From cbd2f8ede634e14e76a47e3dc6d9c53cce06463e Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 23 Jul 2026 18:42:00 +0000 Subject: [PATCH 1/2] fix: bump serde_with to 3.21.0 and rustls-webpki to 0.103.13 (GHSA-7gcf-g7xr-8hxj, GHSA-965h-392x-2mh5, GHSA-xgp8-3hg3-c2mh) --- Cargo.lock | 242 ++++++++++++++++++++++---- crates/ev-enclave/Cargo.toml | 2 +- crates/ev-enclave/src/attest/error.rs | 2 +- crates/ev-enclave/src/attest/mod.rs | 65 +++++-- 4 files changed, 255 insertions(+), 56 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 6e0f66df..2cff18da 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -252,6 +252,29 @@ version = "1.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26" +[[package]] +name = "aws-lc-rs" +version = "1.17.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "00bdb5da18dac48ca2cc7cd4a98e533e8635a58e2361d13a1a4ee3888e0d72f1" +dependencies = [ + "aws-lc-sys", + "zeroize", +] + +[[package]] +name = "aws-lc-sys" +version = "0.43.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "43103168cc76fe62678a375e722fc9cb3a0146159ac5828bc4f0dfd755c2224c" +dependencies = [ + "cc", + "cmake", + "dunce", + "fs_extra", + "pkg-config", +] + [[package]] name = "aws-nitro-enclaves-cose" version = "0.5.2" @@ -263,7 +286,7 @@ dependencies = [ "serde_bytes", "serde_cbor", "serde_repr", - "serde_with 3.12.0", + "serde_with 3.21.0", ] [[package]] @@ -434,6 +457,15 @@ dependencies = [ "generic-array", ] +[[package]] +name = "bs58" +version = "0.5.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bf88ba1141d185c399bee5288d850d63b8369520c1eafc32a0430b5b6c287bf4" +dependencies = [ + "tinyvec", +] + [[package]] name = "build_const" version = "0.2.2" @@ -469,10 +501,11 @@ dependencies = [ [[package]] name = "cc" -version = "1.2.14" +version = "1.3.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0c3d1b2e905a3a7b00a6141adb0e4c0bb941d11caf55349d863942a1cc44e3c9" +checksum = "c89588d05638b5b4594a3348a2d6c20277e43a7f5c5202b05cc56888475a47b8" dependencies = [ + "find-msvc-tools", "jobserver", "libc", "shlex", @@ -573,6 +606,15 @@ version = "0.7.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "f46ad14479a25103f283c0f10005961cf086d8dc42205bb44c46ac563475dca6" +[[package]] +name = "cmake" +version = "0.1.58" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678" +dependencies = [ + "cc", +] + [[package]] name = "cmov" version = "0.5.4" @@ -836,8 +878,18 @@ version = "0.20.10" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "6f63b86c8a8826a49b8c21f08a2d07338eec8d900540f8630dc76284be802989" dependencies = [ - "darling_core", - "darling_macro", + "darling_core 0.20.10", + "darling_macro 0.20.10", +] + +[[package]] +name = "darling" +version = "0.23.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "25ae13da2f202d56bd7f91c25fba009e7717a1e4a1cc98a76d844b65ae912e9d" +dependencies = [ + "darling_core 0.23.0", + "darling_macro 0.23.0", ] [[package]] @@ -854,13 +906,37 @@ dependencies = [ "syn 2.0.98", ] +[[package]] +name = "darling_core" +version = "0.23.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9865a50f7c335f53564bb694ef660825eb8610e0a53d3e11bf1b0d3df31e03b0" +dependencies = [ + "ident_case", + "proc-macro2", + "quote", + "strsim 0.11.1", + "syn 2.0.98", +] + [[package]] name = "darling_macro" version = "0.20.10" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d336a2a514f6ccccaa3e09b02d41d35330c07ddf03a62165fcec10bb561c7806" dependencies = [ - "darling_core", + "darling_core 0.20.10", + "quote", + "syn 2.0.98", +] + +[[package]] +name = "darling_macro" +version = "0.23.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ac3984ec7bd6cfa798e62b4a642426a5be0e68f9401cfc2a01e3fa9ea2fcdb8d" +dependencies = [ + "darling_core 0.23.0", "quote", "syn 2.0.98", ] @@ -1036,6 +1112,18 @@ version = "0.11.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "1435fa1053d8b2fbbe9be7e97eca7f33d37b28409959813daefc1446a14247f1" +[[package]] +name = "dunce" +version = "1.0.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813" + +[[package]] +name = "dyn-clone" +version = "1.0.20" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555" + [[package]] name = "ecdsa" version = "0.15.1" @@ -1302,6 +1390,12 @@ dependencies = [ "subtle", ] +[[package]] +name = "find-msvc-tools" +version = "0.1.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582" + [[package]] name = "findshlibs" version = "0.10.2" @@ -1370,6 +1464,12 @@ version = "2.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "6c2141d6d6c8512188a7891b4b01590a45f6dac67afb4f255c4124dbb86d4eaa" +[[package]] +name = "fs_extra" +version = "1.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c" + [[package]] name = "futures" version = "0.3.31" @@ -2858,6 +2958,26 @@ dependencies = [ "bitflags 2.8.0", ] +[[package]] +name = "ref-cast" +version = "1.0.26" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "216e8f773d7923bcba9ceb86a86c93cabb3903a11872fc3f138c49630e50b96d" +dependencies = [ + "ref-cast-impl", +] + +[[package]] +name = "ref-cast-impl" +version = "1.0.26" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2c9283685feec7d69af75fb0e858d5e7378f33fe4fc699383b2916ab9273e03c" +dependencies = [ + "proc-macro2", + "quote", + "syn 3.0.2", +] + [[package]] name = "regex" version = "1.11.1" @@ -3044,14 +3164,17 @@ dependencies = [ [[package]] name = "rustls" -version = "0.21.12" +version = "0.23.42" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3f56a14d1f48b391359b22f731fd4bd7e43c97f3c50eee276f3aa09c94784d3e" +checksum = "3c54fcab019b409d04215d3a17cb438fd7fbf192ee61461f20f4fe18704bc138" dependencies = [ + "aws-lc-rs", "log", - "ring", + "once_cell", + "rustls-pki-types", "rustls-webpki", - "sct", + "subtle", + "zeroize", ] [[package]] @@ -3074,17 +3197,22 @@ dependencies = [ [[package]] name = "rustls-pki-types" -version = "1.11.0" +version = "1.15.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "917ce264624a4b4db1c364dcc35bfca9ded014d0a958cd47ad3e960e988ea51c" +checksum = "2f4925028c7eb5d1fcdaf196971378ed9d2c1c4efc7dc5d011256f76c99c0a96" +dependencies = [ + "zeroize", +] [[package]] name = "rustls-webpki" -version = "0.101.7" +version = "0.103.13" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8b6275d1ee7a1cd780b64aca7726599a1dbc893b1e64144529e55c3c2f745765" +checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e" dependencies = [ + "aws-lc-rs", "ring", + "rustls-pki-types", "untrusted", ] @@ -3110,21 +3238,35 @@ dependencies = [ ] [[package]] -name = "scopeguard" -version = "1.2.0" +name = "schemars" +version = "0.9.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49" +checksum = "4cd191f9397d57d581cddd31014772520aa448f65ef991055d7f61582c65165f" +dependencies = [ + "dyn-clone", + "ref-cast", + "serde", + "serde_json", +] [[package]] -name = "sct" -version = "0.7.1" +name = "schemars" +version = "1.2.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "da046153aa2352493d6cb7da4b6e5c0c057d8a1d0a9aa8560baffdd945acd414" +checksum = "a2b42f36aa1cd011945615b92222f6bf73c599a102a300334cd7f8dbeec726cc" dependencies = [ - "ring", - "untrusted", + "dyn-clone", + "ref-cast", + "serde", + "serde_json", ] +[[package]] +name = "scopeguard" +version = "1.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49" + [[package]] name = "sec1" version = "0.3.0" @@ -3355,14 +3497,15 @@ dependencies = [ [[package]] name = "serde_json" -version = "1.0.138" +version = "1.0.151" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d434192e7da787e94a6ea7e9670b26a036d0ca41e0b7efb2676dd32bae872949" +checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14" dependencies = [ "itoa", "memchr", - "ryu", "serde", + "serde_core", + "zmij", ] [[package]] @@ -3424,19 +3567,21 @@ dependencies = [ [[package]] name = "serde_with" -version = "3.12.0" +version = "3.21.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d6b6f7f2fcb69f747921f79f3926bd1e203fce4fef62c268dd3abfb6d86029aa" +checksum = "76a5c54c7310e7b8b9577c286d7e399ddd876c3e12b3ed917a8aabc4b96e9e8c" dependencies = [ "base64 0.22.1", + "bs58", "chrono", "hex", "indexmap 1.9.3", "indexmap 2.7.1", - "serde", - "serde_derive", + "schemars 0.9.0", + "schemars 1.2.1", + "serde_core", "serde_json", - "serde_with_macros 3.12.0", + "serde_with_macros 3.21.0", "time", ] @@ -3446,7 +3591,7 @@ version = "2.3.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "881b6f881b17d13214e5d494c939ebab463d01264ce1811e9d4ac3a882e7695f" dependencies = [ - "darling", + "darling 0.20.10", "proc-macro2", "quote", "syn 2.0.98", @@ -3454,11 +3599,11 @@ dependencies = [ [[package]] name = "serde_with_macros" -version = "3.12.0" +version = "3.21.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8d00caa5193a3c8362ac2b73be6b9e768aa5a4b2f721d8f4b339600c3cb51f8e" +checksum = "84d57bc0c8b9a17920c178daa6bb924850d54a9c97ab45194bb8c17ad66bb660" dependencies = [ - "darling", + "darling 0.23.0", "proc-macro2", "quote", "syn 2.0.98", @@ -3532,9 +3677,9 @@ checksum = "24188a676b6ae68c3b2cb3a01be17fbf7240ce009799bb56d5b1409051e78fde" [[package]] name = "shlex" -version = "1.3.0" +version = "2.0.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64" +checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba" [[package]] name = "signal-hook" @@ -3915,6 +4060,21 @@ dependencies = [ "zerovec", ] +[[package]] +name = "tinyvec" +version = "1.12.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bb4ebadaa0af04fab11ae01eb5f9fdb5f9c5b875506e210e71c07873528baa7f" +dependencies = [ + "tinyvec_macros", +] + +[[package]] +name = "tinyvec_macros" +version = "0.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20" + [[package]] name = "tokio" version = "1.48.0" @@ -3953,9 +4113,9 @@ dependencies = [ [[package]] name = "tokio-rustls" -version = "0.24.1" +version = "0.26.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081" +checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61" dependencies = [ "rustls", "tokio", @@ -4977,6 +5137,12 @@ version = "0.5.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2f06ae92f42f5e5c42443fd094f245eb656abf56dd7cce9b8b263236565e00f2" +[[package]] +name = "zmij" +version = "1.0.23" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b" + [[package]] name = "zopfli" version = "0.8.1" diff --git a/crates/ev-enclave/Cargo.toml b/crates/ev-enclave/Cargo.toml index 3c427d19..9a49eef7 100644 --- a/crates/ev-enclave/Cargo.toml +++ b/crates/ev-enclave/Cargo.toml @@ -32,7 +32,7 @@ async-stream = "0.3.3" tokio-stream = "0.1.9" minus = { version = "5.6.1", features = ["static_output"] } exitcode = "1.1.2" -tokio-rustls = { version = "0.24", features = ["dangerous_configuration"] } +tokio-rustls = { version = "0.26" } x509-parser = "0.14.0" hex = "0.4.3" axum = "0.5.16" diff --git a/crates/ev-enclave/src/attest/error.rs b/crates/ev-enclave/src/attest/error.rs index 808a2b5a..8aeadf5e 100644 --- a/crates/ev-enclave/src/attest/error.rs +++ b/crates/ev-enclave/src/attest/error.rs @@ -19,7 +19,7 @@ pub enum AttestCommandError { #[error(transparent)] Attestation(#[from] attestation_doc_validation::error::AttestationError), #[error(transparent)] - InvalidHostname(#[from] tokio_rustls::rustls::client::InvalidDnsNameError), + InvalidHostname(#[from] tokio_rustls::rustls::pki_types::InvalidDnsNameError), #[error(transparent)] DNSLookupFailure(#[from] tokio::time::error::Elapsed), #[error(transparent)] diff --git a/crates/ev-enclave/src/attest/mod.rs b/crates/ev-enclave/src/attest/mod.rs index 270971ba..f750e361 100644 --- a/crates/ev-enclave/src/attest/mod.rs +++ b/crates/ev-enclave/src/attest/mod.rs @@ -9,8 +9,10 @@ use serde::Deserialize; use std::sync::Arc; use tokio::sync::mpsc; use tokio_rustls::rustls::{ - client::{ClientConfig, ServerCertVerified, ServerCertVerifier}, - RootCertStore, + client::danger::{HandshakeSignatureValid, ServerCertVerified, ServerCertVerifier}, + crypto::{verify_tls12_signature, verify_tls13_signature, CryptoProvider}, + pki_types::{CertificateDer, ServerName, UnixTime}, + ClientConfig, DigitallySignedStruct, Error, SignatureScheme, }; use x509_parser::{certificate::X509Certificate, prelude::FromDer}; @@ -26,20 +28,25 @@ struct SubjectAltNameAttestationValidator { macro_rules! to_rustls_general_error { ($err:expr) => { - tokio_rustls::rustls::Error::General($err.to_string()) + Error::General($err.to_string()) }; } +impl std::fmt::Debug for SubjectAltNameAttestationValidator { + fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result { + f.debug_struct("SubjectAltNameAttestationValidator").finish() + } +} + impl ServerCertVerifier for SubjectAltNameAttestationValidator { fn verify_server_cert( &self, - certificate: &tokio_rustls::rustls::Certificate, - _intermediates: &[tokio_rustls::rustls::Certificate], - _server_name: &tokio_rustls::rustls::ServerName, - _scts: &mut dyn Iterator, + certificate: &CertificateDer<'_>, + _intermediates: &[CertificateDer<'_>], + _server_name: &ServerName<'_>, _ocsp_response: &[u8], - _now: std::time::SystemTime, - ) -> std::result::Result { + _now: UnixTime, + ) -> std::result::Result { let (_, certificate_parsed) = X509Certificate::from_der(certificate.as_ref()) .map_err(|e| to_rustls_general_error!(e))?; let attestation_doc = @@ -57,6 +64,34 @@ impl ServerCertVerifier for SubjectAltNameAttestationValidator { verification_result } + + fn verify_tls12_signature( + &self, + message: &[u8], + cert: &CertificateDer<'_>, + dss: &DigitallySignedStruct, + ) -> Result { + let provider = CryptoProvider::get_default() + .ok_or_else(|| Error::General("no crypto provider installed".into()))?; + verify_tls12_signature(message, cert, dss, &provider.signature_verification_algorithms) + } + + fn verify_tls13_signature( + &self, + message: &[u8], + cert: &CertificateDer<'_>, + dss: &DigitallySignedStruct, + ) -> Result { + let provider = CryptoProvider::get_default() + .ok_or_else(|| Error::General("no crypto provider installed".into()))?; + verify_tls13_signature(message, cert, dss, &provider.signature_verification_algorithms) + } + + fn supported_verify_schemes(&self) -> Vec { + CryptoProvider::get_default() + .map(|p| p.signature_verification_algorithms.supported_schemes().to_vec()) + .unwrap_or_default() + } } pub async fn attest_connection_to_enclave( @@ -70,10 +105,6 @@ pub async fn attest_connection_to_enclave( .await?? .collect::>(); let stream = tokio::net::TcpStream::connect(&destinations[..]).await?; - let mut client_config = ClientConfig::builder() - .with_safe_defaults() - .with_root_certificates(RootCertStore::empty()) - .with_no_client_auth(); let attestation_doc = get_attestation_doc(domain).await?; let (tx, _rx) = mpsc::channel(1); let validator = Arc::new(SubjectAltNameAttestationValidator { @@ -81,13 +112,15 @@ pub async fn attest_connection_to_enclave( expected_pcrs, attestation_doc, }); - client_config + let client_config = ClientConfig::builder() .dangerous() - .set_certificate_verifier(validator); + .with_custom_certificate_verifier(validator) + .with_no_client_auth(); let tls_connector: tokio_rustls::TlsConnector = Arc::new(client_config).into(); // a successful connection means the validator has successfully validated the attestation doc - let mut connection = tls_connector.connect(domain.try_into()?, stream).await?; + let server_name = ServerName::try_from(domain.to_owned())?; + let mut connection = tls_connector.connect(server_name, stream).await?; let (_io, session) = connection.get_mut(); session.send_close_notify(); Ok(()) From a19d12ad997f277440a489b39c5c986b35b93363 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 23 Jul 2026 18:55:03 +0000 Subject: [PATCH 2/2] style: apply rustfmt to attest module after rustls 0.23 migration --- crates/ev-enclave/src/attest/mod.rs | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/crates/ev-enclave/src/attest/mod.rs b/crates/ev-enclave/src/attest/mod.rs index f750e361..eb37afdc 100644 --- a/crates/ev-enclave/src/attest/mod.rs +++ b/crates/ev-enclave/src/attest/mod.rs @@ -34,7 +34,8 @@ macro_rules! to_rustls_general_error { impl std::fmt::Debug for SubjectAltNameAttestationValidator { fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result { - f.debug_struct("SubjectAltNameAttestationValidator").finish() + f.debug_struct("SubjectAltNameAttestationValidator") + .finish() } } @@ -73,7 +74,12 @@ impl ServerCertVerifier for SubjectAltNameAttestationValidator { ) -> Result { let provider = CryptoProvider::get_default() .ok_or_else(|| Error::General("no crypto provider installed".into()))?; - verify_tls12_signature(message, cert, dss, &provider.signature_verification_algorithms) + verify_tls12_signature( + message, + cert, + dss, + &provider.signature_verification_algorithms, + ) } fn verify_tls13_signature( @@ -84,12 +90,21 @@ impl ServerCertVerifier for SubjectAltNameAttestationValidator { ) -> Result { let provider = CryptoProvider::get_default() .ok_or_else(|| Error::General("no crypto provider installed".into()))?; - verify_tls13_signature(message, cert, dss, &provider.signature_verification_algorithms) + verify_tls13_signature( + message, + cert, + dss, + &provider.signature_verification_algorithms, + ) } fn supported_verify_schemes(&self) -> Vec { CryptoProvider::get_default() - .map(|p| p.signature_verification_algorithms.supported_schemes().to_vec()) + .map(|p| { + p.signature_verification_algorithms + .supported_schemes() + .to_vec() + }) .unwrap_or_default() } }