Code for QUIC support

.github/workflows/macos-build.yml

@@ -16,6 +16,7 @@ jobs:
       - name: Install Build Prerequisites
         run: |
           brew install autoconf libtool automake
+          brew install go
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@master
@@ -56,6 +57,33 @@ jobs:
       - name: Run clippy
         run: |
           cd wolfcrypt-rs
-          cargo clippy -- -D warnings
+          cargo clippy --all-features -- -D warnings
           cd ../rustls-wolfcrypt-provider
-          cargo clippy -- -D warnings
+          cargo clippy --all-features -- -D warnings
+
+      - name: Run tests of rustls v0.23.35
+        run: |
+          mkdir rustlsv0.23.35-test-workspace
+          cd rustlsv0.23.35-test-workspace
+          git clone https://github.com/rustls/rustls.git
+          cd rustls
+          git fetch --tags
+          selected_tag=$(git tag -l "v/0\.23\.35")
+          git checkout "$selected_tag"
+          cd ..
+          git clone https://github.com/helkoulak/rustls-wolfcrypt-provider.git
+          cd rustls-wolfcrypt-provider/
+          git checkout quic-support
+          cd wolfcrypt-rs/
+          make build
+          cd ../rustls-wolfcrypt-provider/
+          cargo build --all-features --release
+          cd ../..
+          git clone https://github.com/helkoulak/rustls_v0.23.35_test_files.git
+          cp -r ./rustls_v0.23.35_test_files/tests .
+          cp ./rustls_v0.23.35_test_files/Cargo.toml .
+          cp ./rustls_v0.23.35_test_files/provider_files/Cargo.toml ./rustls-wolfcrypt-provider/rustls-wolfcrypt-provider/
+          rm -rf rustls_v0.23.35_test_files
+          cargo test -p tests --test all_suites --all-features
+          cd ..
+          rm -rf rustlsv0.23.35-test-workspace

.github/workflows/ubuntu-build.yml

@@ -57,6 +57,34 @@ jobs:
       - name: Run clippy
         run: |
           cd wolfcrypt-rs
-          cargo clippy -- -D warnings
+          cargo clippy --all-features -- -D warnings
           cd ../rustls-wolfcrypt-provider
-          cargo clippy -- -D warnings
+          cargo clippy --all-features -- -D warnings
+
+      - name: Run tests of rustls v0.23.35
+        run: |
+          mkdir rustlsv0.23.35-test-workspace
+          cd rustlsv0.23.35-test-workspace
+          git clone https://github.com/rustls/rustls.git
+          cd rustls
+          git fetch --tags
+          selected_tag=$(git tag -l "v/0\.23\.35")
+          git checkout "$selected_tag"
+          cd ..
+          git clone https://github.com/helkoulak/rustls-wolfcrypt-provider.git
+          cd rustls-wolfcrypt-provider/
+          git checkout quic-support
+          cd wolfcrypt-rs/
+          make build
+          cd ../rustls-wolfcrypt-provider/
+          cargo build --all-features --release
+          cd ../..
+          git clone https://github.com/helkoulak/rustls_v0.23.35_test_files.git
+          cp -r ./rustls_v0.23.35_test_files/tests .
+          cp ./rustls_v0.23.35_test_files/Cargo.toml .
+          cp ./rustls_v0.23.35_test_files/provider_files/Cargo.toml ./rustls-wolfcrypt-provider/rustls-wolfcrypt-provider/
+          rm -rf rustls_v0.23.35_test_files
+          cargo test -p tests --test all_suites --all-features
+          cd ..
+          rm -rf rustlsv0.23.35-test-workspace
+

rustls-wolfcrypt-provider/Cargo.toml

@@ -33,6 +33,7 @@ lazy_static = "1.5.0"
 hex-literal = "0.4.1"
 
 
+
 [dev-dependencies]
 rcgen = { version = "0.13" }
 serial_test = { version = "3.2.0", default-features = false }
@@ -44,6 +45,7 @@ rustls-pemfile = { version = "2.2.0", default-features = false, features = ["std
 [features]
 default = []
 std = ["pkcs8/std", "rustls/std", "wolfcrypt-rs/std"]
+quic = []
 
 [profile.release]
 strip = true

rustls-wolfcrypt-provider/examples/client.rs

@@ -1,4 +1,4 @@
-use rustls_wolfcrypt_provider::provider;
+use rustls_wolfcrypt_provider::default_provider;
 use std::io::{stdout, Read, Write};
 use std::net::TcpStream;
 use std::sync::Arc;
@@ -9,7 +9,7 @@ fn main() {
     let root_store =
         rustls::RootCertStore::from_iter(webpki_roots::TLS_SERVER_ROOTS.iter().cloned());
 
-    let config = rustls::ClientConfig::builder_with_provider(provider().into())
+    let config = rustls::ClientConfig::builder_with_provider(default_provider().into())
         .with_safe_default_protocol_versions()
         .unwrap()
         .with_root_certificates(root_store)

rustls-wolfcrypt-provider/examples/server.rs

@@ -4,7 +4,7 @@ use std::sync::Arc;
 use rustls::pki_types::{CertificateDer, PrivateKeyDer, PrivatePkcs8KeyDer};
 use rustls::server::Acceptor;
 use rustls::ServerConfig;
-use rustls_wolfcrypt_provider::provider;
+use rustls_wolfcrypt_provider::default_provider;
 
 fn main() {
     env_logger::init();
@@ -90,7 +90,7 @@ impl TestPki {
     }
 
     fn server_config(self) -> Arc<ServerConfig> {
-        let mut server_config = ServerConfig::builder_with_provider(provider().into())
+        let mut server_config = ServerConfig::builder_with_provider(default_provider().into())
             .with_safe_default_protocol_versions()
             .unwrap()
             .with_no_client_auth()

rustls-wolfcrypt-provider/src/aead/aes128gcm.rs

@@ -65,8 +65,8 @@ impl Tls12AeadAlgorithm for Aes128Gcm {
     ) -> Result<ConnectionTrafficSecrets, UnsupportedOperationError> {
         let mut iv_as_vec = vec![0u8; GCM_NONCE_LENGTH];
 
-        iv_as_vec.copy_from_slice(iv);
-        iv_as_vec.copy_from_slice(explicit);
+        iv_as_vec[..iv.len()].copy_from_slice(iv);
+        iv_as_vec[iv.len()..].copy_from_slice(explicit);
 
         Ok(ConnectionTrafficSecrets::Aes128Gcm {
             key,
@@ -172,6 +172,9 @@ impl MessageDecrypter for WCTls12Decrypter {
         seq: u64,
     ) -> Result<InboundPlainMessage<'a>, rustls::Error> {
         let payload = &mut m.payload;
+        if payload.len() < GCM_TAG_LENGTH {
+            return Err(rustls::Error::DecryptError);
+        }
         let payload_len = payload.len();
 
         // First we copy the implicit nonce followed by copying
@@ -225,7 +228,7 @@ impl MessageDecrypter for WCTls12Decrypter {
                 aad.len() as word32,
             )
         };
-        check_if_zero(ret).unwrap();
+        check_if_zero(ret).map_err(|_| rustls::Error::DecryptError)?;
 
         payload.copy_within(payload_start..(payload_len - GCM_TAG_LENGTH), 0);
         payload.truncate(payload_len - ((payload_start) + GCM_TAG_LENGTH));
@@ -353,6 +356,9 @@ impl MessageDecrypter for WCTls13Cipher {
         seq: u64,
     ) -> Result<InboundPlainMessage<'a>, rustls::Error> {
         let payload = &mut m.payload;
+        if payload.len() < GCM_TAG_LENGTH {
+            return Err(rustls::Error::DecryptError);
+        }
         let nonce = Nonce::new(&self.iv, seq);
         let aad = make_tls13_aad(payload.len());
         let mut auth_tag = [0u8; GCM_TAG_LENGTH];
@@ -390,7 +396,7 @@ impl MessageDecrypter for WCTls13Cipher {
                 aad.len() as word32,
             )
         };
-        check_if_zero(ret).unwrap();
+        check_if_zero(ret).map_err(|_| rustls::Error::DecryptError)?;
 
         payload.truncate(message_len);
 

rustls-wolfcrypt-provider/src/aead/aes256gcm.rs

@@ -65,8 +65,8 @@ impl Tls12AeadAlgorithm for Aes256Gcm {
     ) -> Result<ConnectionTrafficSecrets, UnsupportedOperationError> {
         let mut iv_as_vec = vec![0u8; GCM_NONCE_LENGTH];
 
-        iv_as_vec.copy_from_slice(iv);
-        iv_as_vec.copy_from_slice(explicit);
+        iv_as_vec[..iv.len()].copy_from_slice(iv);
+        iv_as_vec[iv.len()..].copy_from_slice(explicit);
 
         Ok(ConnectionTrafficSecrets::Aes256Gcm {
             key,
@@ -172,6 +172,9 @@ impl MessageDecrypter for WCTls12Decrypter {
         seq: u64,
     ) -> Result<InboundPlainMessage<'a>, rustls::Error> {
         let payload = &mut m.payload;
+        if payload.len() < GCM_TAG_LENGTH {
+            return Err(rustls::Error::DecryptError);
+        }
         let payload_len = payload.len();
 
         // First we copy the implicit nonce followed by copying
@@ -225,7 +228,7 @@ impl MessageDecrypter for WCTls12Decrypter {
                 aad.len() as word32,
             )
         };
-        check_if_zero(ret).unwrap();
+        check_if_zero(ret).map_err(|_| rustls::Error::DecryptError)?;
 
         payload.copy_within(payload_start..(payload_len - GCM_TAG_LENGTH), 0);
         payload.truncate(payload_len - ((payload_start) + GCM_TAG_LENGTH));
@@ -353,6 +356,10 @@ impl MessageDecrypter for WCTls13Cipher {
         seq: u64,
     ) -> Result<InboundPlainMessage<'a>, rustls::Error> {
         let payload = &mut m.payload;
+        // In case peer misbehaves and sends plain text after it is not anymore allowed
+        if payload.len() < GCM_TAG_LENGTH {
+            return Err(rustls::Error::DecryptError);
+        }
         let nonce = Nonce::new(&self.iv, seq);
         let aad = make_tls13_aad(payload.len());
         let mut auth_tag = [0u8; GCM_TAG_LENGTH];
@@ -390,7 +397,7 @@ impl MessageDecrypter for WCTls13Cipher {
                 aad.len() as word32,
             )
         };
-        check_if_zero(ret).unwrap();
+        check_if_zero(ret).map_err(|_| rustls::Error::DecryptError)?;
 
         payload.truncate(message_len);
 

rustls-wolfcrypt-provider/src/aead/chacha20.rs

@@ -133,6 +133,9 @@ impl MessageDecrypter for WCTls12Cipher {
         seq: u64,
     ) -> Result<InboundPlainMessage<'a>, rustls::Error> {
         let payload = &mut m.payload;
+        if payload.len() < CHACHAPOLY1305_OVERHEAD {
+            return Err(rustls::Error::DecryptError);
+        }
 
         // We substract the tag, so this len will only consider
         // the message that we are trying to decrypt.
@@ -160,7 +163,7 @@ impl MessageDecrypter for WCTls12Cipher {
                 payload[..message_len].as_mut_ptr(),
             )
         };
-        check_if_zero(ret).unwrap();
+        check_if_zero(ret).map_err(|_| rustls::Error::DecryptError)?;
 
         // We extract the final result...
         payload.truncate(message_len);
@@ -276,6 +279,9 @@ impl MessageDecrypter for WCTls13Cipher {
         seq: u64,
     ) -> Result<InboundPlainMessage<'a>, rustls::Error> {
         let payload = &mut m.payload;
+        if payload.len() < CHACHAPOLY1305_OVERHEAD {
+            return Err(rustls::Error::DecryptError);
+        }
         let nonce = Nonce::new(&self.iv, seq);
         let aad = make_tls13_aad(payload.len());
         let mut auth_tag = [0u8; CHACHAPOLY1305_OVERHEAD];
@@ -302,7 +308,7 @@ impl MessageDecrypter for WCTls13Cipher {
                 payload[..message_len].as_mut_ptr(),
             )
         };
-        check_if_zero(ret).unwrap();
+        check_if_zero(ret).map_err(|_| rustls::Error::DecryptError)?;
 
         // We extract the final result...
         payload.truncate(message_len);