Skip to content

Commit f6bdd23

Browse files
ajewellamzajewellamz
authored
chore(rust): provide fips feature flag (#1703)
1 parent 5f2aa33 commit f6bdd23

File tree

9 files changed

+115
-65
lines changed

9 files changed

+115
-65
lines changed

‎.github/workflows/library_rust_tests.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,12 @@ jobs:
6868
if: matrix.os == 'windows-latest'
6969
uses: ilammy/setup-nasm@v1
7070

71+
# Go is needed for aws-lc-FIPS
72+
- name: Install Go
73+
uses: actions/setup-go@v5
74+
with:
75+
go-version: ">=1.18"
76+
7177
- name: Install Smithy-Dafny codegen dependencies
7278
uses: ./.github/actions/install_smithy_dafny_codegen_dependencies
7379

@@ -97,3 +103,11 @@ jobs:
97103
run: |
98104
make test_rust
99105
make test_rust_debug
106+
107+
- name: Test ${{ matrix.library }} Rust Fips
108+
if: matrix.library == 'AwsCryptographyPrimitives' || matrix.library == 'AwsCryptographicMaterialProviders' || matrix.library == 'TestVectorsAwsCryptographicMaterialProviders'
109+
shell: bash
110+
working-directory: ./${{ matrix.library }}/runtimes/rust
111+
run: |
112+
cargo test --release --features fips -- --nocapture
113+
cargo test --features fips -- --nocapture

‎AwsCryptographicMaterialProviders/runtimes/rust/Cargo.toml‎

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -13,20 +13,27 @@ readme = "README.md"
1313
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
1414

1515
[dependencies]
16-
aws-config = "1.6.2"
17-
aws-lc-rs = "=1.13.0"
18-
aws-lc-sys = "=0.28.2"
16+
aws-config = "1.8.5"
17+
aws-lc-rs = {version = "1.13.3"}
18+
aws-lc-sys = { version = "=0.30", optional = true }
19+
aws-lc-fips-sys = { version = "=0.13", optional = true }
1920
aws-sdk-dynamodb = "1.55.0"
2021
aws-sdk-kms = "1.51.0"
21-
aws-smithy-runtime-api = {version = "1.8.0", features = ["client"] }
22-
aws-smithy-types = "1.3.1"
22+
aws-smithy-runtime-api = {version = "1.9.0", features = ["client"] }
23+
aws-smithy-types = "1.3.2"
2324
chrono = "0.4.41"
2425
cpu-time = "1.0.0"
2526
dafny_runtime = { path = "../../../smithy-dafny/TestModels/dafny-dependencies/dafny_runtime_rust", features = ["sync","small-int"]}
2627
dashmap = "6.1.0"
2728
pem = "3.0.5"
28-
tokio = {version = "1.45.0", features = ["full"] }
29-
uuid = { version = "1.16.0", features = ["v4"] }
29+
tokio = {version = "1.47.1", features = ["full"] }
30+
uuid = { version = "1.18.0", features = ["v4"] }
3031
timeout = "0.1.0"
31-
rand = "0.9.1"
32+
rand = "0.9.2"
3233
futures = "0.3"
34+
35+
[features]
36+
fips = ["aws-lc-rs/fips", "dep:aws-lc-fips-sys"]
37+
non-fips = ["aws-lc-rs/aws-lc-sys", "dep:aws-lc-sys"]
38+
default = ["non-fips"]
39+

‎AwsCryptographicMaterialProviders/runtimes/rust/src/ecdh.rs‎

Lines changed: 31 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -22,14 +22,14 @@ pub mod ECDH {
2222
use crate::software::amazon::cryptography::primitives::internaldafny::types::ECDHCurveSpec;
2323
use crate::software::amazon::cryptography::primitives::internaldafny::types::Error as DafnyError;
2424
use crate::*;
25-
use aws_lc_sys;
25+
use aws_lc_sys_impl;
2626
use dafny_runtime::Rc;
2727

2828
fn get_nid(x: &ECDHCurveSpec) -> i32 {
2929
match x {
30-
ECDHCurveSpec::ECC_NIST_P256 {} => aws_lc_sys::NID_X9_62_prime256v1,
31-
ECDHCurveSpec::ECC_NIST_P384 {} => aws_lc_sys::NID_secp384r1,
32-
ECDHCurveSpec::ECC_NIST_P521 {} => aws_lc_sys::NID_secp521r1,
30+
ECDHCurveSpec::ECC_NIST_P256 {} => aws_lc_sys_impl::NID_X9_62_prime256v1,
31+
ECDHCurveSpec::ECC_NIST_P384 {} => aws_lc_sys_impl::NID_secp384r1,
32+
ECDHCurveSpec::ECC_NIST_P521 {} => aws_lc_sys_impl::NID_secp521r1,
3333
ECDHCurveSpec::SM2 {} => panic!("No SM2 in Rust"),
3434
}
3535
}
@@ -45,29 +45,29 @@ pub mod ECDH {
4545
}
4646
}
4747

48-
use aws_lc_sys::CBB_finish;
49-
use aws_lc_sys::CBB_init;
50-
use aws_lc_sys::EC_GROUP_get_curve_name;
51-
use aws_lc_sys::EC_GROUP_new_by_curve_name;
52-
use aws_lc_sys::EC_KEY_get0_group;
53-
use aws_lc_sys::EC_KEY_get0_public_key;
54-
use aws_lc_sys::EC_KEY_new_by_curve_name;
55-
use aws_lc_sys::EC_KEY_set_public_key;
56-
use aws_lc_sys::EC_POINT_free;
57-
use aws_lc_sys::EC_POINT_new;
58-
use aws_lc_sys::EC_POINT_oct2point;
59-
use aws_lc_sys::EC_POINT_point2oct;
60-
use aws_lc_sys::EVP_PKEY_assign_EC_KEY;
61-
use aws_lc_sys::EVP_PKEY_free;
62-
use aws_lc_sys::EVP_PKEY_get0_EC_KEY;
63-
use aws_lc_sys::EVP_PKEY_new;
64-
use aws_lc_sys::EVP_PKEY_size;
65-
use aws_lc_sys::EVP_marshal_public_key;
66-
use aws_lc_sys::EVP_parse_public_key;
67-
use aws_lc_sys::OPENSSL_free;
68-
use aws_lc_sys::CBB;
69-
use aws_lc_sys::CBS;
70-
use aws_lc_sys::EVP_PKEY_EC;
48+
use aws_lc_sys_impl::CBB_finish;
49+
use aws_lc_sys_impl::CBB_init;
50+
use aws_lc_sys_impl::EC_GROUP_get_curve_name;
51+
use aws_lc_sys_impl::EC_GROUP_new_by_curve_name;
52+
use aws_lc_sys_impl::EC_KEY_get0_group;
53+
use aws_lc_sys_impl::EC_KEY_get0_public_key;
54+
use aws_lc_sys_impl::EC_KEY_new_by_curve_name;
55+
use aws_lc_sys_impl::EC_KEY_set_public_key;
56+
use aws_lc_sys_impl::EC_POINT_free;
57+
use aws_lc_sys_impl::EC_POINT_new;
58+
use aws_lc_sys_impl::EC_POINT_oct2point;
59+
use aws_lc_sys_impl::EC_POINT_point2oct;
60+
use aws_lc_sys_impl::EVP_PKEY_assign_EC_KEY;
61+
use aws_lc_sys_impl::EVP_PKEY_free;
62+
use aws_lc_sys_impl::EVP_PKEY_get0_EC_KEY;
63+
use aws_lc_sys_impl::EVP_PKEY_new;
64+
use aws_lc_sys_impl::EVP_PKEY_size;
65+
use aws_lc_sys_impl::EVP_marshal_public_key;
66+
use aws_lc_sys_impl::EVP_parse_public_key;
67+
use aws_lc_sys_impl::OPENSSL_free;
68+
use aws_lc_sys_impl::CBB;
69+
use aws_lc_sys_impl::CBS;
70+
use aws_lc_sys_impl::EVP_PKEY_EC;
7171
use std::ptr::null_mut;
7272

7373
const ELEM_MAX_BITS: usize = 521;
@@ -106,9 +106,9 @@ pub mod ECDH {
106106
}
107107

108108
let comp = if compress {
109-
aws_lc_sys::point_conversion_form_t::POINT_CONVERSION_COMPRESSED
109+
aws_lc_sys_impl::point_conversion_form_t::POINT_CONVERSION_COMPRESSED
110110
} else {
111-
aws_lc_sys::point_conversion_form_t::POINT_CONVERSION_UNCOMPRESSED
111+
aws_lc_sys_impl::point_conversion_form_t::POINT_CONVERSION_UNCOMPRESSED
112112
};
113113

114114
let mut out_buf = [0u8; PUBLIC_KEY_MAX_LEN];
@@ -184,7 +184,7 @@ pub mod ECDH {
184184
) -> Result<Vec<u8>, String> {
185185
let mut out = null_mut();
186186
let evp_pkey = unsafe {
187-
aws_lc_sys::d2i_PrivateKey(
187+
aws_lc_sys_impl::d2i_PrivateKey(
188188
EVP_PKEY_EC,
189189
&mut out,
190190
&mut key_bytes.as_ptr(),
@@ -340,7 +340,7 @@ pub mod ECDH {
340340
}
341341
let ec_key = unsafe { EVP_PKEY_get0_EC_KEY(evp_pkey) };
342342

343-
if unsafe { aws_lc_sys::EC_KEY_check_fips(ec_key) } != 1 {
343+
if unsafe { aws_lc_sys_impl::EC_KEY_check_fips(ec_key) } != 1 {
344344
return Err(INVALID_KEY.to_string());
345345
}
346346
let ec_group = unsafe { EC_KEY_get0_group(ec_key) };

‎AwsCryptographicMaterialProviders/runtimes/rust/src/ecdsa.rs‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -55,8 +55,8 @@ pub mod Signature {
5555

5656
fn get_nid(x: &ECDSASignatureAlgorithm) -> i32 {
5757
match x {
58-
ECDSASignatureAlgorithm::ECDSA_P256 {} => aws_lc_sys::NID_X9_62_prime256v1,
59-
ECDSASignatureAlgorithm::ECDSA_P384 {} => aws_lc_sys::NID_secp384r1,
58+
ECDSASignatureAlgorithm::ECDSA_P256 {} => aws_lc_sys_impl::NID_X9_62_prime256v1,
59+
ECDSASignatureAlgorithm::ECDSA_P384 {} => aws_lc_sys_impl::NID_secp384r1,
6060
}
6161
}
6262

@@ -71,20 +71,20 @@ pub mod Signature {
7171
sec1_convert(
7272
data,
7373
get_nid(alg),
74-
aws_lc_sys::point_conversion_form_t::POINT_CONVERSION_COMPRESSED,
74+
aws_lc_sys_impl::point_conversion_form_t::POINT_CONVERSION_COMPRESSED,
7575
)
7676
}
7777

7878
pub(crate) fn sec1_convert(
7979
data: &[u8],
8080
nid: i32,
81-
form: aws_lc_sys::point_conversion_form_t,
81+
form: aws_lc_sys_impl::point_conversion_form_t,
8282
) -> Result<Vec<u8>, String> {
83-
use aws_lc_sys::EC_GROUP_new_by_curve_name;
84-
use aws_lc_sys::EC_POINT_free;
85-
use aws_lc_sys::EC_POINT_new;
86-
use aws_lc_sys::EC_POINT_oct2point;
87-
use aws_lc_sys::EC_POINT_point2oct;
83+
use aws_lc_sys_impl::EC_GROUP_new_by_curve_name;
84+
use aws_lc_sys_impl::EC_POINT_free;
85+
use aws_lc_sys_impl::EC_POINT_new;
86+
use aws_lc_sys_impl::EC_POINT_oct2point;
87+
use aws_lc_sys_impl::EC_POINT_point2oct;
8888
use std::ptr::null_mut;
8989

9090
// no need to free ec_group

‎AwsCryptographicMaterialProviders/runtimes/rust/src/lib.rs‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,12 @@
1414
#![allow(clippy::never_loop)]
1515
#![allow(clippy::absurd_extreme_comparisons)]
1616

17+
#[cfg(feature = "fips")]
18+
use aws_lc_fips_sys as aws_lc_sys_impl;
19+
20+
#[cfg(not(feature = "fips"))]
21+
use aws_lc_sys as aws_lc_sys_impl;
22+
1723
pub mod client;
1824
pub mod conversions;
1925
pub mod deps;

‎AwsCryptographyPrimitives/runtimes/rust/Cargo.toml‎

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -7,15 +7,21 @@ rust-version = "1.80.0"
77
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
88

99
[dependencies]
10-
aws-config = "1.6.2"
11-
aws-lc-rs = "1.13.0"
12-
aws-lc-sys = "0.28.2"
13-
aws-smithy-runtime-api = "1.8.0"
14-
aws-smithy-types = "1.3.1"
10+
aws-config = "1.8.5"
11+
aws-lc-rs = {version = "1.13.3"}
12+
aws-lc-sys = { version = "=0.30", optional = true }
13+
aws-lc-fips-sys = { version = "=0.13", optional = true }
14+
aws-smithy-runtime-api = "1.9.0"
15+
aws-smithy-types = "1.3.2"
1516
chrono = "0.4.41"
1617
cpu-time = "1.0.0"
1718
dafny_runtime = { path = "../../../smithy-dafny/TestModels/dafny-dependencies/dafny_runtime_rust", features = ["sync","small-int"]}
1819
dashmap = "6.1.0"
1920
pem = "3.0.5"
20-
tokio = {version = "1.45.0", features = ["full"] }
21-
uuid = { version = "1.16.0", features = ["v4"] }
21+
tokio = {version = "1.47.1", features = ["full"] }
22+
uuid = { version = "1.18.0", features = ["v4"] }
23+
24+
[features]
25+
fips = ["aws-lc-rs/fips", "dep:aws-lc-fips-sys"]
26+
non-fips = ["aws-lc-rs/aws-lc-sys", "dep:aws-lc-sys"]
27+
default = ["non-fips"]

‎AwsCryptographyPrimitives/runtimes/rust/src/lib.rs‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,12 @@
1111
#![allow(clippy::never_loop)]
1212
#![allow(clippy::absurd_extreme_comparisons)]
1313

14+
#[cfg(feature = "fips")]
15+
use aws_lc_fips_sys as aws_lc_sys_impl;
16+
17+
#[cfg(not(feature = "fips"))]
18+
use aws_lc_sys as aws_lc_sys_impl;
19+
1420
pub mod client;
1521
pub mod conversions;
1622
pub mod error;

‎TestVectorsAwsCryptographicMaterialProviders/runtimes/rust/Cargo.toml‎

Lines changed: 14 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -6,24 +6,22 @@ rust-version = "1.80.0"
66

77
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
88

9-
[features]
10-
wrapped-client = []
11-
129
[dependencies]
13-
aws-config = "1.6.2"
14-
aws-lc-rs = "=1.13.0"
15-
aws-lc-sys = "=0.28.2"
10+
aws-config = "1.8.5"
11+
aws-lc-rs = {version = "1.13.3"}
12+
aws-lc-sys = { version = "=0.30", optional = true }
13+
aws-lc-fips-sys = { version = "=0.13", optional = true }
1614
aws-sdk-dynamodb = "1.55.0"
1715
aws-sdk-kms = "1.51.0"
18-
aws-smithy-runtime-api = {version = "1.8.0", features = ["client"] }
19-
aws-smithy-types = "1.3.1"
16+
aws-smithy-runtime-api = {version = "1.9.0", features = ["client"] }
17+
aws-smithy-types = "1.3.2"
2018
chrono = "0.4.41"
2119
cpu-time = "1.0.0"
2220
dafny_runtime = { path = "../../../smithy-dafny/TestModels/dafny-dependencies/dafny_runtime_rust", features = ["sync","small-int"]}
2321
dashmap = "6.1.0"
2422
pem = "3.0.5"
25-
tokio = {version = "1.45.0", features = ["full"] }
26-
uuid = { version = "1.16.0", features = ["v4"] }
23+
tokio = {version = "1.47.1", features = ["full"] }
24+
uuid = { version = "1.18.0", features = ["v4"] }
2725
ring = "0.17.14"
2826

2927
[dev-dependencies]
@@ -32,3 +30,9 @@ aws-mpl-test-vectors = { path = ".", features = ["wrapped-client"] }
3230
[[bin]]
3331
name = "test-vectors"
3432
path = "src/main.rs"
33+
34+
[features]
35+
wrapped-client = []
36+
fips = ["aws-lc-rs/fips", "dep:aws-lc-fips-sys"]
37+
non-fips = ["aws-lc-rs/aws-lc-sys", "dep:aws-lc-sys"]
38+
default = ["non-fips"]

‎TestVectorsAwsCryptographicMaterialProviders/runtimes/rust/src/main.rs‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,13 @@ pub mod types;
2121
pub mod validation;
2222
pub mod wrapped;
2323

24+
#[cfg(feature = "fips")]
25+
use aws_lc_fips_sys as aws_lc_sys_impl;
26+
27+
#[cfg(not(feature = "fips"))]
28+
use aws_lc_sys as aws_lc_sys_impl;
29+
30+
2431
pub(crate) mod standard_library_conversions;
2532
pub(crate) mod standard_library_externs;
2633
pub use client::Client;

0 commit comments

Comments
 (0)