Skip to content

Commit 56d5580

Browse files
xyzzyzxyzzyz
committed
.
1 parent aacd268 commit 56d5580

File tree

9 files changed

+86
-64
lines changed

9 files changed

+86
-64
lines changed

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,3 +2,4 @@ debug/
22
target/
33
**/*.rs.bk
44
*.pdb
5+
.idea/

‎Cargo.toml‎

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -19,12 +19,12 @@ resolver = "1" # Hack to enable the `custom` feature of `getrandom`
1919
# default features often have std breaking no_std and potentially other unwanted
2020
[dependencies]
2121
aead = { version = "0.5.2", default-features = false }
22-
aes-gcm = { version = "0.10.3", default-features = false, features = ["aes", "alloc"] }
23-
chacha20poly1305 = { version = "0.10.1", default-features = false }
22+
aes-gcm = { version = "0.10.3", default-features = false, features = ["aes", "alloc"], optional = true }
23+
chacha20poly1305 = { version = "0.10.1", default-features = false, optional = true }
2424
crypto-common = { version = "0.1.6", default-features = false }
2525
der = { version = "0.7.9", default-features = false }
2626
digest = { version = "0.10.7", default-features = false }
27-
ecdsa = { version = "0.16.8", default-features = false, features = ["alloc"] }
27+
ecdsa = { version = "0.16.8", default-features = false, features = ["alloc"], optional = true }
2828
ed25519-dalek = { version = "2", default-features = false, features = ["pkcs8"], optional = true }
2929
hmac = { version = "0.12.1", default-features = false }
3030
p256 = { version = "0.13.2", default-features = false, features = ["pem", "ecdsa", "ecdh"], optional = true }
@@ -37,17 +37,17 @@ rsa = { version = "0.9.2", default-features = false, features = ["sha2"], option
3737
rustls = { version = "0.23.12", default-features = false }
3838
sec1 = { version = "0.7.3", default-features = false, features = ["pkcs8", "pem"] }
3939
sha2 = { version = "0.10.7", default-features = false }
40-
signature = { version = "2.1.0", default-features = false }
40+
signature = { version = "2.1.0", default-features = false, features = ["rand_core", "alloc"] }
4141
webpki = { package = "rustls-webpki", version = "0.102.0", default-features = false }
4242
x25519-dalek = { version = "2", default-features = false, optional = true }
4343

4444
[dev-dependencies]
4545
getrandom = { version = "0.2", features = ["custom"] } # workaround to build on no_std targets
4646

4747
[features]
48-
default = ["std", "tls12", "zeroize"]
48+
default = ["std", "tls12", "zeroize", "quic", "aes-gcm", "chacha20poly1305", "rsa", "p256", "p384", "ed25519", "x25519"]
4949
logging = ["rustls/logging"]
50-
tls12 = ["rustls/tls12"]
50+
tls12 = ["rustls/tls12", "ecdsa"]
5151

5252
# Only enable feature in upstream if there is an overall effect e.g. aead/alloc in-place
5353
# zeroize is another typical that can be turned off
@@ -56,6 +56,12 @@ tls12 = ["rustls/tls12"]
5656
std = ["alloc", "webpki/std", "pki-types/std", "rustls/std"]
5757
# TODO: go through all of these to ensure to_vec etc. impls are exposed
5858
alloc = ["webpki/alloc", "pki-types/alloc", "aead/alloc"]
59-
zeroize = ["ed25519-dalek/zeroize", "x25519-dalek/zeroize"]
59+
zeroize = ["ed25519-dalek?/zeroize", "x25519-dalek?/zeroize"]
60+
quic = ["chacha20poly1305"]
61+
aes-gcm = ["dep:aes-gcm"]
62+
chacha20poly1305 = ["dep:chacha20poly1305"]
63+
ecdsa = ["dep:ecdsa"]
64+
p256 = ["dep:p256", "ecdsa"]
65+
p384 = ["dep:p384", "ecdsa"]
6066
x25519 = ["dep:x25519-dalek"]
6167
ed25519 = ["dep:ed25519-dalek", "ed25519-dalek/alloc", "ed25519-dalek/std", "alloc"]

‎src/aead.rs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
use aead::Buffer;
22
use rustls::crypto::cipher::{BorrowedPayload, PrefixedPayload};
33

4+
#[cfg(feature = "chacha20poly1305")]
45
pub mod chacha20;
56
pub mod gcm;
67

‎src/aead/chacha20.rs‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ use alloc::boxed::Box;
33

44
use super::{DecryptBufferAdapter, EncryptBufferAdapter};
55

6+
#[cfg(feature = "chacha20poly1305")]
67
use chacha20poly1305::{AeadInPlace, KeyInit, KeySizeUser};
78
use rustls::crypto::cipher::{
89
self, AeadKey, InboundOpaqueMessage, InboundPlainMessage, Iv, MessageDecrypter,
@@ -14,8 +15,12 @@ use rustls::{ConnectionTrafficSecrets, ContentType, ProtocolVersion};
1415
#[cfg(feature = "tls12")]
1516
use rustls::crypto::cipher::{KeyBlockShape, Tls12AeadAlgorithm, NONCE_LEN};
1617

18+
19+
#[cfg(feature = "chacha20poly1305")]
1720
pub struct Chacha20Poly1305;
1821

22+
23+
#[cfg(feature = "chacha20poly1305")]
1924
impl Tls13AeadAlgorithm for Chacha20Poly1305 {
2025
fn encrypter(&self, key: AeadKey, iv: Iv) -> Box<dyn MessageEncrypter> {
2126
Box::new(Tls13Cipher(

‎src/aead/gcm.rs‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -225,11 +225,13 @@ macro_rules! impl_gcm_tls12 {
225225
};
226226
}
227227

228+
#[cfg(feature = "aes-gcm")]
228229
impl_gcm_tls13! {Aes128Gcm, aes_gcm::Aes128Gcm, 16}
230+
#[cfg(feature = "aes-gcm")]
229231
impl_gcm_tls13! {Aes256Gcm, aes_gcm::Aes256Gcm, 16}
230232

231-
#[cfg(feature = "tls12")]
233+
#[cfg(all(feature = "tls12", feature = "aes-gcm"))]
232234
impl_gcm_tls12! {Aes128Gcm, aes_gcm::Aes128Gcm, TLS12_GCM_EXPLICIT_NONCE_LEN, TLS12_GCM_OVERHEAD}
233235

234-
#[cfg(feature = "tls12")]
236+
#[cfg(all(feature = "tls12", feature = "aes-gcm"))]
235237
impl_gcm_tls12! {Aes256Gcm, aes_gcm::Aes256Gcm, TLS12_GCM_EXPLICIT_NONCE_LEN, TLS12_GCM_OVERHEAD}

‎src/kx.rs‎

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,16 @@
1+
#[cfg(feature = "alloc")]
2+
use alloc::boxed::Box;
3+
4+
use crypto::{SharedSecret, SupportedKxGroup};
5+
use paste::paste;
6+
use rustls::crypto;
7+
18
#[cfg(feature = "x25519")]
29
#[derive(Debug)]
310
pub struct X25519;
411

512
#[cfg(feature = "x25519")]
6-
impl crypto::SupportedKxGroup for X25519 {
13+
impl SupportedKxGroup for X25519 {
714
fn name(&self) -> rustls::NamedGroup {
815
rustls::NamedGroup::X25519
916
}
@@ -23,7 +30,7 @@ pub struct X25519KeyExchange {
2330

2431
#[cfg(feature = "x25519")]
2532
impl crypto::ActiveKeyExchange for X25519KeyExchange {
26-
fn complete(self: Box<X25519KeyExchange>, peer: &[u8]) -> Result<crypto::SharedSecret, rustls::Error> {
33+
fn complete(self: Box<X25519KeyExchange>, peer: &[u8]) -> Result<SharedSecret, rustls::Error> {
2734
let peer_array: [u8; 32] = peer
2835
.try_into()
2936
.map_err(|_| rustls::Error::from(rustls::PeerMisbehaved::InvalidKeyShare))?;
@@ -45,7 +52,7 @@ impl crypto::ActiveKeyExchange for X25519KeyExchange {
4552

4653
macro_rules! impl_kx {
4754
($name:ident, $kx_name:ty, $secret:ty, $public_key:ty) => {
48-
paste::paste! {
55+
paste! {
4956

5057
#[derive(Debug)]
5158
#[allow(non_camel_case_types)]
@@ -76,7 +83,7 @@ macro_rules! impl_kx {
7683
fn complete(
7784
self: Box<[<$name KeyExchange>]>,
7885
peer: &[u8],
79-
) -> Result<crypto::SharedSecret, rustls::Error> {
86+
) -> Result<SharedSecret, rustls::Error> {
8087
let their_pub = $public_key::from_sec1_bytes(peer)
8188
.map_err(|_| rustls::Error::from(rustls::PeerMisbehaved::InvalidKeyShare))?;
8289
Ok(self
@@ -104,3 +111,11 @@ impl_kx! {SecP256R1, rustls::NamedGroup::secp256r1, p256::ecdh::EphemeralSecret,
104111
#[cfg(feature = "p384")]
105112
impl_kx! {SecP384R1, rustls::NamedGroup::secp384r1, p384::ecdh::EphemeralSecret, p384::PublicKey}
106113

114+
pub const ALL_KX_GROUPS: &[&dyn SupportedKxGroup] = &[
115+
#[cfg(feature = "x25519")]
116+
&X25519,
117+
#[cfg(feature = "p256")]
118+
&SecP256R1,
119+
#[cfg(feature = "p384")]
120+
&SecP384R1
121+
];

‎src/lib.rs‎

Lines changed: 39 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ use alloc::sync::Arc;
4444
use rustls::crypto::{
4545
CipherSuiteCommon, CryptoProvider, GetRandomFailed, KeyProvider, SecureRandom,
4646
};
47-
use rustls::{crypto, CipherSuite, SupportedCipherSuite, Tls13CipherSuite};
47+
use rustls::{CipherSuite, SupportedCipherSuite, Tls13CipherSuite};
4848

4949
#[cfg(feature = "tls12")]
5050
use rustls::SignatureScheme;
@@ -55,7 +55,7 @@ pub struct Provider;
5555
pub fn provider() -> CryptoProvider {
5656
CryptoProvider {
5757
cipher_suites: ALL_CIPHER_SUITES.to_vec(),
58-
kx_groups: ALL_KX_GROUPS.to_vec(),
58+
kx_groups: kx::ALL_KX_GROUPS.to_vec(),
5959
signature_verification_algorithms: verify::ALGORITHMS,
6060
secure_random: &Provider,
6161
key_provider: &Provider,
@@ -81,14 +81,16 @@ impl KeyProvider for Provider {
8181
}
8282

8383
#[cfg(feature = "tls12")]
84-
const TLS12_ECDSA_SCHEMES: [SignatureScheme; 4] = [
84+
const TLS12_ECDSA_SCHEMES: &[SignatureScheme] = &[
85+
#[cfg(feature = "p256")]
8586
SignatureScheme::ECDSA_NISTP256_SHA256,
87+
#[cfg(feature = "p384")]
8688
SignatureScheme::ECDSA_NISTP384_SHA384,
87-
SignatureScheme::ECDSA_NISTP521_SHA512,
89+
#[cfg(feature = "ed25519")]
8890
SignatureScheme::ED25519,
8991
];
9092

91-
#[cfg(feature = "tls12")]
93+
#[cfg(all(feature = "tls12", feature = "rsa"))]
9294
const TLS12_RSA_SCHEMES: [SignatureScheme; 6] = [
9395
SignatureScheme::RSA_PKCS1_SHA256,
9496
SignatureScheme::RSA_PKCS1_SHA384,
@@ -98,7 +100,7 @@ const TLS12_RSA_SCHEMES: [SignatureScheme; 6] = [
98100
SignatureScheme::RSA_PSS_SHA512,
99101
];
100102

101-
#[cfg(feature = "tls12")]
103+
#[cfg(all(feature = "tls12", feature = "aes-gcm"))]
102104
pub const TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: SupportedCipherSuite =
103105
SupportedCipherSuite::Tls12(&rustls::Tls12CipherSuite {
104106
common: CipherSuiteCommon {
@@ -107,12 +109,12 @@ pub const TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: SupportedCipherSuite =
107109
confidentiality_limit: u64::MAX,
108110
},
109111
kx: rustls::crypto::KeyExchangeAlgorithm::ECDHE,
110-
sign: &TLS12_ECDSA_SCHEMES,
112+
sign: TLS12_ECDSA_SCHEMES,
111113
aead_alg: &aead::gcm::Tls12Aes128Gcm,
112114
prf_provider: &rustls::crypto::tls12::PrfUsingHmac(hmac::SHA256),
113115
});
114116

115-
#[cfg(feature = "tls12")]
117+
#[cfg(all(feature = "tls12", feature = "aes-gcm"))]
116118
pub const TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384: SupportedCipherSuite =
117119
SupportedCipherSuite::Tls12(&rustls::Tls12CipherSuite {
118120
common: CipherSuiteCommon {
@@ -121,12 +123,12 @@ pub const TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384: SupportedCipherSuite =
121123
confidentiality_limit: u64::MAX,
122124
},
123125
kx: rustls::crypto::KeyExchangeAlgorithm::ECDHE,
124-
sign: &TLS12_ECDSA_SCHEMES,
126+
sign: TLS12_ECDSA_SCHEMES,
125127
prf_provider: &rustls::crypto::tls12::PrfUsingHmac(hmac::SHA384),
126128
aead_alg: &aead::gcm::Tls12Aes256Gcm,
127129
});
128130

129-
#[cfg(feature = "tls12")]
131+
#[cfg(all(feature = "tls12", feature = "chacha20poly1305"))]
130132
pub const TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256: SupportedCipherSuite =
131133
SupportedCipherSuite::Tls12(&rustls::Tls12CipherSuite {
132134
common: CipherSuiteCommon {
@@ -136,18 +138,12 @@ pub const TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256: SupportedCipherSuite =
136138
},
137139
prf_provider: &rustls::crypto::tls12::PrfUsingHmac(hmac::SHA256),
138140
kx: rustls::crypto::KeyExchangeAlgorithm::ECDHE,
139-
sign: &TLS12_ECDSA_SCHEMES,
141+
sign: TLS12_ECDSA_SCHEMES,
140142
aead_alg: &aead::chacha20::Chacha20Poly1305,
141143
});
142144

143-
#[cfg(feature = "tls12")]
144-
const TLS_ECDHE_ECDSA_SUITES: &[SupportedCipherSuite] = &[
145-
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
146-
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
147-
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
148-
];
149145

150-
#[cfg(feature = "tls12")]
146+
#[cfg(all(feature = "tls12", feature = "aes-gcm", feature = "rsa"))]
151147
pub const TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: SupportedCipherSuite =
152148
SupportedCipherSuite::Tls12(&rustls::Tls12CipherSuite {
153149
common: CipherSuiteCommon {
@@ -161,7 +157,7 @@ pub const TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: SupportedCipherSuite =
161157
prf_provider: &rustls::crypto::tls12::PrfUsingHmac(hmac::SHA256),
162158
});
163159

164-
#[cfg(feature = "tls12")]
160+
#[cfg(all(feature = "tls12", feature = "aes-gcm", feature = "ecdsa", feature = "rsa"))]
165161
pub const TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384: SupportedCipherSuite =
166162
SupportedCipherSuite::Tls12(&rustls::Tls12CipherSuite {
167163
common: CipherSuiteCommon {
@@ -175,7 +171,7 @@ pub const TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384: SupportedCipherSuite =
175171
aead_alg: &aead::gcm::Tls12Aes256Gcm,
176172
});
177173

178-
#[cfg(feature = "tls12")]
174+
#[cfg(all(feature = "tls12", feature = "rsa", feature = "chacha20poly1305"))]
179175
pub const TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256: SupportedCipherSuite =
180176
SupportedCipherSuite::Tls12(&rustls::Tls12CipherSuite {
181177
common: CipherSuiteCommon {
@@ -189,23 +185,26 @@ pub const TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256: SupportedCipherSuite =
189185
aead_alg: &aead::chacha20::Chacha20Poly1305,
190186
});
191187

192-
#[cfg(feature = "tls12")]
193-
const TLS_ECDHE_RSA_SUITES: &[SupportedCipherSuite] = &[
188+
#[cfg(all(feature = "tls12", feature = "ecdsa"))]
189+
const TLS12_SUITES: &[SupportedCipherSuite] = &[
190+
#[cfg(feature = "aes-gcm")]
191+
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
192+
#[cfg(feature = "aes-gcm")]
193+
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
194+
#[cfg(feature = "chacha20poly1305")]
195+
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
196+
#[cfg(all(feature = "rsa", feature = "aes-gcm"))]
194197
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
198+
#[cfg(all(feature = "rsa", feature = "aes-gcm"))]
195199
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
200+
#[cfg(all(feature = "rsa", feature = "chacha20poly1305"))]
196201
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
197202
];
198203

199-
#[cfg(feature = "tls12")]
200-
const TLS12_SUITES: &[SupportedCipherSuite] = misc::const_concat_slices!(
201-
SupportedCipherSuite,
202-
TLS_ECDHE_ECDSA_SUITES,
203-
TLS_ECDHE_RSA_SUITES
204-
);
205-
206204
#[cfg(not(feature = "tls12"))]
207205
const TLS12_SUITES: &[SupportedCipherSuite] = &[];
208206

207+
#[cfg(feature = "aes-gcm")]
209208
pub const TLS13_AES_128_GCM_SHA256: SupportedCipherSuite =
210209
SupportedCipherSuite::Tls13(&Tls13CipherSuite {
211210
common: CipherSuiteCommon {
@@ -218,6 +217,7 @@ pub const TLS13_AES_128_GCM_SHA256: SupportedCipherSuite =
218217
quic: None,
219218
});
220219

220+
#[cfg(feature = "aes-gcm")]
221221
pub const TLS13_AES_256_GCM_SHA384: SupportedCipherSuite =
222222
SupportedCipherSuite::Tls13(&Tls13CipherSuite {
223223
common: CipherSuiteCommon {
@@ -230,9 +230,7 @@ pub const TLS13_AES_256_GCM_SHA384: SupportedCipherSuite =
230230
quic: None,
231231
});
232232

233-
const TLS13_AES_SUITES: &[SupportedCipherSuite] =
234-
&[TLS13_AES_128_GCM_SHA256, TLS13_AES_256_GCM_SHA384];
235-
233+
#[cfg(feature = "chacha20poly1305")]
236234
pub const TLS13_CHACHA20_POLY1305_SHA256: SupportedCipherSuite =
237235
SupportedCipherSuite::Tls13(&Tls13CipherSuite {
238236
common: CipherSuiteCommon {
@@ -245,11 +243,14 @@ pub const TLS13_CHACHA20_POLY1305_SHA256: SupportedCipherSuite =
245243
quic: None,
246244
});
247245

248-
const TLS13_SUITES: &[SupportedCipherSuite] = misc::const_concat_slices!(
249-
SupportedCipherSuite,
250-
TLS13_AES_SUITES,
251-
&[TLS13_CHACHA20_POLY1305_SHA256]
252-
);
246+
const TLS13_SUITES: &[SupportedCipherSuite] = &[
247+
#[cfg(feature = "aes-gcm")]
248+
TLS13_AES_128_GCM_SHA256,
249+
#[cfg(feature = "aes-gcm")]
250+
TLS13_AES_256_GCM_SHA384,
251+
#[cfg(feature = "chacha20poly1305")]
252+
TLS13_CHACHA20_POLY1305_SHA256
253+
];
253254

254255
static ALL_CIPHER_SUITES: &[SupportedCipherSuite] = misc::const_concat_slices!(
255256
SupportedCipherSuite,
@@ -272,22 +273,13 @@ pub use verify::eddsa::ED25519;
272273
#[cfg(feature = "rsa")]
273274
pub use verify::rsa::{RSA_PKCS1_SHA256, RSA_PKCS1_SHA384, RSA_PKCS1_SHA512, RSA_PSS_SHA256, RSA_PSS_SHA384, RSA_PSS_SHA512};
274275

275-
const ALL_KX_GROUPS: &[&dyn crypto::SupportedKxGroup] = &[
276-
#[cfg(feature = "x25519")]
277-
&X25519,
278-
#[cfg(feature = "p256")]
279-
&SecP256R1,
280-
#[cfg(feature = "p384")]
281-
&SecP384R1
282-
];
283-
284276
mod aead;
285277
mod hash;
286278
mod hmac;
287279

288-
#[cfg(any(feature = "x25519", feature = "p256", feature = "p384"))]
289280
mod kx;
290281
mod misc;
282+
#[cfg(feature = "quic")]
291283
pub mod quic;
292284
pub mod sign;
293285
mod verify;

0 commit comments

Comments
 (0)