Repository navigation
Conversation
- Add the coordinode-crypto workspace package: a pure-Rust rustls provider on current RustCrypto primitives, adapted from rustls-rustcrypto. Local identities are P-256, P-384 or Ed25519; RSA stays verifiable with 2048..=8192-bit public keys - Implement the rust_crypto JWT backend through jsonwebtoken's CryptoProvider interface: HMAC, ECDSA, EdDSA and RSA public verification; RSA signer and private-key factories are refused - Drop rustls-webpki 0.102, paste and the obsolete crypto-bigint from the default graph, with their advisory ignores (RUSTSEC-2026-0382 among them failed every advisory scan) - Stop ProxyServer::from_config from installing a jsonwebtoken provider: only building the built-in verifier does, so a proxy without auth leaves that choice to its host - Let the selected rustls provider decide the listener identities it presents, so a host-installed or aws-lc provider keeps RSA listeners whatever features the graph unified - State at every auth entry point that an application with its own authn/authz, such as structured-id, uses none of the proxy's auth - Test coordinode-crypto in CI (clippy, tests, MSRV 1.92, no-std) and publish-check both packages; no GitHub release for its tags - Adopt rustfmt style edition 2024 across the workspace BREAKING CHANGE: with the default rust_crypto backend the listener refuses RSA private keys; serve TLS with a P-256, P-384 or Ed25519 key, or install a provider that signs with RSA. Closes #154
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
All six AES-GCM suites declared u64::MAX as their confidentiality limit, so rustls never updated the key or closed the connection before the AES-GCM record bound. Set 2^24 full-size records (RFC 8446 section 5.5, draft-irtf-cfrg-aead-limits section 5.1), as rustls' own providers do; ChaCha20-Poly1305 keeps u64::MAX. Part of #154
The confidentiality-limit test expected nine suites, which fails the TLS 1.3-only build (`tls12` off) that offers three. Compare the exact suite list of the compiled profile, in offer order, with each limit, and run that profile's clippy and tests in CI. Part of #154
P-256 and P-384 key exchange accepted compressed SEC1 points, because the SEC1 decoder takes both forms. TLS 1.3 key shares and TLS 1.2 ECDHE points are uncompressed only (RFC 8446 section 4.2.8.2, RFC 8422 section 5.1.2): require the exact 65 / 97-byte length and the 0x04 prefix before decoding, in both TLS profiles. Part of #154
The TLS 1.2 AES-GCM and ChaCha20-Poly1305 decrypters returned authenticated plaintext longer than 2^14 bytes. rustls admits ciphertext up to 2^14 + 2048 and does not check the plaintext after a provider decrypts, so refuse it with PeerSentOversizedRecord (RFC 5246 section 6.2.1), as rustls' own providers do. TLS 1.3 keeps its unpadding check. Part of #154
The TLS 1.2 record-limit regression covered AES-256-GCM and ChaCha20-Poly1305 only. Exercise AES-128-GCM too, with the 16-byte keys of a local TLS 1.2 handshake extracted through rustls' dangerous_extract_secrets, and take a fresh key pair per decrypter under test. Part of #154
The RustCrypto rustls provider and the jsonwebtoken adapter now come from the shared sid-crypto crate (tls::rustcrypto::provider and jwt::rustcrypto::provider), which carries the AES-GCM confidentiality limit, uncompressed-only ECDHE shares, the TLS 1.2 plaintext bound and the bounded RSA public-key decoder. Neither installs a process default: the proxy still settles the JWT provider only when it builds the built-in verifier, and takes the host's rustls provider first. - Remove the in-tree coordinode-crypto crate and the JWT adapter; their own tests live with sid-crypto - Drop the coordinode-crypto CI job and release-plz entry; the publish dry-run checks this package alone - Point the RUSTSEC-2023-0071 rationale at the sid-crypto chain Part of #154
polaz
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
rustls-rustcrypto0.0.2-alpha and the RustCrypto JWT backend with the providers of the sharedsid-cryptocrate (tls::rustcrypto::provider()andjwt::rustcrypto::provider()) on current RustCrypto primitives. The default graph no longer carriesrustls-webpki0.102,pasteor the obsoletecrypto-bigint, so the advisory scan passes again.Changes
rust_cryptofeature:sid-cryptowithstd,tls-rustcrypto,tls12andjwt-rustcrypto(no default features); the in-tree provider crate and JWT adapter are goneProxyServer::from_configno longer installs a jsonwebtoken provider;ConfigVerifier::buildis the only place that does, and a provider the host installed first standsserver_configleaves identity admission to the selected provider, so a host-installed or aws-lc provider keeps RSA listeners whatever features the graph unified; its key/cert error names both filesdeny.toml/.cargo/audit.toml: only RUSTSEC-2023-0071 (rsa, verify-only) remains ignoredwith_auth,with_token_verifier,with_auth_decider,TokenVerifier,AuthDeciderand theauth/hooksmodulesrustfmt.toml: style edition 2024; the crate is reformatted with itTesting
Formatting, clippy with
-D warnings, nextest, doc tests,cargo docwith-D warnings, the advisory scan, MSRV and the publish dry-run pass for therust_crypto,aws_lc_rs,injected_verifierand--all-featuresbuilds on macOS; CI runs the same on Linux and musl.BREAKING CHANGE: with the default rust_crypto backend the listener refuses RSA private keys; serve TLS with a P-256, P-384 or Ed25519 key, or install a provider that signs with RSA.
Closes #154