rustls's own default of 2 applies), so this is a strictly additive, no-behavior-change-by-default feature.

Why

For TLS-library performance comparison benchmarks, NewSessionTicket issuance after a full handshake is a measurable distortion. rustls upstream established this in PR #2187 ("server: default send_tls13_tickets 4 -> 2"):

the extra 2 tickets cost us 8%/6% (client/server) of a normal resumption, or ~0%/2% of a full handshake. This also manifests when comparing default configurations between TLS libraries due to the high cost of creating new tickets ... It also avoids folks repeatedly tripping into this during benchmarking.

Both peer libraries expose a knob to suppress this:

• OpenSSL: SSL_CTX_set_num_tickets(ctx, 0)
• rustls (Rust API): server.send_tls13_tickets = 0

rustls-ffi was the one path that couldn't, so a C/Zig/Python benchmark driving rustls through the FFI could not get a handshake measurement equivalent to its peers — the rustls-ffi handshake row measured "handshake + 2 NewSessionTicket issuance" while peers measured "handshake only." The workaround of building a fresh config per connection prevents resumption (client offering PSK) but not ticket issuance (server still generates and sends the tickets).

Changes

• librustls/src/server.rs: send_tls13_tickets: Option<usize> field on ServerConfigBuilder (init None in both _new and _new_custom), rustls_server_config_builder_set_num_tickets setter, applied in rustls_server_config_builder_build. Test test_server_config_builder_set_num_tickets covering both 0 and a non-zero value.
• librustls/src/rustls.h: vendored header declaration.

Verification

• cargo test --no-default-features --features ring --locked — 35 passed (incl. new test)
• cargo fmt --check — clean
• cargo clippy --no-default-features --features ring --all-targets -- -D warnings -A unknown-lints — no warnings in changed code

(No cargo-c/capi build run locally; the C examples need cmake which isn't in my env. The header change is a straightforward declaration mirroring set_ignore_client_order.)

Notes

• No effect on TLS 1.2 connections (send_tls13_tickets is TLS 1.3 only in rustls).
• The name set_num_tickets mirrors OpenSSL's SSL_CTX_set_num_tickets for discoverability.
• This came out of evaluating whether to drive rustls from a Zig benchmark harness via rustls-ffi; the inability to disable ticket issuance was the one blocker (see Expose a way to set ServerConfig::send_tls13_tickets (disable TLS 1.3 session ticket issuance) #652).

[cpu]

Can you squash your commits as well? Thanks

[mattrobenolt]

Thanks @djc @cpu. Pushed an update addressing all the feedback:

• Removed the docstring on the send_tls13_tickets struct field (it is pub(crate), not publicly exposed, so no doccomment per the RFC 1574 guidelines).
• Trimmed the setter doc comment to a short summary + the "Setting this to 0 disables session ticket issuance entirely" behavior, matching the style of rustls_server_config_builder_set_ignore_client_order. Dropped the OpenSSL SSL_CTX_set_num_tickets citation and the benchmarking rationale from the API docs.
• Regenerated/aligned the vendored rustls.h declaration to match cbindgen output.
• Squashed into a single commit (e0a4c3d).

[mattrobenolt]

Pushed another update (831186e) addressing the latest feedback:

• @djc: the setter doc summary is now a single line, per RFC 1574 §"Summary sentence".
• @cpu: renamed to rustls_server_config_builder_set_send_tls13_tickets to match the upstream ServerConfig::send_tls13_tickets field name, consistent with how set_ignore_client_order mirrors ignore_client_order. Updated the header and regenerated api.json.
• @cpu: added the missing assert!(!config.is_null()); to the second build in the test.

Also renamed the test function to match and confirmed the header still regenerates cleanly with cbindgen.

[cpu]

Thanks