filip/Stalwart
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

Use aws-lc-rs everywhere

Browse Source
This commit is contained in:
Maurus Decimus
2026-04-09 16:52:25 +02:00
parent ef8e56b4ca
commit e4a4cf8fce
18 changed files with 44 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
crates/common/Cargo.toml
View File

@@ -30,6 +30,7 @@ arc-swap = "1.6.0"
rustls = { version = "0.23.5", default-features = false, features = ["std", "aws_lc_rs", "tls12"] }
rustls-pemfile = "2.0"
rustls-pki-types = { version = "1" }
aws-lc-rs = { version = "1" }
ring = { version = "0.17" }
tokio = { version = "1.47", features = ["net", "macros"] }
tokio-rustls = { version = "0.26", default-features = false, features = ["aws_lc_rs", "tls12"] }

2
crates/common/src/config/server/listener.rs
View File

@@ -18,7 +18,7 @@ use registry::schema::{
};
use rustls::{
ALL_VERSIONS, ServerConfig, SupportedCipherSuite,
crypto::ring::{ALL_CIPHER_SUITES, cipher_suite::*, default_provider},
crypto::aws_lc_rs::{ALL_CIPHER_SUITES, cipher_suite::*, default_provider},
};
use std::sync::Arc;
use store::registry::{RegistryObject, bootstrap::Bootstrap};

2
crates/common/src/config/server/tls.rs
View File

@@ -12,7 +12,7 @@ use registry::schema::{
};
use rustls::{
SupportedProtocolVersion,
crypto::ring::sign::any_supported_type,
crypto::aws_lc_rs::sign::any_supported_type,
sign::CertifiedKey,
version::{TLS12, TLS13},
};

2
crates/common/src/enterprise/license.rs
View File

@@ -22,7 +22,7 @@
use crate::manager::fetch_resource;
use base64::{Engine, engine::general_purpose::STANDARD};
use hyper::{HeaderMap, header::AUTHORIZATION};
use ring::signature::{ED25519, UnparsedPublicKey};
use aws_lc_rs::signature::{ED25519, UnparsedPublicKey};
use std::{
fmt::{Display, Formatter},
time::Duration,

22
crates/common/src/manager/defaults.rs
View File

@@ -13,6 +13,10 @@ use registry::{
},
types::{duration::Duration, error::Error, list::List, map::Map},
};
use aws_lc_rs::{
rand::SystemRandom,
signature::{ECDSA_P256_SHA256_FIXED_SIGNING, EcdsaKeyPair},
};
use std::str::FromStr;
use store::{
rand::{Rng, distr::Alphanumeric, rng},
@@ -289,7 +293,16 @@ async fn insert_safe_defaults(bp: &mut Bootstrap) -> trc::Result<()> {
}
if bp.registry.count_object(ObjectType::OidcProvider).await? == 0 {
let todo = "use asymmetric keys";
let pkcs8_doc =
EcdsaKeyPair::generate_pkcs8(&ECDSA_P256_SHA256_FIXED_SIGNING, &SystemRandom::new())
.map_err(|err| {
trc::EventType::Server(trc::ServerEvent::Startup)
.into_err()
.reason(err)
.caused_by(trc::location!())
})?;
let signature_pem = pem::encode(&pem::Pem::new("PRIVATE KEY", pkcs8_doc.as_ref()));
bp.registry
.write(RegistryWrite::insert(
&OidcProvider {
@@ -301,12 +314,9 @@ async fn insert_safe_defaults(bp: &mut Bootstrap) -> trc::Result<()> {
.collect::<String>(),
}),
signature_key: SecretText::Text(SecretTextValue {
secret: rng()
.sample_iter(Alphanumeric)
.take(64)
.map(char::from)
.collect::<String>(),
secret: signature_pem,
}),
signature_algorithm: JwtSignatureAlgorithm::Es256,
..Default::default()
}
.into(),

6
crates/common/src/network/acme/account.rs
View File

@@ -11,8 +11,8 @@ use base64::Engine;
use base64::engine::general_purpose::{self, URL_SAFE_NO_PAD};
use registry::schema::structs::AcmeProvider;
use reqwest::Method;
use ring::rand::SystemRandom;
use ring::signature::{ECDSA_P256_SHA256_FIXED_SIGNING, EcdsaKeyPair, EcdsaSigningAlgorithm};
use aws_lc_rs::rand::SystemRandom;
use aws_lc_rs::signature::{ECDSA_P256_SHA256_FIXED_SIGNING, EcdsaKeyPair, EcdsaSigningAlgorithm};
use utils::sanitize_email;
static ALG: &EcdsaSigningAlgorithm = &ECDSA_P256_SHA256_FIXED_SIGNING;
@@ -51,7 +51,7 @@ pub async fn acme_create_account(
let directory = Directory::discover(&provider.directory, provider.max_retries as u32).await?;
let account_key = EcdsaKeyPair::generate_pkcs8(ALG, &SystemRandom::new()).unwrap();
let key_pair = EcdsaKeyPair::from_pkcs8(ALG, account_key.as_ref(), &SystemRandom::new())
let key_pair = EcdsaKeyPair::from_pkcs8(ALG, account_key.as_ref())
.map_err(|err| AcmeError::Crypto(format!("Failed to create ECDSA key pair: {}", err)))?;
let eab = if let Some(eab) = &eab {
eab_sign(&key_pair, &eab.kid, &eab.hmac_key, &directory.new_account)?.into()

4
crates/common/src/network/acme/directory.rs
View File

@@ -21,8 +21,7 @@ use base64::engine::general_purpose::URL_SAFE_NO_PAD;
use rcgen::{CustomExtension, KeyPair, PKCS_ECDSA_P256_SHA256};
use registry::schema::structs::AcmeProvider;
use reqwest::Method;
use ring::rand::SystemRandom;
use ring::signature::{ECDSA_P256_SHA256_FIXED_SIGNING, EcdsaKeyPair, EcdsaSigningAlgorithm};
use aws_lc_rs::signature::{ECDSA_P256_SHA256_FIXED_SIGNING, EcdsaKeyPair, EcdsaSigningAlgorithm};
use serde::de::DeserializeOwned;
use serde_json::json;
use store::Serialize;
@@ -58,7 +57,6 @@ impl AcmeRequestBuilder {
.map_err(|err| {
AcmeError::Crypto(format!("Failed to decode account key: {}", err))
})?,
&SystemRandom::new(),
)
.map_err(|err| AcmeError::Crypto(format!("Failed to create ECDSA key pair: {}", err)))?;

8
crates/common/src/network/acme/jose.rs
View File

@@ -9,10 +9,10 @@
use crate::network::acme::{AcmeError, AcmeResult};
use base64::Engine;
use base64::engine::general_purpose::URL_SAFE_NO_PAD;
use ring::digest::{Digest, SHA256, digest};
use ring::hmac;
use ring::rand::SystemRandom;
use ring::signature::{EcdsaKeyPair, KeyPair};
use aws_lc_rs::digest::{Digest, SHA256, digest};
use aws_lc_rs::hmac;
use aws_lc_rs::rand::SystemRandom;
use aws_lc_rs::signature::{EcdsaKeyPair, KeyPair};
use serde::Serialize;
pub(crate) fn sign(

2
crates/common/src/network/acme/resolver.rs
View File

@@ -10,7 +10,7 @@ use crate::{
};
use rustls::{
ServerConfig,
crypto::ring::sign::any_ecdsa_type,
crypto::aws_lc_rs::sign::any_ecdsa_type,
server::{ClientHello, ResolvesServerCert},
sign::CertifiedKey,
};

2
crates/common/src/network/listen.rs
View File

@@ -13,7 +13,7 @@ use crate::{
config::server::{Listener, Listeners, ServerProtocol, TcpListener},
};
use proxy_header::io::ProxiedStream;
use rustls::crypto::ring::cipher_suite::TLS13_AES_128_GCM_SHA256;
use rustls::crypto::aws_lc_rs::cipher_suite::TLS13_AES_128_GCM_SHA256;
use std::{
net::{IpAddr, SocketAddr},
sync::Arc,

2
crates/common/src/telemetry/webhooks/mod.rs
View File

@@ -6,7 +6,7 @@
use crate::{LONG_1Y_SLUMBER, config::telemetry::WebhookTracer};
use base64::{Engine, engine::general_purpose::STANDARD};
use ring::hmac;
use aws_lc_rs::hmac;
use serde::Serialize;
use std::{
sync::{