diff --git a/.github/workflows/artifacts.yaml b/.github/workflows/artifacts.yaml index 02dd7663..a33de0df 100644 --- a/.github/workflows/artifacts.yaml +++ b/.github/workflows/artifacts.yaml @@ -23,6 +23,8 @@ jobs: - name: Install stable Rust uses: dtolnay/rust-toolchain@stable + - uses: Swatinem/rust-cache@v2 + - name: Install cargo-c shell: pwsh env: @@ -57,6 +59,8 @@ jobs: - name: Install stable Rust uses: dtolnay/rust-toolchain@stable + - uses: Swatinem/rust-cache@v2 + - name: Install cargo-c env: LINK: https://github.com/lu-zero/cargo-c/releases/latest/download @@ -77,6 +81,39 @@ jobs: name: rustls-ffi-x86_64-linux-gnu path: dist + linux-arm64-binaries: + name: Linux (arm64 GNU) + runs-on: ubuntu-22.04-arm + steps: + - uses: actions/checkout@v7 + with: + persist-credentials: false + + - name: Install stable Rust + uses: dtolnay/rust-toolchain@stable + + - uses: Swatinem/rust-cache@v2 + + - name: Install cargo-c + env: + LINK: https://github.com/lu-zero/cargo-c/releases/latest/download + CARGO_C_FILE: cargo-c-aarch64-unknown-linux-musl.tar.gz + run: | + curl -L $LINK/$CARGO_C_FILE | tar xz -C ~/.cargo/bin + + - name: Build rustls-ffi + run: | + cargo cinstall --locked --target aarch64-unknown-linux-gnu --features cert_compression --release --prefix dist + + - name: Copy in LICENSE files + run: cp LICENSE* dist + + - name: Upload binaries + uses: actions/upload-artifact@v7 + with: + name: rustls-ffi-arm64-linux-gnu + path: dist + linux-deb: name: Linux (x86-64 GNU Deb) runs-on: ubuntu-22.04 # x86_64. @@ -90,6 +127,8 @@ jobs: - name: Install stable Rust uses: dtolnay/rust-toolchain@stable + - uses: Swatinem/rust-cache@v2 + - name: Install cargo-c env: LINK: https://github.com/lu-zero/cargo-c/releases/latest/download @@ -126,13 +165,15 @@ jobs: # Install both the arm64 and x86_64 targets. targets: aarch64-apple-darwin, x86_64-apple-darwin + - uses: Swatinem/rust-cache@v2 + - name: Install cargo-c env: LINK: https://github.com/lu-zero/cargo-c/releases/latest/download CARGO_C_FILE: cargo-c-macos.zip run: | curl -L $LINK/$CARGO_C_FILE -o cargo-c-macos.zip - unzip cargo-c-macos.zip -d ~/.cargo/bin + unzip -o cargo-c-macos.zip -d ~/.cargo/bin - name: Build rustls-ffi (arm64) run: | @@ -171,7 +212,7 @@ jobs: test-archives: name: "Test (${{ matrix.os }})" runs-on: ${{ matrix.os }} - needs: [ windows-binaries, linux-binaries, macos-binaries ] + needs: [ windows-binaries, linux-binaries, linux-arm64-binaries, macos-binaries ] strategy: matrix: include: @@ -179,6 +220,8 @@ jobs: artifact: rustls-ffi-x86_64-windows - os: ubuntu-latest artifact: rustls-ffi-x86_64-linux-gnu + - os: ubuntu-22.04-arm + artifact: rustls-ffi-arm64-linux-gnu - os: macos-15 artifact: rustls-ffi-arm64-macos - os: macos-15-intel diff --git a/CHANGELOG.md b/CHANGELOG.md index f72dc336..4d842fac 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,27 @@ # Changelog +## 0.15.4 (2026-09-25) + +This is a minor release with one security fix. It also updates `rustls` to +[0.23.45](https://github.com/rustls/rustls/releases/tag/v%2F0.23.45). + +### Security + +This update addresses +[GHSA-2mjx-qc3c-rqvc](https://github.com/rustls/rustls/security/advisories/GHSA-2mjx-qc3c-rqvc), +a security issue affecting TLS 1.3 handshake message processing that could allow +a broken peer to send plaintext handshake messages where an encrypted one is +expected without rustls rejecting the connection. + +### Added + +* ML-DSA certificate signature support when using the `aws-lc-rs` cryptography + provider, inherited from the upstream `rustls` + [0.23.44 release](https://github.com/rustls/rustls/releases/tag/v%2F0.23.44). + This includes ML-DSA-44, ML-DSA-65, and ML-DSA-87, and is independent of the + `prefer-post-quantum` feature that controls `X25519MLKEM768` key-exchange + priority. + ## 0.15.3 (2026-04-22) This is a minor release with one security fix. It also updates `rustls` to diff --git a/Cargo.lock b/Cargo.lock index 8273b45f..bd3c33e7 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -51,23 +51,24 @@ checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53" [[package]] name = "aws-lc-fips-sys" -version = "0.13.14" +version = "0.14.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d3d619165468401dec3caa3366ebffbcb83f2f31883e5b3932f8e2dec2ddc568" +checksum = "03367707e92796b190a4207d4d39b0a4271d574503d2969c2b0cfbf5c87658ee" dependencies = [ "bindgen", "cc", "cmake", "dunce", "fs_extra", + "pkg-config", "regex", ] [[package]] name = "aws-lc-rs" -version = "1.17.0" +version = "1.18.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5ec2f1fc3ec205783a5da9a7e6c1509cc69dedf09a1949e412c1e18469326d00" +checksum = "b281d307588d634de920874890732659e2e7672f72b5e10e81badc1a8a83621e" dependencies = [ "aws-lc-fips-sys", "aws-lc-sys", @@ -76,14 +77,15 @@ dependencies = [ [[package]] name = "aws-lc-sys" -version = "0.41.0" +version = "0.45.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1a2f9779ce85b93ab6170dd940ad0169b5766ff848247aff13bb788b832fe3f4" +checksum = "9bff6c3b54fad79a2e60b8102caf565819711497c1f5f092f49508e2f5c31b27" dependencies = [ "cc", "cmake", "dunce", "fs_extra", + "pkg-config", ] [[package]] @@ -947,6 +949,12 @@ version = "0.2.17" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd" +[[package]] +name = "pkg-config" +version = "0.3.34" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548" + [[package]] name = "portable-atomic" version = "1.13.1" @@ -1105,9 +1113,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.42" +version = "0.23.45" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3c54fcab019b409d04215d3a17cb438fd7fbf192ee61461f20f4fe18704bc138" +checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" dependencies = [ "aws-lc-rs", "brotli", @@ -1125,7 +1133,7 @@ dependencies = [ [[package]] name = "rustls-ffi" -version = "0.15.3" +version = "0.15.4" dependencies = [ "libc", "log", @@ -1202,9 +1210,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" [[package]] name = "rustls-webpki" -version = "0.103.13" +version = "0.103.15" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e" +checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" dependencies = [ "aws-lc-rs", "ring", diff --git a/README.md b/README.md index 8a628598..519c72a3 100644 --- a/README.md +++ b/README.md @@ -98,15 +98,28 @@ platforms see the upstream documentation: [`*ring*`]: https://crates.io/crates/ring [`*ring*` supported platforms]: https://github.com/briansmith/ring/blob/2e8363b433fa3b3962c877d9ed2e9145612f3160/include/ring-core/target.h#L18-L64 -#### Post-Quantum X25519MLKEM768 Key Exchange +#### Post-Quantum Support -Post-quantum-secure key exchange using [X25519MLKEM768][] is supported when using the `aws-lc-rs` -cryptography provider and offered by default at the highest priority. +The `aws-lc-rs` cryptography provider supports post-quantum-secure key exchange +and certificate signatures. These algorithms are not supported by the `ring` +provider. -By disabling the `prefer-post-quantum` feature flag the `X25519MLKEM768` key exchange will be -offered at a lower negotiation priority. +##### X25519MLKEM768 Key Exchange -[X25519MLKEM768]: https://datatracker.ietf.org/doc/draft-kwiatkowski-tls-ecdhe-mlkem +Post-quantum-secure key exchange using [X25519MLKEM768][] is offered by default +at the highest priority. + +The `prefer-post-quantum` Cargo feature is enabled by default. Disabling it +keeps `X25519MLKEM768` available, but at a lower negotiation priority. Note that +this feature only controls key-exchange priority. It doesn't affect ML-DSA +support. + +[X25519MLKEM768]: https://datatracker.ietf.org/doc/draft-ietf-tls-ecdhe-mlkem/ + +##### ML-DSA Certificate Signatures + +Certificates and private keys using the ML-DSA-44, ML-DSA-65, and ML-DSA-87 +signature schemes are supported. This is principally useful with private PKIs. #### Certificate Compression diff --git a/librustls/Cargo.toml b/librustls/Cargo.toml index 83a4977f..5faa3167 100644 --- a/librustls/Cargo.toml +++ b/librustls/Cargo.toml @@ -1,7 +1,7 @@ [package] name = "rustls-ffi" # Keep in sync with defines in cbindgen.toml -version = "0.15.3" +version = "0.15.4" license = "Apache-2.0 OR ISC OR MIT" readme = "../README-crates.io.md" description = "Rustls bindings for non-Rust languages" @@ -30,7 +30,7 @@ prefer-post-quantum = ["aws-lc-rs", "rustls/prefer-post-quantum"] [dependencies] # Keep in sync with RUSTLS_CRATE_VERSION in build.rs -rustls = { version = "=0.23.42", default-features = false, features = ["std", "tls12"] } +rustls = { version = "=0.23.45", default-features = false, features = ["std", "tls12"] } webpki = { workspace = true } libc = { workspace = true } log = { workspace = true } diff --git a/librustls/build.rs b/librustls/build.rs index 793b6337..8c9499bc 100644 --- a/librustls/build.rs +++ b/librustls/build.rs @@ -37,4 +37,4 @@ fn main() { // because doing so would require a heavy-weight deserialization lib dependency // (and it couldn't be a _dev_ dep for use in a build script) or doing brittle // by-hand parsing. -const RUSTLS_CRATE_VERSION: &str = "0.23.42"; +const RUSTLS_CRATE_VERSION: &str = "0.23.45"; diff --git a/librustls/cbindgen.toml b/librustls/cbindgen.toml index f3a2d595..02d52466 100644 --- a/librustls/cbindgen.toml +++ b/librustls/cbindgen.toml @@ -5,7 +5,7 @@ after_includes = """ #define RUSTLS_VERSION_MAJOR 0 #define RUSTLS_VERSION_MINOR 15 -#define RUSTLS_VERSION_PATCH 3 +#define RUSTLS_VERSION_PATCH 4 /** * This gives each version part 8 bits, and leaves the 8 least significant bits @@ -13,7 +13,7 @@ after_includes = """ */ #define RUSTLS_VERSION_NUMBER ((RUSTLS_VERSION_MAJOR << 24) \\ |(RUSTLS_VERSION_MINOR << 16) \\ - |(RUSTLS_VERSION_MINOR << 8)) + |(RUSTLS_VERSION_PATCH << 8)) #if defined(__clang__) || defined(__GNUC__) # define DEPRECATED_FUNC(why) __attribute__((deprecated(why))) diff --git a/librustls/src/acceptor.rs b/librustls/src/acceptor.rs index 1684af16..0b94cc54 100644 --- a/librustls/src/acceptor.rs +++ b/librustls/src/acceptor.rs @@ -775,8 +775,13 @@ mod tests { SignatureScheme::RSA_PSS_SHA512, SignatureScheme::ED25519, ]; - #[cfg(feature = "aws-lc-rs")] // aws-lc-rs also includes P-521. - expected_schemes.push(SignatureScheme::ECDSA_NISTP521_SHA512); + #[cfg(feature = "aws-lc-rs")] + expected_schemes.extend([ + SignatureScheme::ECDSA_NISTP521_SHA512, + SignatureScheme::ML_DSA_44, + SignatureScheme::ML_DSA_65, + SignatureScheme::ML_DSA_87, + ]); let mut expected_schemes = expected_schemes .into_iter() diff --git a/librustls/src/rustls.h b/librustls/src/rustls.h index 85327bdc..d6d7957a 100644 --- a/librustls/src/rustls.h +++ b/librustls/src/rustls.h @@ -9,7 +9,7 @@ #define RUSTLS_VERSION_MAJOR 0 #define RUSTLS_VERSION_MINOR 15 -#define RUSTLS_VERSION_PATCH 3 +#define RUSTLS_VERSION_PATCH 4 /** * This gives each version part 8 bits, and leaves the 8 least significant bits @@ -17,7 +17,7 @@ */ #define RUSTLS_VERSION_NUMBER ((RUSTLS_VERSION_MAJOR << 24) \ |(RUSTLS_VERSION_MINOR << 16) \ - |(RUSTLS_VERSION_MINOR << 8)) + |(RUSTLS_VERSION_PATCH << 8)) #if defined(__clang__) || defined(__GNUC__) # define DEPRECATED_FUNC(why) __attribute__((deprecated(why)))