filip/Stalwart
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

Use aws-lc-rs everywhere

Browse Source
This commit is contained in:
Maurus Decimus
2026-04-09 16:52:25 +02:00
parent ef8e56b4ca
commit e4a4cf8fce
18 changed files with 44 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
crates/common/src/network/acme/account.rs
View File

@@ -11,8 +11,8 @@ use base64::Engine;
use base64::engine::general_purpose::{self, URL_SAFE_NO_PAD};
use registry::schema::structs::AcmeProvider;
use reqwest::Method;
use ring::rand::SystemRandom;
use ring::signature::{ECDSA_P256_SHA256_FIXED_SIGNING, EcdsaKeyPair, EcdsaSigningAlgorithm};
use aws_lc_rs::rand::SystemRandom;
use aws_lc_rs::signature::{ECDSA_P256_SHA256_FIXED_SIGNING, EcdsaKeyPair, EcdsaSigningAlgorithm};
use utils::sanitize_email;
static ALG: &EcdsaSigningAlgorithm = &ECDSA_P256_SHA256_FIXED_SIGNING;
@@ -51,7 +51,7 @@ pub async fn acme_create_account(
let directory = Directory::discover(&provider.directory, provider.max_retries as u32).await?;
let account_key = EcdsaKeyPair::generate_pkcs8(ALG, &SystemRandom::new()).unwrap();
let key_pair = EcdsaKeyPair::from_pkcs8(ALG, account_key.as_ref(), &SystemRandom::new())
let key_pair = EcdsaKeyPair::from_pkcs8(ALG, account_key.as_ref())
.map_err(|err| AcmeError::Crypto(format!("Failed to create ECDSA key pair: {}", err)))?;
let eab = if let Some(eab) = &eab {
eab_sign(&key_pair, &eab.kid, &eab.hmac_key, &directory.new_account)?.into()

4
crates/common/src/network/acme/directory.rs
View File

@@ -21,8 +21,7 @@ use base64::engine::general_purpose::URL_SAFE_NO_PAD;
use rcgen::{CustomExtension, KeyPair, PKCS_ECDSA_P256_SHA256};
use registry::schema::structs::AcmeProvider;
use reqwest::Method;
use ring::rand::SystemRandom;
use ring::signature::{ECDSA_P256_SHA256_FIXED_SIGNING, EcdsaKeyPair, EcdsaSigningAlgorithm};
use aws_lc_rs::signature::{ECDSA_P256_SHA256_FIXED_SIGNING, EcdsaKeyPair, EcdsaSigningAlgorithm};
use serde::de::DeserializeOwned;
use serde_json::json;
use store::Serialize;
@@ -58,7 +57,6 @@ impl AcmeRequestBuilder {
.map_err(|err| {
AcmeError::Crypto(format!("Failed to decode account key: {}", err))
})?,
&SystemRandom::new(),
)
.map_err(|err| AcmeError::Crypto(format!("Failed to create ECDSA key pair: {}", err)))?;

8
crates/common/src/network/acme/jose.rs
View File

@@ -9,10 +9,10 @@
use crate::network::acme::{AcmeError, AcmeResult};
use base64::Engine;
use base64::engine::general_purpose::URL_SAFE_NO_PAD;
use ring::digest::{Digest, SHA256, digest};
use ring::hmac;
use ring::rand::SystemRandom;
use ring::signature::{EcdsaKeyPair, KeyPair};
use aws_lc_rs::digest::{Digest, SHA256, digest};
use aws_lc_rs::hmac;
use aws_lc_rs::rand::SystemRandom;
use aws_lc_rs::signature::{EcdsaKeyPair, KeyPair};
use serde::Serialize;
pub(crate) fn sign(

2
crates/common/src/network/acme/resolver.rs
View File

@@ -10,7 +10,7 @@ use crate::{
};
use rustls::{
ServerConfig,
crypto::ring::sign::any_ecdsa_type,
crypto::aws_lc_rs::sign::any_ecdsa_type,
server::{ClientHello, ResolvesServerCert},
sign::CertifiedKey,
};

2
crates/common/src/network/listen.rs
View File

@@ -13,7 +13,7 @@ use crate::{
config::server::{Listener, Listeners, ServerProtocol, TcpListener},
};
use proxy_header::io::ProxiedStream;
use rustls::crypto::ring::cipher_suite::TLS13_AES_128_GCM_SHA256;
use rustls::crypto::aws_lc_rs::cipher_suite::TLS13_AES_128_GCM_SHA256;
use std::{
net::{IpAddr, SocketAddr},
sync::Arc,