Update to 1.3.56 #2

nickitat · 2024-01-23T20:20:46Z

No description provided.

Signed-off-by: Felipe R. Monteiro <[email protected]>

* Update s2n to latest PQ Hybrid TLS 1.3 Draft Specification

…match. (aws#3866)

…load_cns (aws#3870) * Revert defer_cleanup * use ZERO_TO_DISABLE_DEFER_CLEANUP * Add unit test * Add second link * Use defer cleanup for X509_NAME * Break up test * Call load cns multiple times * Use default cert and check return values * Avoid reassigning x509_name * Move define pointer cleanup func into test

) * tokio-s2n-tls: Enable access to the IO instance from TcpStream * Rename io_* get_* for getting the inner stream --------- Co-authored-by: Cameron Bytheway <[email protected]>

New usage is based on [the KEM API design document][1] and [header][2]. Now that we're on a stable KEM API, we remove the S2N_AWSLC_KYBER_UNSTABLE build flag and always use the linked libcrypto's Kyber implementation if available. This flag wasn't previously specified in any of our CI scripts, meaning that AWS-LC-backed kyber was previously uncovered in s2n's CI. This commit ensures that coverage and updates the PQ KEM unit test to asserts that if (non-FIPS) AWS-LC is used as the backing libcrypto, it has the new Kyber 512 KEM API available. [1]: https://github.com/aws/aws-lc/blob/main/crypto/kem/README.md [2]: https://github.com/aws/aws-lc/blob/92c56fbc15f9bb43c4ff062c6c02f7991fd417f6/include/openssl/evp.h#L880 Check for other pre-processor symbol from AWS-LC

…#3891) Co-authored-by: maddeleine <[email protected]>

This is currently only supported for TLS 1.3 and is standard compliant, using the TLS-Exporter function defined by RFC 8446: https://www.rfc-editor.org/rfc/rfc8446#section-7.5

Co-authored-by: Lindsay Stewart <[email protected]>

This commit shifts the TlsConnection trait to make it more generic. The purpose of this is to allow more general usage of the TlsConnection objects. In the future, "purpose-specific" logic will be implemented on the Config type rather than the connection type.

…rsions extension (aws#4249)

…#4228)

…en using multiple threads. See also aws/aws-sdk-cpp#1706.

CLAassistant · 2024-01-23T20:21:00Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
2 out of 14 committers have signed the CLA.

✅ nickitat
✅ vitlibar
❌ toidiu
❌ lrstewart
❌ camshaft
❌ goatgoose
❌ jmayclin
❌ arielb1
❌ dougch
❌ Mark-Simulacrum
❌ WillChilds-Klein
❌ WesleyRosenblum
❌ maddeleine
❌ qinheping
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

lrstewart and others added 30 commits February 23, 2023 15:18

Add JA3 to s2nd (aws#3838)

eb83c3d

filter do_not_merge label from Ready to merge (aws#3849)

55c8a52

Remove unused s2n_config_client_hello_cb_enable_poll (aws#3850)

60da828

Run integv2 tests with nix (aws#3824)

6d4eb1f

ci: nix fmt action (aws#3834)

5d1898a

Add CBMC proof-running GitHub Action (aws#3840)

2352dd1

Upgrade OpenSSL model for CBMC proofs (aws#3857)

9533076

Signed-off-by: Felipe R. Monteiro <[email protected]>

Bump Rust MSRV for latest openssl-src. (aws#3858)

a9c152f

Handle ASN.1 type detection errors (aws#3855)

8062414

[bindings] Add private key callback (aws#3847)

274f321

Removed codecov github status badge. (aws#3859)

4af1487

Add method to create Rust certs without private keys (aws#3860)

e885b1b

Update s2n to latest revision of PQ Hybrid TLS 1.3 Draft RFC (aws#3800)

7640009

* Update s2n to latest PQ Hybrid TLS 1.3 Draft Specification

chore: bump rust bindings version; crates msrv to 1.63.0 (aws#3863)

e3cecf2

ci: Check for msrv match between rust-toolchain an crates; make them …

61d77b0

…match. (aws#3866)

tests: add checks for LTO+interning compatibility (aws#3839)

8816a57

Enforce that ENSURE and GUARD_OSSL use valid error codes (aws#3873)

77d70d8

Rewrite of the PSK section in Usage Guide (aws#3864)

1707ff2

test: cleanup after tests (aws#3831)

ae5c47c

ktls: feature probe test (aws#3869)

bd0b756

Fixes some compiler warnings coming from tests (aws#3883)

6f4e104

tokio-s2n-tls: Enable access to the IO instance from TcpStream (aws#3882

d35e966

) * tokio-s2n-tls: Enable access to the IO instance from TcpStream * Rename io_* get_* for getting the inner stream --------- Co-authored-by: Cameron Bytheway <[email protected]>

chore: bump rust bindings for 1.3.39 release (aws#3887)

63870f4

test: cleanup tests (aws#3832)

b999dba

test: Add missing packages to nix devShell (aws#3885)

736bbed

Document behavior of s2n_negotiate for a client with client auth (aws…

3a4639e

…#3891) Co-authored-by: maddeleine <[email protected]>

Switch OpenBSD CI job GH action to something more robust (aws#3877)

2004999

Enable strict compile checks in unit test build (aws#3878)

7a5a07a

Mark-Simulacrum and others added 24 commits October 4, 2023 08:09

Add support for exporting symmetric keys from connections (aws#4230)

b15a1ba

This is currently only supported for TLS 1.3 and is standard compliant, using the TLS-Exporter function defined by RFC 8446: https://www.rfc-editor.org/rfc/rfc8446#section-7.5

ci: add ktls + asan build (aws#4213)

76fb286

ktls: forbid renegotiation (aws#4229)

a6517c5

ktls: support aes256 (aws#4227)

2a6ead7

Merge pull request from GHSA-97r4-p6c4-5gv3

4654fec

Co-authored-by: Lindsay Stewart <[email protected]>

Run clang-format (aws#4238)

b0ada99

bindings: release 0.0.39 (aws#4235)

5af7a0d

feat: Processes post-handshake messages for quic (aws#4218)

18dd059

chore: pin dependency to fix rust MSRV issues (aws#4243)

2d05302

feat: Turns off automatic ticket creation for quic (aws#4239)

a2b16d2

Switch sig schemes from copies to references (aws#4237)

92c35cb

Add new PQ TLS 1.3 policies (aws#4247)

3526e69

bindings: release 0.0.40 (aws#4251)

6f86292

docs: remove extra security policy item (aws#4248)

fa58945

Clean up sending supported sig algs (aws#4254)

e4f5bf6

Allow TLS 1.2 servers to report client versions from the supported ve…

e9d48da

…rsions extension (aws#4249)

Always apply the PARTIAL_CHAIN flag (aws#4258)

e76363e

Update get_client_cert_chain API documentation (aws#4260)

80db009

Switch from vmactions to cross-platform-actions (aws#4266)

aa41c9b

Clean up receiving peer sig alg (aws#4259)

5c860d7

fix: update permissions to allow dashboard to write to gh-pages. (aws…

1dc74a5

…#4228)

ci: Minor cppcheck speedup (aws#4268)

95753f0

Fix memory leak from s2n_per_thread_rand_state thread-local data wh…

5e0c164

…en using multiple threads. See also aws/aws-sdk-cpp#1706.

Merge branch 'master' into upd_1.3.56

955d421

nickitat force-pushed the upd_1.3.56 branch from 3eef878 to 955d421 Compare January 23, 2024 21:06

fix build

9a1e754

nickitat merged commit 8824ae2 into master Feb 11, 2024
0 of 2 checks passed

nickitat deleted the upd_1.3.56 branch February 11, 2024 22:20

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update to 1.3.56 #2

Update to 1.3.56 #2

nickitat commented Jan 23, 2024

CLAassistant commented Jan 23, 2024 •

edited

Loading

Update to 1.3.56 #2

Update to 1.3.56 #2

Conversation

nickitat commented Jan 23, 2024

CLAassistant commented Jan 23, 2024 • edited Loading

CLAassistant commented Jan 23, 2024 •

edited

Loading