More various fixes (F-*)

.github/workflows/macos-build.yml

@@ -46,6 +46,7 @@ jobs:
           cd rustls-wolfcrypt-provider
           make build
           make test
+          make test-quic
 
       - name: Check formatting
         run: |

.github/workflows/ubuntu-build.yml

@@ -46,6 +46,7 @@ jobs:
           cd rustls-wolfcrypt-provider
           make build
           make test
+          make test-quic
 
       - name: Check formatting
         run: |

rustls-wolfcrypt-provider/Cargo.toml

@@ -18,10 +18,10 @@ webpki = { package = "rustls-webpki", version = "0.103.13", features = ["alloc"]
 foreign-types = { version = "0.5.0", default-features = false } 
 rustls-pki-types = { version = "1.11.0", default-features = false } 
 log = { version = "0.4.25", default-features = false } 
-env_logger = { version = "0.11.6", default-features = false }
 wolfcrypt-rs = { path = "../wolfcrypt-rs" }
-rustls-pemfile = { version = "2.2.0", default-features = false }
-hex = { version = "0.4.3", default-features = false, features = ["alloc"]} 
+zeroize = { version = "1", default-features = false, features = ["alloc", "derive"] }
+
+[dev-dependencies]
 wycheproof = { version = "0.6.0", default-features = false, features = [
     "aead",
     "hkdf",
@@ -30,11 +30,9 @@ rayon = "1.10.0"
 anyhow = "1.0.95"
 num_cpus = "1.16.0"
 lazy_static = "1.5.0"
+hex = { version = "0.4.3", default-features = false, features = ["alloc"]} 
 hex-literal = "0.4.1"
-zeroize = { version = "1", default-features = false, features = ["alloc", "derive"] }
-
-
-[dev-dependencies]
+env_logger = { version = "0.11.6", default-features = false }
 rcgen = { version = "0.13" }
 serial_test = { version = "3.2.0", default-features = false }
 tokio = { version = "1.43", features = ["macros", "rt", "net", "io-util", "io-std"], default-features = false }

rustls-wolfcrypt-provider/Makefile

@@ -1,7 +1,11 @@
 .PHONY: test
-test: 
+test:
 	@cargo test
 
+.PHONY: test-quic
+test-quic:
+	@cargo test --features quic
+
 .PHONY: build
 build:
 	@cargo build --release

rustls-wolfcrypt-provider/src/aead/aes128gcm.rs

@@ -140,12 +140,15 @@ impl MessageEncrypter for WCTls12Encrypter {
         // 8 bytes.
         let payload_start = GCM_NONCE_LENGTH - 4;
         let payload_end = m.payload.len() + (GCM_NONCE_LENGTH - 4);
+        let buf = &mut payload.as_mut()[payload_start..payload_end];
+        let buf_len = buf.len() as word32;
+        let buf_ptr = buf.as_mut_ptr();
         ret = unsafe {
             wc_AesGcmEncrypt(
                 aes_object.as_ptr(),
-                payload.as_mut()[payload_start..payload_end].as_mut_ptr(),
-                payload.as_ref()[payload_start..payload_end].as_ptr(),
-                payload.as_ref()[payload_start..payload_end].len() as word32,
+                buf_ptr,
+                buf_ptr as *const u8,
+                buf_len,
                 nonce.as_ptr(),
                 nonce.len() as word32,
                 auth_tag.as_mut_ptr(),
@@ -173,7 +176,7 @@ impl MessageDecrypter for WCTls12Decrypter {
         seq: u64,
     ) -> Result<InboundPlainMessage<'a>, rustls::Error> {
         let payload = &mut m.payload;
-        if payload.len() < GCM_TAG_LENGTH {
+        if payload.len() < (GCM_NONCE_LENGTH - 4) + GCM_TAG_LENGTH {
             return Err(rustls::Error::DecryptError);
         }
         let payload_len = payload.len();
@@ -212,15 +215,15 @@ impl MessageDecrypter for WCTls12Decrypter {
         // from the payload.
         let payload_start = GCM_NONCE_LENGTH - 4;
         let payload_end = payload_len - GCM_TAG_LENGTH;
+        let buf = &mut payload[payload_start..payload_end];
+        let buf_len = buf.len() as word32;
+        let buf_ptr = buf.as_mut_ptr();
         ret = unsafe {
             wc_AesGcmDecrypt(
                 aes_object.as_ptr(),
-                payload[payload_start..payload_end].as_mut_ptr(),
-                payload[payload_start..payload_end].as_ptr(),
-                payload[payload_start..payload_end]
-                    .len()
-                    .try_into()
-                    .unwrap(),
+                buf_ptr,
+                buf_ptr as *const u8,
+                buf_len,
                 nonce.as_ptr(),
                 nonce.len() as word32,
                 auth_tag.as_ptr(),
@@ -318,12 +321,15 @@ impl MessageEncrypter for WCTls13Cipher {
         // authIn, into the authentication tag, authTag.
         // Apparently we need to also need to include for the encoding type into the encrypted
         // payload, hence the + 1 otherwise the rustls returns EoF.
+        let buf = &mut payload.as_mut()[..payload_len + 1];
+        let buf_len = buf.len() as word32;
+        let buf_ptr = buf.as_mut_ptr();
         ret = unsafe {
             wc_AesGcmEncrypt(
                 aes_object.as_ptr(),
-                payload.as_mut()[..payload_len + 1].as_mut_ptr(),
-                payload.as_ref()[..payload_len + 1].as_ptr(),
-                payload.as_ref()[..payload_len + 1].len() as word32,
+                buf_ptr,
+                buf_ptr as *const u8,
+                buf_len,
                 nonce.0.as_ptr(),
                 nonce.0.len() as word32,
                 auth_tag.as_mut_ptr(),
@@ -384,12 +390,15 @@ impl MessageDecrypter for WCTls13Cipher {
 
         // Finally, we have everything to decrypt the message
         // from the payload.
+        let buf = &mut payload[..message_len];
+        let buf_len = buf.len() as word32;
+        let buf_ptr = buf.as_mut_ptr();
         ret = unsafe {
             wc_AesGcmDecrypt(
                 aes_object.as_ptr(),
-                payload[..message_len].as_mut_ptr(),
-                payload[..message_len].as_ptr(),
-                payload[..message_len].len().try_into().unwrap(),
+                buf_ptr,
+                buf_ptr as *const u8,
+                buf_len,
                 nonce.0.as_ptr(),
                 nonce.0.len() as word32,
                 auth_tag.as_ptr(),

rustls-wolfcrypt-provider/src/aead/aes256gcm.rs

@@ -140,12 +140,15 @@ impl MessageEncrypter for WCTls12Encrypter {
         // 8 bytes.
         let payload_start = GCM_NONCE_LENGTH - 4;
         let payload_end = m.payload.len() + (GCM_NONCE_LENGTH - 4);
+        let buf = &mut payload.as_mut()[payload_start..payload_end];
+        let buf_len = buf.len() as word32;
+        let buf_ptr = buf.as_mut_ptr();
         ret = unsafe {
             wc_AesGcmEncrypt(
                 aes_object.as_ptr(),
-                payload.as_mut()[payload_start..payload_end].as_mut_ptr(),
-                payload.as_ref()[payload_start..payload_end].as_ptr(),
-                payload.as_ref()[payload_start..payload_end].len() as word32,
+                buf_ptr,
+                buf_ptr as *const u8,
+                buf_len,
                 nonce.as_ptr(),
                 nonce.len() as word32,
                 auth_tag.as_mut_ptr(),
@@ -173,7 +176,7 @@ impl MessageDecrypter for WCTls12Decrypter {
         seq: u64,
     ) -> Result<InboundPlainMessage<'a>, rustls::Error> {
         let payload = &mut m.payload;
-        if payload.len() < GCM_TAG_LENGTH {
+        if payload.len() < (GCM_NONCE_LENGTH - 4) + GCM_TAG_LENGTH {
             return Err(rustls::Error::DecryptError);
         }
         let payload_len = payload.len();
@@ -212,15 +215,15 @@ impl MessageDecrypter for WCTls12Decrypter {
         // from the payload.
         let payload_start = GCM_NONCE_LENGTH - 4;
         let payload_end = payload_len - GCM_TAG_LENGTH;
+        let buf = &mut payload[payload_start..payload_end];
+        let buf_len = buf.len() as word32;
+        let buf_ptr = buf.as_mut_ptr();
         ret = unsafe {
             wc_AesGcmDecrypt(
                 aes_object.as_ptr(),
-                payload[payload_start..payload_end].as_mut_ptr(),
-                payload[payload_start..payload_end].as_ptr(),
-                payload[payload_start..payload_end]
-                    .len()
-                    .try_into()
-                    .unwrap(),
+                buf_ptr,
+                buf_ptr as *const u8,
+                buf_len,
                 nonce.as_ptr(),
                 nonce.len() as word32,
                 auth_tag.as_ptr(),
@@ -318,12 +321,15 @@ impl MessageEncrypter for WCTls13Cipher {
         // authIn, into the authentication tag, authTag.
         // Apparently we need to also need to include for the encoding type into the encrypted
         // payload, hence the + 1 otherwise the rustls returns EoF.
+        let buf = &mut payload.as_mut()[..payload_len + 1];
+        let buf_len = buf.len() as word32;
+        let buf_ptr = buf.as_mut_ptr();
         ret = unsafe {
             wc_AesGcmEncrypt(
                 aes_object.as_ptr(),
-                payload.as_mut()[..payload_len + 1].as_mut_ptr(),
-                payload.as_ref()[..payload_len + 1].as_ptr(),
-                payload.as_ref()[..payload_len + 1].len() as word32,
+                buf_ptr,
+                buf_ptr as *const u8,
+                buf_len,
                 nonce.0.as_ptr(),
                 nonce.0.len() as word32,
                 auth_tag.as_mut_ptr(),
@@ -385,12 +391,15 @@ impl MessageDecrypter for WCTls13Cipher {
 
         // Finally, we have everything to decrypt the message
         // from the payload.
+        let buf = &mut payload[..message_len];
+        let buf_len = buf.len() as word32;
+        let buf_ptr = buf.as_mut_ptr();
         ret = unsafe {
             wc_AesGcmDecrypt(
                 aes_object.as_ptr(),
-                payload[..message_len].as_mut_ptr(),
-                payload[..message_len].as_ptr(),
-                payload[..message_len].len().try_into().unwrap(),
+                buf_ptr,
+                buf_ptr as *const u8,
+                buf_len,
                 nonce.0.as_ptr(),
                 nonce.0.len() as word32,
                 auth_tag.as_ptr(),

rustls-wolfcrypt-provider/src/aead/chacha20.rs

@@ -153,16 +153,17 @@ impl MessageDecrypter for WCTls12Cipher {
         // to an authentication generated with the inAAD (arbitrary length additional authentication data).
         // Note: If the generated authentication tag does not match the supplied
         // authentication tag, the text is not decrypted.
+        let buf_ptr = payload[..message_len].as_mut_ptr();
         let ret = unsafe {
             wc_ChaCha20Poly1305_Decrypt(
                 self.key.as_ptr(),
                 nonce.0.as_ptr(),
                 aad.as_ptr(),
                 aad.len() as word32,
-                payload[..message_len].as_ptr(), // we decrypt only the payload, we don't include the tag.
+                buf_ptr as *const u8, // we decrypt only the payload, we don't include the tag.
                 message_len as word32,
                 auth_tag.as_ptr(),
-                payload[..message_len].as_mut_ptr(),
+                buf_ptr,
             )
         };
 
@@ -245,15 +246,16 @@ impl MessageEncrypter for WCTls13Cipher {
         // and stores the generated authentication tag in the output buffer, outAuthTag.
         // We need to also need to include for the encoding type, apparently, hence the + 1
         // otherwise the rustls returns EoF.
+        let buf_ptr = payload.as_mut()[..m.payload.len() + 1].as_mut_ptr();
         let ret = unsafe {
             wc_ChaCha20Poly1305_Encrypt(
                 self.key.as_ptr(),
                 nonce.0.as_ptr(),
                 aad.as_ptr(),
                 aad.len() as word32,
-                payload.as_ref()[..m.payload.len() + 1].as_ptr(),
+                buf_ptr as *const u8,
                 (m.payload.len() + 1) as word32,
-                payload.as_mut()[..m.payload.len() + 1].as_mut_ptr(),
+                buf_ptr,
                 auth_tag.as_mut_ptr(),
             )
         };
@@ -298,6 +300,7 @@ impl MessageDecrypter for WCTls13Cipher {
         // to an authentication generated with the inAAD (arbitrary length additional authentication data).
         // Note: If the generated authentication tag does not match the supplied
         // authentication tag, the text is not decrypted.
+        let buf_ptr = payload[..message_len].as_mut_ptr();
         let ret = unsafe {
             wc_ChaCha20Poly1305_Decrypt(
                 self.key.as_ptr(),
@@ -306,10 +309,10 @@ impl MessageDecrypter for WCTls13Cipher {
                 aad.len() as word32,
                 // [..message_len] since we want to exclude the
                 // the auth_tag.
-                payload[..message_len].as_ptr(),
+                buf_ptr as *const u8,
                 message_len as word32,
                 auth_tag.as_ptr(),
-                payload[..message_len].as_mut_ptr(),
+                buf_ptr,
             )
         };