rust: bssl-tls: Unstage compliance policy This API may undergo another redesign internally. Given the uncertainty we would like to unstage this feature until the design is stabilised. Update-Note: Due to low demand and the need for redesigning the compliance policy interface, we will stop accepting the policy values when a connection is constructed. Signed-off-by: Xiangfei Ding <xfding@google.com> Change-Id: If47dec3b1700202343b9d72c39f9acf76a6a6964 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/98908 Reviewed-by: Adam Langley <agl@google.com> Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com>
diff --git a/rust/bssl-tls-tokio/src/lib.rs b/rust/bssl-tls-tokio/src/lib.rs index a439368..bfb3007 100644 --- a/rust/bssl-tls-tokio/src/lib.rs +++ b/rust/bssl-tls-tokio/src/lib.rs
@@ -75,7 +75,7 @@ //! # //! # let server_task = tokio::spawn(async move { //! # let (stream, _) = listener.accept().await.unwrap(); -//! # let mut conn = server_ctx.new_server_connection(None).unwrap().build(); +//! # let mut conn = server_ctx.new_server_connection().unwrap().build(); //! # conn.set_io(TokioIo(stream)).unwrap(); //! # conn.async_handshake().await.unwrap(); //! # @@ -90,7 +90,7 @@ //! //! let client_ctx = client_ctx_builder.build(); //! -//! let mut conn = client_ctx.new_client_connection(None).unwrap().build(); +//! let mut conn = client_ctx.new_client_connection().unwrap().build(); //! conn.in_handshake().unwrap().set_host("www.google.com")?; //! conn.set_io(TokioIo(stream))?; //! @@ -524,7 +524,7 @@ where S: AsyncRead + AsyncWrite + Send + Unpin + 'static, { - let mut conn = self.ctx.new_client_connection(None)?.build(); + let mut conn = self.ctx.new_client_connection()?.build(); conn.in_handshake().unwrap().set_host(domain)?; conn.set_io(TokioIo(stream))?; @@ -554,7 +554,7 @@ where S: AsyncRead + AsyncWrite + Send + Unpin + 'static, { - let mut conn = self.ctx.new_server_connection(None)?.build(); + let mut conn = self.ctx.new_server_connection()?.build(); conn.set_io(TokioIo(stream))?; @@ -629,7 +629,7 @@ where S: AbstractSocket + Send + Unpin + 'static, { - let mut conn = self.ctx.new_client_connection(None)?.build(); + let mut conn = self.ctx.new_client_connection()?.build(); conn.in_handshake().unwrap().set_host(domain)?; conn.set_io(stream)?; conn.async_handshake().await?; @@ -657,7 +657,7 @@ where S: AbstractSocket + Send + Unpin + 'static, { - let mut conn = self.ctx.new_server_connection(None)?.build(); + let mut conn = self.ctx.new_server_connection()?.build(); conn.set_io(stream)?; conn.async_handshake().await?;
diff --git a/rust/bssl-tls-tokio/src/tests/datagram.rs b/rust/bssl-tls-tokio/src/tests/datagram.rs index 4012d48..0cf9d0c 100644 --- a/rust/bssl-tls-tokio/src/tests/datagram.rs +++ b/rust/bssl-tls-tokio/src/tests/datagram.rs
@@ -68,7 +68,7 @@ }; server_ctx_builder.with_credential(server_cred.unwrap())?; let server_ctx = server_ctx_builder.build(); - let server_conn = server_ctx.new_server_connection(None)?.build(); + let server_conn = server_ctx.new_server_connection()?.build(); let mut client_ctx_builder = TlsContextBuilder::new_dtls(); let ca = X509Certificate::parse_one_from_pem(CA)?; @@ -77,7 +77,7 @@ let cert_store = cert_store.build(); client_ctx_builder.with_certificate_store(&cert_store); let client_ctx = client_ctx_builder.build(); - let client_conn = client_ctx.new_client_connection(None)?.build(); + let client_conn = client_ctx.new_client_connection()?.build(); Ok((server_conn, client_conn)) }
diff --git a/rust/bssl-tls-tokio/src/tests/transport.rs b/rust/bssl-tls-tokio/src/tests/transport.rs index 16dcf01..d8944f4 100644 --- a/rust/bssl-tls-tokio/src/tests/transport.rs +++ b/rust/bssl-tls-tokio/src/tests/transport.rs
@@ -62,7 +62,7 @@ }; server_ctx_builder.with_credential(server_cred.unwrap())?; let server_ctx = server_ctx_builder.build(); - let server_conn = server_ctx.new_server_connection(None)?.build(); + let server_conn = server_ctx.new_server_connection()?.build(); let mut client_ctx_builder = TlsContextBuilder::new_tls(); let mut cert_store = X509StoreBuilder::new(); @@ -72,7 +72,7 @@ let cert_store = cert_store.build(); client_ctx_builder.with_certificate_store(&cert_store); let client_ctx = client_ctx_builder.build(); - let client_conn = client_ctx.new_client_connection(None)?.build(); + let client_conn = client_ctx.new_client_connection()?.build(); Ok((server_conn, client_conn)) }
diff --git a/rust/bssl-tls/src/config.rs b/rust/bssl-tls/src/config.rs index 706ed63..7e5c23f 100644 --- a/rust/bssl-tls/src/config.rs +++ b/rust/bssl-tls/src/config.rs
@@ -241,49 +241,3 @@ pub const RsaWith3desEdeCbcSha: Self = Self(bssl_sys::SSL_CIPHER_RSA_WITH_3DES_EDE_CBC_SHA as u16); } - -bssl_enum! { - /// Compliance Policy. - #[derive(Clone, Copy, PartialEq, Eq)] - pub enum CompliancePolicy: u8 { - /// FIPS 202205 - /// - /// This policy configures a TLS connection to use: - /// - TLS 1.2 or 1.3; - /// - For TLS 1.2, only `ECDHE_[RSA|ECDSA]_WITH_AES_*_GCM_SHA*`; - /// - For TLS 1.3, only `AES-GCM`; - /// - P-256 or P-384 for key agreement; - /// - For server signatures, only PKCS#1/PSS with SHA256/384/512, - /// or ECDSA with P-256 or P-384 and SHA256/SHA384. - Fips202205 = bssl_sys::ssl_compliance_policy_t_ssl_compliance_policy_fips_202205 as u8, - /// WPA3-192 202304 - /// - /// This policy configures a TLS connection to use: - /// - TLS 1.2 or 1.3. - /// - For TLS 1.2, only `TLS_ECDHE_[ECDSA|RSA]_WITH_AES_256_GCM_SHA384`. - /// - For TLS 1.3, only `AES-256-GCM`. - /// - P-384 for key agreement. - /// - For handshake signatures, only ECDSA with P-384 and SHA-384, or RSA - /// with SHA-384 or SHA-512. - /// - /// No limitations on the certificate chain nor leaf public key are imposed, - /// other than by the supported signature algorithms. - /// But WPA3's "192-bit" mode requires at least P-384 or 3072-bit RSA along the chain. - /// The caller must enforce this themselves on the verified chain using functions such as - /// [`crate::credentials::TlsCredentialBuilder::with_certificate_chain`]. - /// - /// Note that this setting is less secure than the default. - /// The implementation risks of using a more obscure primitive like P-384 dominate other - /// considerations. - Wpa3_192_202304 = bssl_sys::ssl_compliance_policy_t_ssl_compliance_policy_wpa3_192_202304 as u8, - /// CNSA 202407 - /// - /// This policy configures a TLS connection to use: - /// - For TLS 1.3, AES-256-GCM over AES-128-GCM over ChaCha20-Poly1305. - /// - /// I.e. it ensures that AES-GCM will be used whenever the client supports it. - /// The cipher suite configuration mini-language can be used to similarly - /// configure prior TLS versions if they are enabled. - Cnsa202407 = bssl_sys::ssl_compliance_policy_t_ssl_compliance_policy_cnsa_202407 as u8, - } -}
diff --git a/rust/bssl-tls/src/context.rs b/rust/bssl-tls/src/context.rs index 285f722..8fc26d5 100644 --- a/rust/bssl-tls/src/context.rs +++ b/rust/bssl-tls/src/context.rs
@@ -26,7 +26,6 @@ use crate::{ check_lib_error, config::{ - CompliancePolicy, ConfigurationError, KeyExchangeGroupFlag, KeyExchangeGroups, @@ -456,21 +455,12 @@ where M: HasTlsContextMethod + HasTlsConnectionMethod, { - fn new_connection( - &self, - compliance_policy: Option<CompliancePolicy>, - ) -> NonNull<bssl_sys::SSL> { + fn new_connection(&self) -> NonNull<bssl_sys::SSL> { let conn = unsafe { // Safety: in this type-state, our SSL_CTX is effectively immutable, // so we can freely alias. bssl_sys::SSL_new(self.ptr()) }; - if let Some(policy) = compliance_policy { - unsafe { - // Safety: `policy` is a valid enum value per construction. - bssl_sys::SSL_set_compliance_policy(conn, policy as _); - } - } NonNull::new(conn).expect("allocation failure") } @@ -480,11 +470,8 @@ /// from the server. /// To override this default, use /// [`TlsConnectionBuilder::with_certificate_verification_mode`]. - pub fn new_client_connection( - &self, - compliance_policy: Option<CompliancePolicy>, - ) -> Result<TlsConnectionBuilder<Client, M>, Error> { - let conn = self.new_connection(compliance_policy); + pub fn new_client_connection(&self) -> Result<TlsConnectionBuilder<Client, M>, Error> { + let conn = self.new_connection(); unsafe { // Safety: the connection is still valid here bssl_sys::SSL_set_connect_state(conn.as_ptr()); @@ -499,11 +486,8 @@ } /// Make a new server-half connection inheriting the configuration of this context - pub fn new_server_connection( - &self, - compliance_policy: Option<CompliancePolicy>, - ) -> Result<TlsConnectionBuilder<Server, M>, Error> { - let conn = self.new_connection(compliance_policy); + pub fn new_server_connection(&self) -> Result<TlsConnectionBuilder<Server, M>, Error> { + let conn = self.new_connection(); unsafe { // Safety: the connection is still valid here bssl_sys::SSL_set_accept_state(conn.as_ptr());
diff --git a/rust/bssl-tls/src/credentials/tests.rs b/rust/bssl-tls/src/credentials/tests.rs index 6ae988b..fcca08c 100644 --- a/rust/bssl-tls/src/credentials/tests.rs +++ b/rust/bssl-tls/src/credentials/tests.rs
@@ -159,8 +159,8 @@ let (client_socket, server_socket, mut executor) = create_mock_pipe(); - let mut client_conn = client_ctx.new_client_connection(None)?.build(); - let mut server_conn = server_ctx.new_server_connection(None)?.build(); + let mut client_conn = client_ctx.new_client_connection()?.build(); + let mut server_conn = server_ctx.new_server_connection()?.build(); client_conn.set_io(client_socket)?; server_conn.set_io(server_socket)?; @@ -213,8 +213,8 @@ client_ctx.with_credential(cred)?; let client_ctx = client_ctx.build(); - let mut client_conn = client_ctx.new_client_connection(None)?.build(); - let mut server_conn = server_ctx.new_server_connection(None)?.build(); + let mut client_conn = client_ctx.new_client_connection()?.build(); + let mut server_conn = server_ctx.new_server_connection()?.build(); client_conn.set_split_io(client_reader, client_writer)?; server_conn.set_split_io(server_reader, server_writer)?; @@ -256,7 +256,7 @@ client_ctx.with_accepted_peer_cert_types(&[CertificateType::Rpk])?; let client_ctx = client_ctx.build(); - let mut client_conn_builder = client_ctx.new_client_connection(None)?; + let mut client_conn_builder = client_ctx.new_client_connection()?; client_conn_builder.with_certificate_verification_mode(CertificateVerificationMode::None); let mut client_conn = client_conn_builder.build(); unsafe { @@ -269,7 +269,7 @@ Some(accept_any_verify), ); } - let mut server_conn = server_ctx.new_server_connection(None)?.build(); + let mut server_conn = server_ctx.new_server_connection()?.build(); let (sock_client, sock_server, mut executor) = create_mock_pipe(); @@ -455,10 +455,10 @@ let (sock_client, sock_server, mut executor) = create_mock_pipe(); - let mut server_conn = server_ctx.new_server_connection(None)?.build(); + let mut server_conn = server_ctx.new_server_connection()?.build(); server_conn.set_io(sock_server)?; - let mut client_conn_builder = client_ctx.new_client_connection(None)?; + let mut client_conn_builder = client_ctx.new_client_connection()?; client_conn_builder .with_certificate_verification_mode(CertificateVerificationMode::None) .with_certificate_verifier(
diff --git a/rust/bssl-tls/src/sync_io.rs b/rust/bssl-tls/src/sync_io.rs index b61cf80..2b8ba24 100644 --- a/rust/bssl-tls/src/sync_io.rs +++ b/rust/bssl-tls/src/sync_io.rs
@@ -50,7 +50,7 @@ where S: Read + Write + Send + 'static, { - let mut conn = self.ctx.new_client_connection(None)?.build(); + let mut conn = self.ctx.new_client_connection()?.build(); { conn.in_handshake() .expect("connection is freshly constructed and it cannot already be established") @@ -82,7 +82,7 @@ where S: Read + Write + Send + 'static, { - let mut conn = self.ctx.new_server_connection(None)?.build(); + let mut conn = self.ctx.new_server_connection()?.build(); conn.set_io(StdIoWithReactor::new(stream, NoAsync))?; conn.do_handshake()?;
diff --git a/rust/bssl-tls/src/tests.rs b/rust/bssl-tls/src/tests.rs index ed9b45f..fb34208 100644 --- a/rust/bssl-tls/src/tests.rs +++ b/rust/bssl-tls/src/tests.rs
@@ -84,7 +84,7 @@ }; server_ctx_builder.with_credential(server_cred.unwrap())?; let server_ctx = server_ctx_builder.build(); - let server_conn = server_ctx.new_server_connection(None)?.build(); + let server_conn = server_ctx.new_server_connection()?.build(); let mut client_ctx_builder = TlsContextBuilder::new_tls(); let mut cert_store = X509StoreBuilder::new(); @@ -94,7 +94,7 @@ let cert_store = cert_store.build(); client_ctx_builder.with_certificate_store(&cert_store); let client_ctx = client_ctx_builder.build(); - let client_conn = client_ctx.new_client_connection(None)?.build(); + let client_conn = client_ctx.new_client_connection()?.build(); Ok((server_conn, client_conn)) }
diff --git a/rust/bssl-tls/src/tests/credentials.rs b/rust/bssl-tls/src/tests/credentials.rs index 6c026de..3eb49ba 100644 --- a/rust/bssl-tls/src/tests/credentials.rs +++ b/rust/bssl-tls/src/tests/credentials.rs
@@ -117,7 +117,7 @@ }; server_ctx_builder.with_credential(server_cred)?; let server_ctx = server_ctx_builder.build(); - let mut server_conn = server_ctx.new_server_connection(None)?.build(); + let mut server_conn = server_ctx.new_server_connection()?.build(); let mut client_ctx_builder = TlsContextBuilder::new_tls(); let mut cert_store = X509StoreBuilder::new(); @@ -127,7 +127,7 @@ let cert_store = cert_store.build(); client_ctx_builder.with_certificate_store(&cert_store); let client_ctx = client_ctx_builder.build(); - let mut client_conn = client_ctx.new_client_connection(None)?; + let mut client_conn = client_ctx.new_client_connection()?; client_conn.with_certificate_verification_mode(CertificateVerificationMode::PeerCertMandatory); let mut client_conn = client_conn.build(); client_conn
diff --git a/rust/bssl-tls/src/tests/datagram.rs b/rust/bssl-tls/src/tests/datagram.rs index 6b33ae5..374340d 100644 --- a/rust/bssl-tls/src/tests/datagram.rs +++ b/rust/bssl-tls/src/tests/datagram.rs
@@ -46,7 +46,7 @@ }; server_ctx_builder.with_credential(server_cred.unwrap())?; let server_ctx = server_ctx_builder.build(); - let server_conn = server_ctx.new_server_connection(None)?.build(); + let server_conn = server_ctx.new_server_connection()?.build(); let mut client_ctx_builder = TlsContextBuilder::new_dtls(); let ca = X509Certificate::parse_one_from_pem(super::CA)?; @@ -55,7 +55,7 @@ let cert_store = cert_store.build(); client_ctx_builder.with_certificate_store(&cert_store); let client_ctx = client_ctx_builder.build(); - let client_conn = client_ctx.new_client_connection(None)?.build(); + let client_conn = client_ctx.new_client_connection()?.build(); Ok((server_conn, client_conn)) }
diff --git a/rust/bssl-tls/src/tests/handshake.rs b/rust/bssl-tls/src/tests/handshake.rs index 431f609..1c087a7 100644 --- a/rust/bssl-tls/src/tests/handshake.rs +++ b/rust/bssl-tls/src/tests/handshake.rs
@@ -46,7 +46,7 @@ .with_certificate_cache(Some(&cache)) .with_credential(server_cred.unwrap())?; let server_ctx = server_ctx_builder.build(); - let mut server_conn = server_ctx.new_server_connection(None)?.build(); + let mut server_conn = server_ctx.new_server_connection()?.build(); let mut client_ctx_builder = TlsContextBuilder::new_tls(); let mut cert_store = X509StoreBuilder::new(); @@ -58,7 +58,7 @@ .with_certificate_cache(Some(&cache)) .with_certificate_store(&cert_store); let client_ctx = client_ctx_builder.build(); - let mut client_conn = client_ctx.new_client_connection(None)?; + let mut client_conn = client_ctx.new_client_connection()?; client_conn.with_certificate_verification_mode(CertificateVerificationMode::PeerCertMandatory); let mut client_conn = client_conn.build(); client_conn