Narrow provider contract hardening scope

Author: thieman

src/aead.rs

@@ -12,7 +12,6 @@ use windows::Win32::Security::Cryptography::{
     BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO_VERSION, BCRYPT_CHACHA20_POLY1305_ALG_HANDLE,
     BCRYPT_FLAGS, BCRYPT_KEY_HANDLE,
 };
-use zeroize::Zeroizing;
 
 /// The tag length is 16 bytes for all supported ciphers.
 pub(crate) const TAG_LEN: usize = 16;
@@ -114,13 +113,14 @@ impl AeadKey {
             ..Default::default()
         };
 
-        let input = Zeroizing::new(data.to_vec());
         unsafe {
+            // SAFETY: CNG supports in-place encryption, so the input and output buffers can be the same.
             let mut size = 0u32;
+            let input = std::slice::from_raw_parts(data.as_ptr().cast(), data.len());
 
             BCryptEncrypt(
                 *self.handle,
-                Some(input.as_slice()),
+                Some(input),
                 Some(std::ptr::from_ref(&info) as *mut _),
                 None,
                 Some(data),
@@ -161,11 +161,14 @@ impl AeadKey {
 
         let mut size = 0u32;
 
-        let input = ciphertext.to_vec();
         unsafe {
+            // SAFETY: CNG supports in-place decryption, so the input and output buffers can be the same.
+
+            let input = std::slice::from_raw_parts(ciphertext.as_ptr().cast(), ciphertext.len());
+
             BCryptDecrypt(
                 *self.handle,
-                Some(&input),
+                Some(input),
                 Some(std::ptr::from_ref(&info) as *mut _),
                 None,
                 Some(ciphertext),

src/keys.rs

@@ -16,7 +16,6 @@ use windows::{
         BCRYPT_RSAPUBLIC_MAGIC, BCRYPT_RSA_ALG_HANDLE,
     },
 };
-use zeroize::Zeroizing;
 
 /// Wrapper for an owned key handle that can be sent between threads.
 #[derive(Debug)]
@@ -48,7 +47,7 @@ pub(crate) fn import_rsa_private_key(
         + prime1.len()
         + prime2.len();
 
-    let mut blob = Zeroizing::new(Vec::with_capacity(size));
+    let mut blob = Vec::with_capacity(size);
     unsafe {
         let p: *const BCRYPT_RSAKEY_BLOB = &header;
         let p: *const u8 = p.cast::<u8>();
@@ -68,7 +67,7 @@ pub(crate) fn import_rsa_private_key(
             None,
             BCRYPT_RSAPRIVATE_BLOB,
             &mut *key_handle,
-            blob.as_slice(),
+            &blob,
             0,
         )
         .ok()
@@ -147,14 +146,14 @@ fn import_ec_private_key(
         cbKey: key_len as u32,
     };
     let header_size = core::mem::size_of::<BCRYPT_ECCKEY_BLOB>();
-    let mut blob = Zeroizing::new(Vec::with_capacity(header_size + key_len * 3));
+    let mut blob = Vec::with_capacity(header_size + key_len * 3);
     unsafe {
         let p: *const BCRYPT_ECCKEY_BLOB = &header;
         let p: *const u8 = p.cast::<u8>();
         let slice = std::slice::from_raw_parts(p, header_size);
         blob.extend_from_slice(slice);
     }
-    blob.extend(std::iter::repeat_n(0, key_len * 2));
+    blob.extend_from_slice(&vec![0u8; key_len * 2]);
     blob.extend_from_slice(private_key);
     let mut key_handle = Owned::default();
     unsafe {
@@ -163,7 +162,7 @@ fn import_ec_private_key(
             None,
             BCRYPT_ECCPRIVATE_BLOB,
             &mut *key_handle,
-            blob.as_slice(),
+            &blob,
             0,
         )
         .ok()

src/tls12.rs

@@ -20,15 +20,6 @@ use rustls::{
 
 const GCM_EXPLICIT_NONCE_LENGTH: usize = 8;
 const GCM_IMPLICIT_NONCE_LENGTH: usize = 4;
-const MAX_TLS12_PLAINTEXT_FRAGMENT_LEN: usize = 16_384;
-
-fn reject_oversized_tls12_plaintext(plaintext_len: usize) -> Result<(), Error> {
-    if plaintext_len > MAX_TLS12_PLAINTEXT_FRAGMENT_LEN {
-        return Err(Error::PeerSentOversizedRecord);
-    }
-
-    Ok(())
-}
 
 static ECDSA_SCHEMES: &[SignatureScheme] = &[
     SignatureScheme::ECDSA_NISTP521_SHA512,
@@ -290,7 +281,6 @@ impl MessageDecrypter for AesGcmDecrypter {
             &aad,
             &mut payload.as_mut()[GCM_EXPLICIT_NONCE_LENGTH..],
         )?;
-        reject_oversized_tls12_plaintext(plaintext_len)?;
 
         // Remove the explicit nonce from the front of the buffer, as it's not part of the plaintext.
         payload.copy_within(
@@ -344,7 +334,6 @@ impl MessageDecrypter for ChaCha20Poly1305Crypter {
         tag.copy_from_slice(&payload[message_len..]);
 
         let plaintext_len = self.key.open(nonce.0, &aad, payload)?;
-        reject_oversized_tls12_plaintext(plaintext_len)?;
         payload.truncate(plaintext_len);
         Ok(msg.into_plain_message())
     }
@@ -358,20 +347,4 @@ mod tests {
     fn tls12_ecdsa_sign_schemes_do_not_advertise_ed25519() {
         assert!(!ECDSA_SCHEMES.contains(&SignatureScheme::ED25519));
     }
-
-    #[test]
-    fn aes_gcm_decrypter_rejects_oversized_plaintext() {
-        assert!(matches!(
-            reject_oversized_tls12_plaintext(MAX_TLS12_PLAINTEXT_FRAGMENT_LEN + 1),
-            Err(Error::PeerSentOversizedRecord)
-        ));
-    }
-
-    #[test]
-    fn chacha20_poly1305_decrypter_rejects_oversized_plaintext() {
-        assert!(matches!(
-            reject_oversized_tls12_plaintext(MAX_TLS12_PLAINTEXT_FRAGMENT_LEN + 1),
-            Err(Error::PeerSentOversizedRecord)
-        ));
-    }
 }

src/verify.rs

@@ -327,7 +327,10 @@ impl<const HASH_SIZE: usize> SignatureVerificationAlgorithm for VerificationAlgo
                                 BCRYPT_PAD_PSS,
                             )
                             .ok()
-                            .map_err(|_| InvalidSignature)
+                            .map_err(|e| {
+                                dbg!(e);
+                                InvalidSignature
+                            })
                         }
                     }
                 }