Merge branch 'main' into codebuild_u24

Makefile

@@ -72,22 +72,6 @@ valgrind: bin
 pedantic_valgrind: bin
 	$(MAKE) -C tests pedantic_valgrind
 
-.PHONY : fuzz
-ifeq ($(shell uname),Linux)
-fuzz : fuzz-linux
-else
-fuzz : fuzz-osx
-endif
-
-.PHONY : fuzz-osx
-fuzz-osx :
-	@echo "\033[33;1mSKIPPED\033[0m Fuzzing is not supported on \"$$(uname -mprs)\" at this time."
-
-.PHONY : fuzz-linux
-fuzz-linux : export S2N_UNSAFE_FUZZING_MODE = 1
-fuzz-linux : bin
-	$(MAKE) -C tests fuzz
-
 .PHONY : coverage
 coverage: run-lcov run-genhtml
 

codebuild/bin/install_default_dependencies.sh

@@ -23,12 +23,6 @@ if [[ "$TESTS" == "fuzz" || "$TESTS" == "ALL" || "$LATEST_CLANG" == "true" ]]; t
     codebuild/bin/install_clang.sh "$(mktemp -d)" "$LATEST_CLANG_INSTALL_DIR" "$OS_NAME" > /dev/null ;
 fi
 
-# Download and Install LibFuzzer with latest clang
-if [[ "$TESTS" == "fuzz" || "$TESTS" == "ALL" ]]; then
-    mkdir -p "$LIBFUZZER_INSTALL_DIR" || true
-    PATH=$LATEST_CLANG_INSTALL_DIR/bin:$PATH codebuild/bin/install_libFuzzer.sh "$(mktemp -d)" "$LIBFUZZER_INSTALL_DIR" "$OS_NAME" ;
-fi
-
 # Download and Install Openssl 1.1.1
 if [[ ("$S2N_LIBCRYPTO" == "openssl-1.1.1") || ( "$TESTS" == "integrationv2" || "$TESTS" == "ALL" ) ]]; then
     if [[ ! -x "$OPENSSL_1_1_1_INSTALL_DIR/bin/openssl" ]]; then

codebuild/bin/s2n_codebuild.sh

@@ -127,8 +127,6 @@ if [[ "$TESTS" == "ALL" || "$TESTS" == "integrationv2" ]]; then run_integration_
 if [[ "$TESTS" == "ALL" || "$TESTS" == "crt" ]]; then ./codebuild/bin/build_aws_crt_cpp.sh $(mktemp -d) $(mktemp -d); fi
 if [[ "$TESTS" == "ALL" || "$TESTS" == "sharedandstatic" ]]; then ./codebuild/bin/test_install_shared_and_static.sh $(mktemp -d); fi
 if [[ "$TESTS" == "ALL" || "$TESTS" == "dynamicload" ]]; then ./codebuild/bin/test_dynamic_load.sh $(mktemp -d); fi
-# This can be removed after CI starts using buildspec_fuzz.yml
-if [[ "$TESTS" == "ALL" || "$TESTS" == "fuzz" ]]; then (make clean && make fuzz) ; fi
 if [[ "$TESTS" == "sawHMAC" ]] && [[ "$OS_NAME" == "linux" ]]; then make -C tests/saw/ tmp/verify_HMAC.log ; fi
 if [[ "$TESTS" == "sawDRBG" ]]; then make -C tests/saw tmp/verify_drbg.log ; fi
 if [[ "$TESTS" == "ALL" || "$TESTS" == "tls" ]]; then make -C tests/saw tmp/verify_handshake.log ; fi

crypto/s2n_libcrypto.h

@@ -17,6 +17,7 @@
 
 #include "utils/s2n_result.h"
 
+uint64_t s2n_libcrypto_awslc_api_version(void);
 S2N_RESULT s2n_libcrypto_validate_runtime(void);
 const char *s2n_libcrypto_get_version_name(void);
 bool s2n_libcrypto_supports_flag_no_check_time();

crypto/s2n_pq.c

@@ -33,3 +33,15 @@ bool s2n_pq_is_enabled()
 {
     return s2n_libcrypto_supports_evp_kem();
 }
+
+bool s2n_libcrypto_supports_mlkem()
+{
+    /* S2N_LIBCRYPTO_SUPPORTS_MLKEM will be auto-detected and #defined if
+     * ./tests/features/S2N_LIBCRYPTO_SUPPORTS_MLKEM.c successfully compiles
+     */
+#if defined(S2N_LIBCRYPTO_SUPPORTS_MLKEM)
+    return true;
+#else
+    return false;
+#endif
+}

crypto/s2n_pq.h

@@ -23,3 +23,4 @@
 
 bool s2n_pq_is_enabled(void);
 bool s2n_libcrypto_supports_evp_kem(void);
+bool s2n_libcrypto_supports_mlkem(void);

docs/usage-guide/topics/ch11-resumption.md

@@ -25,6 +25,8 @@ Servers should set the three caching callback functions: `s2n_config_set_cache_s
 
 Clients should call `s2n_connection_get_session()` to retrieve some serialized state about the session. Then `s2n_connection_set_session()` should be called with that saved state when attempting to resume a new connection.
 
+The `cache_delete_callback` is called when a connection encounters a fatal error. This allows a server to delete a potentially corrupted or faulty session from its cache. Because an unexpected end-of-stream is considered a fatal error, an application should ensure that it performs a graceful TLS shutdown when using session caching. For more information on how to close connections, see [Closing the Connection](./ch07-io.md#closing-the-connection).
+
 ## Session Resumption in TLS1.2 and TLS1.3
 
 In TLS1.2, session ticket messages are sent during the handshake and are automatically received as part of calling `s2n_negotiate()`. They will be available as soon as negotiation is complete.

lib/Makefile

@@ -20,10 +20,6 @@ all: libs2n.a libs2n.so libs2n.dylib
 
 include ../s2n.mk
 
-ifeq ($(FUZZ_COVERAGE), true)
-	FUZZCOV_FLAGS = -fprofile-instr-generate -fcoverage-mapping
-endif
-
 libs2n.a: ${OBJS}
 	$(AR) cru libs2n.a ${OBJS}
 	$(RANLIB) libs2n.a

s2n.mk

@@ -57,23 +57,6 @@ COVERAGE_CFLAGS = -fprofile-arcs -ftest-coverage
 COVERAGE_LDFLAGS = --coverage
 LDFLAGS = -z relro -z now -z noexecstack
 
-FUZZ_CFLAGS = -fsanitize-coverage=trace-pc-guard -fsanitize=address,undefined,leak
-
-# Define FUZZ_COVERAGE - to be used for generating coverage reports on fuzz tests
-#                !!! NOT COMPATIBLE WITH S2N_COVERAGE !!!
-ifeq ($(FUZZ_COVERAGE), true)
-	FUZZ_CFLAGS += -fprofile-instr-generate -fcoverage-mapping
-else
-	ifeq ($(S2N_COVERAGE), true)
-		DEFAULT_CFLAGS += ${COVERAGE_CFLAGS}
-		LIBS += ${COVERAGE_LDFLAGS}
-	endif
-endif
-
-ifdef FUZZ_TIMEOUT_SEC
-	DEFAULT_CFLAGS += -DS2N_FUZZ_TESTING=1
-endif
-
 # Add a flag to disable stack protector for alternative libcs without
 # libssp.
 ifneq ($(NO_STACK_PROTECTOR), 1)
@@ -134,27 +117,6 @@ endif
 
 LLVM_GCOV_MARKER_FILE=${COVERAGE_DIR}/use-llvm-gcov.tmp
 
-ifeq ($(S2N_UNSAFE_FUZZING_MODE),1)
-    # Override compiler to clang if fuzzing, since gcc does not support as many sanitizer flags as clang
-    CC=clang
-
-    # Create a marker file so that later invocations of make can pick the right COV_TOOL by default
-    $(shell touch "${LLVM_GCOV_MARKER_FILE}")
-
-    # Turn on debugging and fuzzing flags when S2N_UNSAFE_FUZZING_MODE is enabled to give detailed stack traces in case
-    # an error occurs while fuzzing.
-    CFLAGS += ${DEFAULT_CFLAGS} ${DEBUG_CFLAGS} ${FUZZ_CFLAGS}
-
-    # Filter out the visibility settings if we are fuzzing
-    CFLAGS := $(filter-out -fvisibility=hidden,$(CFLAGS))
-    CFLAGS := $(filter-out -DS2N_EXPORTS,$(CFLAGS))
-    DEFAULT_CFLAGS := $(filter-out -fvisibility=hidden,$(DEFAULT_CFLAGS))
-    DEFAULT_CFLAGS := $(filter-out -DS2N_EXPORTS,$(DEFAULT_CFLAGS))
-    CPPFLAGS := $(filter-out -fvisibility=hidden,$(CPPFLAGS))
-    CPPFLAGS := $(filter-out -DS2N_EXPORTS,$(CPPFLAGS))
-
-endif
-
 # Disable strict-prototypes check in clang
 ifneq '' '$(findstring clang,$(CC))'
 	CFLAGS += -Wno-strict-prototypes

tests/Makefile

@@ -43,11 +43,6 @@ libs:
 integrationv2:
 	${MAKE} -C integrationv2
 
-.PHONY : fuzz
-fuzz:
-	${MAKE} -C testlib
-	${MAKE} -C fuzz
-
 .PHONY : viz
 viz:
 	${MAKE} -C viz
@@ -59,7 +54,6 @@ clean: decruft
 	${MAKE} -C testlib decruft
 	${MAKE} -C LD_PRELOAD decruft
 	${MAKE} -C unit clean
-	${MAKE} -C fuzz clean
 	${MAKE} -C viz clean
 	${MAKE} -C saw decruft
 

tests/features/S2N_LIBCRYPTO_SUPPORTS_MLKEM.c

@@ -0,0 +1,31 @@
+/*
+* Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+*
+* Licensed under the Apache License, Version 2.0 (the "License").
+* You may not use this file except in compliance with the License.
+* A copy of the License is located at
+*
+*  http://aws.amazon.com/apache2.0
+*
+* or in the "license" file accompanying this file. This file is distributed
+* on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
+* express or implied. See the License for the specific language governing
+* permissions and limitations under the License.
+*/
+
+#include <openssl/evp.h>
+#include <openssl/nid.h>
+
+int main()
+{
+    EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_KEM, NULL);
+    if (ctx == NULL) {
+        return 1;
+    }
+    if (!EVP_PKEY_CTX_kem_set_params(ctx, NID_MLKEM768)) {
+        EVP_PKEY_CTX_free(ctx);
+        return 1;
+    }
+    EVP_PKEY_CTX_free(ctx);
+    return 0;
+}