Merge branch 'main' into small-fixes

Author: justsmth

.github/workflows/aws-lc-rs.yml

@@ -251,6 +251,111 @@ jobs:
           cargo test -p aws-lc-sys --target x86_64-pc-windows-msvc
           cargo test -p aws-lc-rs --target x86_64-pc-windows-msvc
 
+  # Cross-compile to Windows from Linux using cargo-xwin (clang-cl + lld-link)
+  aws-lc-rs-windows-cross:
+    if: github.repository_owner == 'aws'
+    runs-on: ubuntu-24.04
+    name: aws-lc-rs-windows-cross (${{ matrix.name }})
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: x86_64
+            target: x86_64-pc-windows-msvc
+          - name: x86_64-fips
+            target: x86_64-pc-windows-msvc
+            fips: true
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          repository: aws/aws-lc-rs
+          path: ./aws-lc-rs
+          submodules: 'recursive'
+      - name: Remove aws-lc submodule from crate directories
+        shell: bash
+        run: |
+          rm -rf ./aws-lc-rs/aws-lc-sys/aws-lc
+          rm -rf ./aws-lc-rs/aws-lc-fips-sys/aws-lc
+      - uses: actions/checkout@v4
+        with:
+          path: ./aws-lc-rs/aws-lc-sys/aws-lc
+      - uses: actions/checkout@v4
+        with:
+          path: ./aws-lc-rs/aws-lc-fips-sys/aws-lc
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+      - uses: actions/setup-go@v4
+        with:
+          go-version: '>=1.20'
+      - name: Install dependencies
+        run: |
+          set -ex
+          sudo apt-get update -o Acquire::Languages=none -o Acquire::Translation=none
+          sudo apt-get install --assume-yes --no-install-recommends \
+            cmake ninja-build nasm \
+            wget lsb-release software-properties-common gnupg
+          # Install Clang 19 from LLVM apt repository
+          # (xwin's MSVC STL headers require Clang 19+; Ubuntu 24.04 ships Clang 18)
+          wget -qO- https://apt.llvm.org/llvm.sh | sudo bash -s -- 19
+          sudo ln -sf /usr/bin/clang-19 /usr/local/bin/clang-cl
+          sudo ln -sf /usr/bin/lld-19 /usr/local/bin/lld-link
+          sudo ln -sf /usr/bin/llvm-ar-19 /usr/local/bin/llvm-lib
+          cargo install cargo-xwin --locked
+      - name: Setup Wine binfmt
+        if: matrix.fips
+        env:
+          WINEDEBUG: "-all"
+          DISPLAY: ""
+        run: |
+          set -ex
+          # Wine binfmt allows the kernel to transparently run .exe files through
+          # Wine. This is needed for the FIPS build, which runs fips_empty_main.exe
+          # at build time to capture the integrity hash.
+          #
+          # Ubuntu 24.04's wine64 (9.0) does not properly execute .CRT$XCU
+          # initializers in cross-compiled DLLs, which prevents the FIPS
+          # power-on self-test from running. WineHQ stable (11.0+) handles
+          # this correctly.
+          sudo dpkg --add-architecture i386
+          sudo mkdir -pm755 /etc/apt/keyrings
+          sudo wget -O /etc/apt/keyrings/winehq-archive.key https://dl.winehq.org/wine-builds/winehq.key
+          sudo wget -NP /etc/apt/sources.list.d/ https://dl.winehq.org/wine-builds/ubuntu/dists/noble/winehq-noble.sources
+          sudo apt-get update -o Acquire::Languages=none -o Acquire::Translation=none
+          sudo apt-get install --assume-yes --install-recommends winehq-stable binfmt-support
+          # Register Wine as the interpreter for Windows PE executables
+          if [ ! -f /proc/sys/fs/binfmt_misc/wine ]; then
+            echo ':wine:M::MZ::/usr/bin/wine:' | sudo tee /proc/sys/fs/binfmt_misc/register
+          fi
+          wineboot --init
+      - name: Build
+        working-directory: ./aws-lc-rs
+        env:
+          WINEDEBUG: "-all"
+          DISPLAY: ""
+        run: cargo xwin build -p aws-lc-rs --target ${{ matrix.target }} ${{ matrix.fips && '--features fips' || '' }}
+      - name: FIPS sanity test (via Wine)
+        if: matrix.fips
+        working-directory: ./aws-lc-rs
+        env:
+          WINEDEBUG: "-all"
+          DISPLAY: ""
+        run: |
+          # The FIPS crypto DLL has a version prefix (e.g.,
+          # aws_lc_fips_0_13_13_crypto.dll) and lives in the cargo build
+          # artifacts directory — not next to the test binary. Set WINEPATH
+          # so Wine can find it at runtime.
+          CRYPTO_DLL=$(find target -name '*crypto.dll' -path '*/aws-lc-fips-sys*' | head -1)
+          if [ -z "${CRYPTO_DLL}" ]; then
+            echo "ERROR: Could not find FIPS crypto DLL"
+            exit 1
+          fi
+          echo "Found FIPS DLL: ${CRYPTO_DLL}"
+          export WINEPATH="$(winepath -w "$(dirname "${CRYPTO_DLL}")")"
+          # Any test that loads the FIPS crypto library triggers the power-on
+          # self-test; if the integrity hash is wrong the process aborts.
+          cargo xwin test -p aws-lc-rs --target ${{ matrix.target }} --features fips
+
   # CMake Rust bindings generation tests
   cmake-rust-bindings:
     if: github.repository_owner == 'aws'

.github/workflows/ocsp-external-tests.yml

@@ -0,0 +1,30 @@
+name: OCSP integration tests
+on:
+  pull_request:
+    branches: ["*"]
+  workflow_dispatch:
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref_name }}
+  cancel-in-progress: true
+env:
+  GOPROXY: https://proxy.golang.org,direct
+permissions:
+  contents: read
+
+jobs:
+  ocsp-external:
+    if: github.repository_owner == 'aws'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Git clone the repository
+        uses: actions/checkout@v3
+      - name: Install OS Dependencies
+        run: |
+          sudo apt-get update -o Acquire::Languages=none -o Acquire::Translation=none
+          sudo apt-get -y --no-install-recommends install cmake ninja-build golang
+      - name: Build integration_test
+        run: |
+          cmake -GNinja -Btest_build_dir
+          ninja -C test_build_dir ssl/integration_test
+      - name: Run OCSP integration tests
+        run: ./test_build_dir/ssl/integration_test

.github/workflows/windows-alt.yml

@@ -166,6 +166,19 @@ jobs:
       - if: ${{ matrix.target  == 'x64' }}
         name: Run tests
         run: cmake --build ./build --target run_tests
+      - if: ${{ matrix.target  == 'x64' }}
+        name: Setup Go (for FIPS)
+        uses: actions/setup-go@v4
+        with:
+          go-version: '>=1.20'
+      - if: ${{ matrix.target  == 'x64' }}
+        name: Build and test with FIPS
+        run: |
+          cmake -GNinja -B ./build-fips -DCMAKE_C_COMPILER=clang-cl -DCMAKE_CXX_COMPILER=clang-cl -DCMAKE_BUILD_TYPE=Release -DFIPS=1 -DBUILD_SHARED_LIBS=1
+          cmake --build ./build-fips
+          $buildFips = (Resolve-Path ./build-fips).Path
+          $env:PATH = "$buildFips;$buildFips\crypto;$buildFips\ssl;$env:PATH"
+          cmake --build ./build-fips --target run_tests
   cross-mingw:
     if: github.repository_owner == 'aws'
     runs-on: ubuntu-22.04

crypto/CMakeLists.txt

@@ -629,30 +629,34 @@ if(FIPS_SHARED)
   # Rewrite libcrypto.so, libcrypto.dylib, or crypto.dll to inject the correct module
   # hash value. For now we support the FIPS build only on Linux, macOS, iOS, and Windows.
   if(MSVC)
-    # On Windows we use capture_hash.go to capture the computed integrity value that bcm.o prints to generate the
-    # correct value in generated_fips_shared_support.c. See FIPS.md for a full explanation of the process
-    build_libcrypto(NAME precrypto MODULE_SOURCE $<TARGET_OBJECTS:fipsmodule>)
+    # On Windows we use capture_hash.go: build crypto.dll with a placeholder
+    # hash, then run fips_empty_main.exe (which triggers the integrity check
+    # and prints the correct hash), then patch the placeholder in crypto.dll.
+    #
+    # The fips_integrity target (marked ALL) ensures the hash injection runs
+    # before 'install' copies crypto.dll. Without this, Cargo builds (which
+    # run 'cmake --build --target install') would skip the hash injection
+    # because fips_empty_main is not in crypto's dependency chain.
+    build_libcrypto(NAME crypto MODULE_SOURCE $<TARGET_OBJECTS:fipsmodule> SET_OUTPUT_NAME)
+
     add_executable(fips_empty_main fipsmodule/fips_empty_main.c)
-    target_link_libraries(fips_empty_main PUBLIC precrypto)
+    target_link_libraries(fips_empty_main PUBLIC crypto)
     target_add_awslc_include_paths(TARGET fips_empty_main SCOPE PRIVATE)
-    add_custom_command(OUTPUT generated_fips_shared_support.c
-            COMMAND ${GO_EXECUTABLE} run
-            ${AWSLC_SOURCE_DIR}/util/fipstools/capture_hash/capture_hash.go
-            -in-executable $<TARGET_FILE:fips_empty_main> > generated_fips_shared_support.c
-            WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
-            DEPENDS fips_empty_main ${AWSLC_SOURCE_DIR}/util/fipstools/capture_hash/capture_hash.go
-            )
-    add_library(
-      generated_fipsmodule
-
-      OBJECT
-
-      generated_fips_shared_support.c
-      ${AWSLC_SOURCE_DIR}/crypto/fipsmodule/cpucap/cpucap.c
-    )
-    target_add_awslc_include_paths(TARGET generated_fipsmodule SCOPE PRIVATE)
 
-    build_libcrypto(NAME crypto MODULE_SOURCE $<TARGET_OBJECTS:generated_fipsmodule> SET_OUTPUT_NAME)
+    add_custom_command(
+      OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/fips_hash_injected.stamp
+      COMMAND ${GO_EXECUTABLE} run
+        ${AWSLC_SOURCE_DIR}/util/fipstools/capture_hash/capture_hash.go
+        -in-executable $<TARGET_FILE:fips_empty_main>
+        -patch-dll $<TARGET_FILE:crypto>
+      COMMAND ${CMAKE_COMMAND} -E touch ${CMAKE_CURRENT_BINARY_DIR}/fips_hash_injected.stamp
+      DEPENDS fips_empty_main crypto
+        ${AWSLC_SOURCE_DIR}/util/fipstools/capture_hash/capture_hash.go
+      WORKING_DIRECTORY ${AWSLC_SOURCE_DIR}
+    )
+    add_custom_target(fips_integrity ALL
+      DEPENDS ${CMAKE_CURRENT_BINARY_DIR}/fips_hash_injected.stamp
+    )
   else()
     # On Apple and Linux platforms inject_hash.go can parse libcrypto and inject
     # the hash directly into the final library.

crypto/fipsmodule/CMakeLists.txt

@@ -611,14 +611,20 @@ elseif(FIPS_SHARED)
     # contain pragmas that instruct the compiler to put the code in specific FIPS sections. These sections have a
     # specific suffix $a through $c that controls the order of the FIPS sections when it is linked together into a
     # Grouped Section.
+    #
+    # These custom commands invoke the compiler directly (outside CMake's normal
+    # target compilation), so we must forward CMAKE_C_FLAGS manually. This is
+    # necessary for cross-compilation where the flags contain --target and
+    # system include paths (e.g. clang-cl + xwin on Linux).
+    separate_arguments(FIPS_MARKER_C_FLAGS NATIVE_COMMAND "${CMAKE_C_FLAGS}")
     add_custom_command(
       OUTPUT fips_msvc_start.obj
-      COMMAND ${CMAKE_C_COMPILER} /nologo /c /DAWSLC_FIPS_SHARED_START /Fo:fips_msvc_start.obj ${CMAKE_CURRENT_SOURCE_DIR}/fips_shared_library_marker.c
+      COMMAND ${CMAKE_C_COMPILER} ${FIPS_MARKER_C_FLAGS} -w /nologo /c /DAWSLC_FIPS_SHARED_START /Fo:fips_msvc_start.obj ${CMAKE_CURRENT_SOURCE_DIR}/fips_shared_library_marker.c
       DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/fips_shared_library_marker.c
     )
     add_custom_command(
       OUTPUT fips_msvc_end.obj
-      COMMAND ${CMAKE_C_COMPILER} /nologo /c /DAWSLC_FIPS_SHARED_END /Fo:fips_msvc_end.obj ${CMAKE_CURRENT_SOURCE_DIR}/fips_shared_library_marker.c
+      COMMAND ${CMAKE_C_COMPILER} ${FIPS_MARKER_C_FLAGS} -w /nologo /c /DAWSLC_FIPS_SHARED_END /Fo:fips_msvc_end.obj ${CMAKE_CURRENT_SOURCE_DIR}/fips_shared_library_marker.c
       DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/fips_shared_library_marker.c
     )
 
@@ -631,11 +637,9 @@ elseif(FIPS_SHARED)
 
     add_custom_command(
       OUTPUT ${BCM_NAME}
-      # This takes bcm_library which is static library and possibly a collection of assembly files in a CMake list.
-      # The archiver does not handle the CMake list which uses semicolons between items, this generator expression
-      # converts it to a list of quoted strings, it also needs to be itself string escaped
-      COMMAND ${MSVC_LIB} /nologo fips_msvc_start.obj "\"$<JOIN:$<TARGET_OBJECTS:bcm_library>,\" \">\"" fips_msvc_end.obj /OUT:${BCM_NAME}
-      DEPENDS  fips_msvc_start.obj fips_msvc_end.obj bcm_library
+      COMMAND ${MSVC_LIB} /nologo fips_msvc_start.obj $<TARGET_OBJECTS:bcm_library> fips_msvc_end.obj /OUT:${BCM_NAME}
+      COMMAND_EXPAND_LISTS
+      DEPENDS fips_msvc_start.obj fips_msvc_end.obj bcm_library
       WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
     )
   else()

crypto/fipsmodule/FIPS.md

@@ -163,22 +163,20 @@ The Shared Windows FIPS integrity test differs in two key ways:
 2. How the correct integrity hash is calculated
 
 Microsoft Visual C compiler (MSVC) does not support linker scripts that add symbols to mark the start and end of the text and rodata sections, as is done on Linux. Instead, `fips_shared_library_marker.c` is compiled twice to generate two object files that contain start/end functions and variables. MSVC `pragma` segment definitions are used to place the markers in specific sections (e.g. `.fipstx$a`). This particular name format uses [Portable Executable Grouped Sections](https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#grouped-sections-object-only) to control what section the code is placed in and the order within the section. With the start and end markers placed at `$a` and `$z` respectively, BCM puts everything in the `$b` section. When the final crypto.dll is built, all the code is in the `.fipstx` section, all data is in `.fipsda`, all constants are in `.fipsco`, all uninitialized items in `.fipsbs`, and everything is in the correct order.
-The process to generate the expected integrity fingerprint is also different from Linux:
+The process to generate the expected integrity fingerprint is also different from Linux. We use a single-DLL capture-and-patch approach: build `crypto.dll` once with a placeholder hash, run it to compute the real hash, then binary-patch the placeholder directly in the DLL. This avoids building two separate DLLs whose linker output may differ (e.g. mandatory ASLR on ARM64 causes different ADRP immediates, and `lld-link` used by clang-cl is not guaranteed to produce byte-identical output across two independent link operations).
 
-1. Build the required object files once: `bcm.obj` from `bcm.c` and the start/end object files 
+1. Build the required object files once: `bcm.obj` from `bcm.c` and the start/end object files
     1. `bcm.obj` places the power-on self tests in the `.CRT$XCU` section which is run automatically by the Windows Common Runtime library (CRT) startup code
-2. Use MSVC's `lib.exe` to combine the start/end object files with `bcm.obj` to create the static library `bcm.lib`. 
+2. Use MSVC's `lib.exe` (or `llvm-lib` for clang-cl) to combine the start/end object files with `bcm.obj` to create the static library `bcm.lib`.
     1. MSVC does not support combining multiple object files into another object file like the Apple build.
 3. Build `fipsmodule` which contains the placeholder integrity hash
-4. Build `precrypto.dll` with `bcm.obj` and `fipsmodule`
-5. Build the small application `fips_empty_main.exe` and link it with `precrypto.dll`
-6. `capture-hash.go` runs `fips_empty_main.exe`
+4. Build `crypto.dll` with `bcm.lib` and `fipsmodule`
+5. Build the small application `fips_empty_main.exe` and link it with `crypto.dll`
+6. `capture_hash.go` runs `fips_empty_main.exe`
     1. The CRT runs all functions in the `.CRT$XC*` sections in order starting with `.CRT$XCA`
     2. The BCM power-on tests are in `.CRT$XCU` and are run after all other Windows initialization is complete
     3. BCM calculates the correct integrity value which will not match the placeholder value. Before aborting the process the correct value is printed
-    4. `capture-hash.go` reads the correct integrity value and writes it to `generated_fips_shared_support.c`
-7. `generated_fipsmodule` is built with `generated_fips_shared_support.c`
-8. `crypto.dll` is built with the same original `bcm.lib` and `generated_fipsmodule`
+    4. `capture_hash.go` reads the correct integrity value and binary-patches the 32-byte placeholder directly in `crypto.dll`
 
 ### Linux Static build
 

crypto/fipsmodule/bcm.c

@@ -21,6 +21,10 @@
 #pragma data_seg(".fipsda$b")
 #pragma const_seg(".fipsco$b")
 #pragma bss_seg(".fipsbs$b")
+// Explicitly declare the FIPS rodata section with correct attributes. This
+// ensures the section is known to the compiler/linker even if #pragma const_seg
+// is not fully supported (e.g. clang-cl on ARM64).
+#pragma section(".fipsco$b", read)
 #endif
 
 #include <openssl/chacha.h>

crypto/fipsmodule/cipher/e_aes.c

@@ -565,7 +565,7 @@ static int aes_xts_init_key(EVP_CIPHER_CTX *ctx, const uint8_t *key,
     //
     // key_len is two AES keys
 
-    if (OPENSSL_memcmp(key, key + ctx->key_len / 2, ctx->key_len / 2) == 0) {
+    if (CRYPTO_memcmp(key, key + ctx->key_len / 2, ctx->key_len / 2) == 0) {
       OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_XTS_DUPLICATED_KEYS);
       return 0;
     }

crypto/fipsmodule/evp/p_kem.c

@@ -194,7 +194,9 @@ static int pkey_kem_encapsulate(EVP_PKEY_CTX *ctx,
                                 size_t  *ciphertext_len,
                                 uint8_t *shared_secret,
                                 size_t  *shared_secret_len) {
+  GUARD_PTR(ctx);
   KEM_PKEY_CTX *dctx = ctx->data;
+  GUARD_PTR(dctx);
   const KEM *kem = dctx->kem;
   if (kem == NULL) {
     if (ctx->pkey == NULL) {
@@ -204,6 +206,12 @@ static int pkey_kem_encapsulate(EVP_PKEY_CTX *ctx,
     kem = KEM_KEY_get0_kem(ctx->pkey->pkey.kem_key);
   }
 
+  // Check that length pointers can be written to.
+  if (ciphertext_len == NULL || shared_secret_len == NULL) {
+    OPENSSL_PUT_ERROR(EVP, ERR_R_PASSED_NULL_PARAMETER);
+    return 0;
+  }
+
   // Caller is getting parameter values.
   if (ciphertext == NULL && shared_secret == NULL) {
     *ciphertext_len = kem->ciphertext_len;
@@ -257,7 +265,9 @@ static int pkey_kem_decapsulate(EVP_PKEY_CTX *ctx,
                                 size_t  *shared_secret_len,
                                 const uint8_t *ciphertext,
                                 size_t ciphertext_len) {
+  GUARD_PTR(ctx);
   KEM_PKEY_CTX *dctx = ctx->data;
+  GUARD_PTR(dctx);
   const KEM *kem = dctx->kem;
   if (kem == NULL) {
     if (ctx->pkey == NULL) {
@@ -267,12 +277,24 @@ static int pkey_kem_decapsulate(EVP_PKEY_CTX *ctx,
     kem = KEM_KEY_get0_kem(ctx->pkey->pkey.kem_key);
   }
 
+  // Check that the length pointer can be written to.
+  if (shared_secret_len == NULL) {
+    OPENSSL_PUT_ERROR(EVP, ERR_R_PASSED_NULL_PARAMETER);
+    return 0;
+  }
+
   // Caller is getting parameter values.
   if (shared_secret == NULL) {
     *shared_secret_len = kem->shared_secret_len;
     return 1;
   }
 
+  // The ciphertext buffer must be non-NULL for actual decapsulation.
+  if (ciphertext == NULL) {
+    OPENSSL_PUT_ERROR(EVP, ERR_R_PASSED_NULL_PARAMETER);
+    return 0;
+  }
+
   // The input and output buffers need to be large enough.
   if (ciphertext_len != kem->ciphertext_len ||
       *shared_secret_len < kem->shared_secret_len) {

crypto/fipsmodule/evp/p_pqdsa.c

@@ -78,7 +78,7 @@ static int pkey_pqdsa_sign_generic(EVP_PKEY_CTX *ctx, uint8_t *sig,
     return 1;
   }
 
-  if (*sig_len != pqdsa->signature_len) {
+  if (*sig_len < pqdsa->signature_len) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_BUFFER_TOO_SMALL);
     return 0;
   }
@@ -115,6 +115,10 @@ static int pkey_pqdsa_sign_generic(EVP_PKEY_CTX *ctx, uint8_t *sig,
   }
   // DIGEST sign mode
   else {
+    if (message_len != pqdsa->digest_len) {
+      OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_BUFFER_SIZE);
+      return 0;
+    }
     if (!pqdsa->method->pqdsa_sign(key->private_key, sig, sig_len, message, message_len)) {
       OPENSSL_PUT_ERROR(EVP, ERR_R_INTERNAL_ERROR);
       return 0;
@@ -190,6 +194,10 @@ static int pkey_pqdsa_verify_generic(EVP_PKEY_CTX *ctx, const uint8_t *sig,
   }
   // DIGEST verify mode
   else {
+    if (message_len != pqdsa->digest_len) {
+      OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_BUFFER_SIZE);
+      return 0;
+    }
     if (sig_len != pqdsa->signature_len ||
     !pqdsa->method->pqdsa_verify(key->public_key, sig, sig_len, message, message_len)) {
       OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_SIGNATURE);