feat(s2n-quic-tls, s2n-quic-rustls): pass fips flag to tls backend (#…

…2209)

.github/workflows/ci.yml

@@ -284,9 +284,13 @@ jobs:
 
       - uses: camshaft/rust-cache@v1
 
-      - name: Run test
+      - name: Run test (rustls)
         run: |
-          cargo test --features provider-tls-fips
+          cargo test --no-default-features --features "provider-tls-fips provider-tls-rustls"
+
+      - name: Run test (s2n-tls)
+        run: |
+          cargo test --no-default-features --features "provider-tls-fips provider-tls-s2n"
 
   miri:
     # miri needs quite a bit of memory so use a larger instance

quic/s2n-quic-rustls/Cargo.toml

@@ -10,6 +10,9 @@ license = "Apache-2.0"
 # Exclude corpus files when publishing to crates.io
 exclude = ["corpus.tar.gz"]
 
+[features]
+fips = ["s2n-quic-crypto/fips", "rustls/fips"]
+
 [dependencies]
 bytes = { version = "1", default-features = false }
 # By [default](https://docs.rs/crate/rustls/latest/features) rustls includes the `tls12` feature.

quic/s2n-quic-rustls/src/cipher_suite.rs

@@ -11,9 +11,13 @@ use s2n_quic_core::crypto::{self, packet_protection, scatter, tls, HeaderProtect
 /// `aws_lc_rs` is the default crypto provider since that is also the
 /// default used by rustls.
 pub(crate) fn default_crypto_provider() -> Result<CryptoProvider, rustls::Error> {
+    let crypto = aws_lc_rs::default_provider();
+    #[cfg(feature = "fips")]
+    assert!(crypto.fips());
+
     Ok(CryptoProvider {
         cipher_suites: DEFAULT_CIPHERSUITES.to_vec(),
-        ..aws_lc_rs::default_provider()
+        ..crypto
     })
 }
 

quic/s2n-quic-tls/Cargo.toml

@@ -11,7 +11,7 @@ license = "Apache-2.0"
 exclude = ["corpus.tar.gz"]
 
 [features]
-fips = ["s2n-quic-crypto/fips"]
+fips = ["s2n-quic-crypto/fips", "s2n-tls/fips"]
 unstable_client_hello = []
 unstable_private_key = []
 

quic/s2n-quic-tls/src/client.rs

@@ -186,6 +186,9 @@ impl Builder {
     }
 
     pub fn build(self) -> Result<Client, Error> {
+        #[cfg(feature = "fips")]
+        assert!(s2n_tls::init::fips_mode()?.is_enabled());
+
         Ok(Client {
             loader: self.config.build()?,
             keylog: self.keylog,

quic/s2n-quic-tls/src/server.rs

@@ -219,6 +219,9 @@ impl Builder {
     }
 
     pub fn build(self) -> Result<Server, Error> {
+        #[cfg(feature = "fips")]
+        assert!(s2n_tls::init::fips_mode()?.is_enabled());
+
         Ok(Server {
             loader: self.config.build()?,
             keylog: self.keylog,

quic/s2n-quic/Cargo.toml

@@ -18,6 +18,7 @@ default = [
 provider-tls-fips = [
     "s2n-quic-tls-default?/fips",
     "s2n-quic-tls?/fips",
+    "s2n-quic-rustls?/fips",
 ]
 provider-address-token-default = [
     "cuckoofilter",