`test_client_mtu_reduction` and `test_server_mtu_reduction` already exist
but only check client/server behaviour in (relative) isolation.
This test just checks handshaking and bidirectional data flow over
a matrix of key types, TLS versions, and max_fragment_sizes.
This commit adds a `Debug` bound to the `StoresServerSessions` trait in
addition to `Send` and `Sync`. Types implementing this trait are updated
to either derive `Debug` or implement it by hand as appropriate.
This commit adds a `Debug` bound to the `ResolvesServerCert` trait in
addition to `Send` and `Sync`. Types implementing this trait are updated
to either derive `Debug` or implement it by hand as appropriate.
This commit adds a `Debug` bound to the `ProducesTickets` trait in
addition to `Send` and `Sync`. Types implementing this trait are updated
to either derive `Debug` or implement it by hand as appropriate.
This commit adds a `Debug` bound to the `ServerCertVerifier` trait in
addition to `Send` and `Sync`. Types implementing this trait are updated
to either derive `Debug` or implement it by hand as appropriate.
This commit adds a `Debug` bound to the `ClientCertVerifier` trait in
addition to `Send` and `Sync`. Types implementing this trait are updated
to either derive `Debug` or implement it by hand as appropriate.
This commit adds a `Debug` bound to the `ResolvesClientCert` trait,
alongside `Send` and `Sync`. The types implementing this trait are
updated to either derive `Debug`, or implement it by hand, as
appropriate.
This commit adds a `Debug` bound to the `SideData` trait. The types
implementing it are updated to derive `Debug` or implement it by hand as
appropriate.
This commit adds a `Debug` bound to the `ClientSessionStore` trait,
alongside `Send` and `Sync`. Types implementing the trait are updated
with derived or hand-written `Debug` impls as appropriate, taking care
to avoid leaking any sensitive information.
This commit adds a `Debug` bound to the `Signer` trait alongside the
existing `Send` and `Sync` bounds. Types implementing the trait are
updated with a hand-written `Debug` impl to avoid leaking sensitive
data.
This commit adds a `Debug` bound to the `SigningKey` trait, alongside
`Send` and `Sync`. Types implementing this trait are updated to hand
implement `Debug` to avoid leaking any sensitive data.
This commit adds a `Debug` bound to the `KeyLog` trait in addition to
`Send` and `Sync`. Each implementation in the codebase is updated to
derive, or hand-implement the `Debug` trait, taking care not to include
any fields that may contain secret key information.
It isn't possible to write a cfg expression that says when this
is used, because it would differ over the two instantiations.
Note that HMAC-SHA512 is only actually used to run test vectors posted
to the tlswg mailing list by some random in 2009.
Provide shims for limited number of places where ring 0.17 and
aws-lc-rs (ring 0.16-era) APIs have diverged. This is a
short-term fix, as they are likely to diverge more over time.
Eventually we'll have to stop sharing the code like this.
For unit-like tests, export a `test_provider` alias that resolves
to a provider module, for use in these tests.
This resolves to:
- *ring* if cfg(feature = "ring"), else
- aws-lc-rs if cfg(feature = "aws_lc_rs"), else
- is absent
This drastically simplifies `provider-example`. But the
primary goal is ensuring a client configured `with_provider(AWS_LC_RS)`
only uses algorithms from aws-lc-rs, irrespective of crate features.
Naming cipher suites individually seems like a "detail" feature, and
therefore having to name the provider too is not a large imposition.
Naturally this is a breaking change.
This commit adds a new `connect-tests/tests/ech.rs` module that performs
a DNS over HTTPS lookup for HTTPS type records, finding `EchConfig`s and
testing we can deserialize the raw form into the Rustls representation
without error.
Presently it tests against:
* `crypto.cloudflare.com`
* `defo.ie`
* `tls-ech.dev`
Since these are network based tests they need to live in `connect-tests`
to avoid flakyness during normal CI runs.
In previous WIP branches this was done as part of an overall end-to-end
example of using ECH, but we can test this in isolation ahead of having
full ECH support.
This commit breaks out representation of Encrypted Client Hello (ECH)
configuration from overall support for the feature. This code is
relatively isolated and so can be added without much impact to the rest
of the codebase. It does _not_ provide any actual ECH support.
The code is almost entirely derived from earlier WIP branches adding ECH
support, updated for the current Rustls codebase, and spot checked
against the current most ECH draft at the time of writing (draft-17).
HPKE references are also updated to use the published RFC (RFC 9180).
Notable updates from the WIP version:
* adapting to the `Codec` return type change.
* adapting to the enum builder changes.
* adapting to the server name changes.
* adapting to `TlsListElement` trait.
* adapting HPKE registry refs to use the RFC instead of an earlier
draft.
* adding `Hpke` prefix to enums to clarify their purpose.
* adapting base64 usage to avoid deprecated fns.
* reworking unit tests for de-duplication, adding another encoded test
case, adding more asserts for decoded content.
* fixing `clippy::use_self` finding.
* Changing `default` fn on `HpkeSymmetricCipherSuite` to be an impl of
`Default`.
* Updating trust-dns-resolver code to use latest hickory-resolver.
* Pulling out ECH config fetch + deserialize from ECH example program to
a connect-tests unit test.
Add `Other` variant in Error to express any other error. The main
intention for this is to use it to hold errors throw from underlying
custom crypto provider or pki provider.
A new unit struct `OtherError` is added to properly implement
`PartialEq`.
Use `Error` instead of `GetRandomFailed` in trait `SupportedKxGroup`,
so that underlying crypto provider could throw errors other than RNG
related errors.
Instead of taking a `Vec<u8>` and inserting bytes at the beginning,
take a `&[u8]` and return a new vector containing those bytes plus
a tag and a length.
This isn't the perfect approach for all situations, but for one of the
main places we call wrap_in_sequence (DistinguishedName::in_sequence),
it's optimal because the input is `&[u8]`, meaning we can't write to
a previously existing `Vec<u8>` (which would potentially save
allocations by using excess capacity at the end of the Vec).
In the process, change the one call site for `wrap_in_asn1_len` to call
the new `asn1_wrap` function instead, which encodes a tag and length at
the same time, reducing reallocations and copies.
This has a slight secondary benefit: the resulting Vec is exactly sized
to what it holds, instead of following the doubling approach and
possibly over-allocating. This saves a handful of bytes in a long-lived
data structure.
This version of webpki improves CRL ergonomics. Notable changes:
* use `with_status_policy builder` fn
The upstream crate added a more ergonomic interface we can use in
place of having to keep around a mutable builder and doing our own
matching.
* avoid CRL dyn trait hurdles
The upstream crate made working with CRLs easier by replacing the
`CertRevocationList` trait with an `enum` representation.
Notably this makes working with the `Vec<OwnedCertRevocationList>` that
the webpki verifier builders and verifiers hold much easier: we no long
have to do as many contortions to convert to a `&[&dyn
CertRevocationList]`.
Pull out a generic helper from the existing client cert resolver test,
rename the test that uses the helper to emphasize it's testing a default
configuration. This will make it easier to add a test for non-default
configurations.
Dirkjan Ochtman
Daniel McCarney
Joseph Birr-Pixton
Jorge Aparicio
Yuxiang Cao
Jacob Hoffman-Andrews
Paolo Barbolini