Merge pull request #494 from egrimley-arm/pr-tls13

Switch from TLS 1.2 to TLS 1.3.

Author: egrimley-arm

icecap/src/c/libc-supplement/include/stdio.h

@@ -17,5 +17,6 @@
 typedef struct { void *x; } FILE;
 
 int printf(const char *format, ...);
+int puts(const char *s);
 int snprintf(char *str, size_t size, const char *format, ...);
 int vsnprintf(char *str, size_t size, const char *format, __builtin_va_list ap);

icecap/src/c/libc-supplement/src/printf.c

@@ -0,0 +1,19 @@
+/*
+ * AUTHORS
+ *
+ * The Veracruz Development Team.
+ *
+ * COPYRIGHT
+ *
+ * See the `LICENSE_MIT.markdown` file in the Veracruz root directory
+ * for licensing and copyright information.
+ *
+ */
+
+#include <stdio.h>
+
+int printf(const char *format, ...)
+{
+    // HACK: do nothing, and assume return value is not checked
+    return 0;
+}

icecap/src/c/libc-supplement/src/puts.c

@@ -0,0 +1,19 @@
+/*
+ * AUTHORS
+ *
+ * The Veracruz Development Team.
+ *
+ * COPYRIGHT
+ *
+ * See the `LICENSE_MIT.markdown` file in the Veracruz root directory
+ * for licensing and copyright information.
+ *
+ */
+
+#include <stdio.h>
+
+int puts(const char *s)
+{
+    // HACK: do nothing
+    return 0;
+}

sdk/generate-policy/src/main.rs

@@ -10,8 +10,8 @@
 //! and copyright information.
 
 use std::{
-    fmt::Debug,
     convert::TryFrom,
+    fmt::Debug,
     fs::{read_to_string, File},
     io::{Read, Write},
     net::SocketAddr,
@@ -41,8 +41,7 @@ use wasi_types::Rights;
 ////////////////////////////////////////////////////////////////////////////////
 
 /// Aborts the program with a message on `stderr`.
-fn abort_with<T: Debug>(msg: T) -> !
-{
+fn abort_with<T: Debug>(msg: T) -> ! {
     eprintln!("{:?}", msg);
     exit(1);
 }
@@ -80,7 +79,7 @@ information.";
 const VERSION: &'static str = "0.1.0";
 
 /// The single supported ciphersuite embedded in the policy file.
-const POLICY_CIPHERSUITE: &'static str = "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256";
+const POLICY_CIPHERSUITE: &'static str = "TLS1_3_CHACHA20_POLY1305_SHA256";
 
 /// The default filename of the output JSON policy file, if no alternative is
 /// provided on the command line.

session-manager/src/session_context.rs

@@ -156,12 +156,13 @@ impl SessionContext {
         let entropy = Arc::new(mbedtls::rng::OsEntropy::new());
         let rng = Arc::new(mbedtls::rng::CtrDrbg::new(entropy, None)?);
         config.set_rng(rng);
-        config.set_min_version(config::Version::Tls1_2)?;
-        config.set_max_version(config::Version::Tls1_2)?;
+        config.set_min_version(config::Version::Tls1_3)?;
+        config.set_max_version(config::Version::Tls1_3)?;
         config.set_ca_list(Arc::new(self.root_certs.clone()), None);
         config.push_cert(
             Arc::new(self.cert_chain.clone()),
             Arc::new(mbedtls::pk::Pk::from_private_key(
+                &mut mbedtls::rng::CtrDrbg::new(Arc::new(mbedtls::rng::OsEntropy::new()), None)?,
                 &self.server_private_key,
                 None,
             )?),

tests/tests/server_test.rs

@@ -771,8 +771,8 @@ impl TestExecutor {
     }
 
     fn check_policy_hash(&mut self) -> Result<Vec<u8>> {
-        let serialized_request_policy_hash =
-            transport_protocol::serialize_request_policy_hash().map_err(|e| {
+        let serialized_request_policy_hash = transport_protocol::serialize_request_policy_hash()
+            .map_err(|e| {
                 anyhow!(
                     "Failed to serialize request for policy hash.  Error produced: {:?}.",
                     e
@@ -1030,8 +1030,8 @@ fn create_client_test_connection<P: AsRef<Path>, Q: AsRef<Path>>(
         mbedtls::ssl::config::Transport::Stream,
         mbedtls::ssl::config::Preset::Default,
     );
-    config.set_min_version(mbedtls::ssl::config::Version::Tls1_2)?;
-    config.set_max_version(mbedtls::ssl::config::Version::Tls1_2)?;
+    config.set_min_version(mbedtls::ssl::config::Version::Tls1_3)?;
+    config.set_max_version(mbedtls::ssl::config::Version::Tls1_3)?;
     let policy_ciphersuite = veracruz_utils::lookup_ciphersuite(ciphersuite_str)
         .ok_or_else(|| anyhow!("invalid ciphersuite"))?;
     let cipher_suites: Vec<i32> = vec![policy_ciphersuite.into(), 0];
@@ -1061,6 +1061,10 @@ fn read_cert_file<P: AsRef<Path>>(filename: P) -> Result<List<Certificate>> {
 fn read_priv_key_file<P: AsRef<Path>>(filename: P) -> Result<mbedtls::pk::Pk> {
     let mut buffer = std::fs::read(filename)?;
     buffer.push(b'\0');
-    let pkey_vec = mbedtls::pk::Pk::from_private_key(&buffer, None)?;
+    let pkey_vec = mbedtls::pk::Pk::from_private_key(
+        &mut mbedtls::rng::CtrDrbg::new(Arc::new(mbedtls::rng::OsEntropy::new()), None)?,
+        &buffer,
+        None,
+    )?;
     Ok(pkey_vec)
 }

third-party/rust-mbedtls

@@ -104,8 +104,13 @@ fn veracruz_client_session() {
         let mut key_buffer = std::vec::Vec::new();
         key_file.read_to_end(&mut key_buffer).unwrap();
         key_buffer.push(b'\0');
-        let rsa_keys = mbedtls::pk::Pk::from_private_key(&key_buffer, None)
-            .expect("file contains invalid rsa private key");
+        let rsa_keys = mbedtls::pk::Pk::from_private_key(
+            &mut mbedtls::rng::CtrDrbg::new(Arc::new(mbedtls::rng::OsEntropy::new()), None)
+                .unwrap(),
+            &key_buffer,
+            None,
+        )
+        .expect("file contains invalid rsa private key");
         rsa_keys
     };
 
@@ -136,10 +141,10 @@ fn veracruz_client_session() {
     );
     config.set_ca_list(Arc::new(client_cert), None);
     config
-        .set_min_version(mbedtls::ssl::config::Version::Tls1_2)
+        .set_min_version(mbedtls::ssl::config::Version::Tls1_3)
         .unwrap();
     config
-        .set_max_version(mbedtls::ssl::config::Version::Tls1_2)
+        .set_max_version(mbedtls::ssl::config::Version::Tls1_3)
         .unwrap();
     config
         .push_cert(Arc::new(server_cert), Arc::new(server_priv_key))

third-party/rust-psa-crypto

@@ -18,7 +18,10 @@ use std::{
     fs::File,
     io::{BufReader, Read, Write},
     path::Path,
-    sync::{Arc, atomic::{AtomicU32, Ordering}},
+    sync::{
+        atomic::{AtomicU32, Ordering},
+        Arc,
+    },
 };
 use veracruz_utils::VERACRUZ_RUNTIME_HASH_EXTENSION_ID;
 
@@ -99,7 +102,8 @@ impl Write for InsecureConnection {
             let received_session_id = body_items[0]
                 .parse::<u32>()
                 .map_err(|_| err("bad session id"))?;
-            self.remote_session_id.store(received_session_id, Ordering::SeqCst);
+            self.remote_session_id
+                .store(received_session_id, Ordering::SeqCst);
             // And append response data to the read_buffer.
             for item in body_items.iter().skip(1) {
                 let this_body_data = base64::decode(item).map_err(|_| err("base64::decode"))?;
@@ -153,7 +157,11 @@ impl VeracruzClient {
     pub(crate) fn read_private_key<P: AsRef<Path>>(filename: P) -> Result<Pk> {
         let mut buffer = VeracruzClient::read_all_bytes_in_file(filename)?;
         buffer.push(b'\0');
-        let pkey_vec = Pk::from_private_key(&buffer, None)?;
+        let pkey_vec = Pk::from_private_key(
+            &mut mbedtls::rng::CtrDrbg::new(Arc::new(mbedtls::rng::OsEntropy::new()), None)?,
+            &buffer,
+            None,
+        )?;
         Ok(pkey_vec)
     }
 
@@ -228,8 +236,8 @@ impl VeracruzClient {
 
         use mbedtls::ssl::config::{Config, Endpoint, Preset, Transport, Version};
         let mut config = Config::new(Endpoint::Client, Transport::Stream, Preset::Default);
-        config.set_min_version(Version::Tls1_2)?;
-        config.set_max_version(Version::Tls1_2)?;
+        config.set_min_version(Version::Tls1_3)?;
+        config.set_max_version(Version::Tls1_3)?;
         let policy_ciphersuite = veracruz_utils::lookup_ciphersuite(policy.ciphersuite().as_str())
             .ok_or(anyhow!(VeracruzClientError::UnexpectedCiphersuite))?;
         let cipher_suites: Vec<i32> = vec![policy_ciphersuite.into(), 0];
@@ -372,12 +380,13 @@ impl VeracruzClient {
             .ok_or(anyhow!(VeracruzClientError::UnexpectedCertificate))?;
         let extensions = cert.extensions()?;
         // check for OUR extension
-        let data = veracruz_utils::find_extension(extensions, &VERACRUZ_RUNTIME_HASH_EXTENSION_ID).ok_or({
-            error!("Our extension is not present. This should be fatal");
-            anyhow!(VeracruzClientError::RuntimeHashExtensionMissing)
-        })?;
+        let data = veracruz_utils::find_extension(extensions, &VERACRUZ_RUNTIME_HASH_EXTENSION_ID)
+            .ok_or({
+                error!("Our extension is not present. This should be fatal");
+                anyhow!(VeracruzClientError::RuntimeHashExtensionMissing)
+            })?;
         info!("Certificate extension present.");
-        self.compare_runtime_hash(&data).map_err(|err|{
+        self.compare_runtime_hash(&data).map_err(|err| {
             error!("Runtime hash mismatch: {}.", err);
             anyhow!(err)
         })