test(s2n-quic-tls): remove openssl dev dependency (#3161)

Author: WesleyRosenblum

examples/post-quantum/Cargo.toml

@@ -10,14 +10,6 @@ s2n-quic = { version = "1", path = "../../quic/s2n-quic" }
 # enable the post-quantum feature in s2n-tls
 s2n-tls = { version = "*", features = ["pq"] }
 tokio = { version = "1", features = ["full"] }
-# Build the vendored version to make it easy to test.
-#
-# For a production build, it's probably better to link to the system dependency instead
-# so you automatically get security patches.
-#
-# NOTE: The version of the `openssl-sys` crate is not the same as OpenSSL itself.
-#       Versions 1.0.1 - 3.0.0 are automatically discovered.
-openssl-sys = { version = "0.9", features = ["vendored"] }
 
 [workspace]
 members = ["."]

quic/s2n-quic-tls/Cargo.toml

@@ -29,19 +29,10 @@ s2n-tls = { version = "0.3.31", features = ["quic"] }
 [dev-dependencies]
 checkers = "0.7"
 pin-project = { version = "1" }
-openssl = { version = "0.10" }
-# Build the vendored version to make it easy to test in dev
-#
-# NOTE: The version of the `openssl-sys` crate is not the same as OpenSSL itself.
-#       Versions 1.0.1 - 3.0.0 are automatically discovered.
-openssl-sys = { version = "0.9", features = ["vendored"] }
+aws-lc-rs = "1.12"
 s2n-quic-core = { path = "../s2n-quic-core", features = ["testing"] }
 s2n-quic-rustls = { path = "../s2n-quic-rustls" }
 
-# we don't use openssl-sys directly; it's just here to pin and vendor in dev
-[package.metadata.cargo-udeps.ignore]
-development = [ "openssl-sys" ]
-
 [lints.rust.unexpected_cfgs]
 level = "warn"
 check-cfg = [

quic/s2n-quic-tls/src/tests.rs

@@ -2,17 +2,20 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::{certificate, client, server};
+use aws_lc_rs::{
+    digest::{self, Digest},
+    signature::{EcdsaKeyPair, ECDSA_P256_SHA256_ASN1_SIGNING},
+};
 use core::{
     sync::atomic::{AtomicBool, AtomicU8, Ordering},
     task::Poll,
 };
-use openssl::{ec::EcKey, ecdsa::EcdsaSig};
 use pin_project::pin_project;
 use s2n_quic_core::{
     crypto::tls::{
         self,
         testing::{
-            certificates::{CERT_PEM, KEY_PEM, UNTRUSTED_CERT_PEM, UNTRUSTED_KEY_PEM},
+            certificates::{CERT_PEM, KEY_DER, KEY_PEM, UNTRUSTED_CERT_PEM, UNTRUSTED_KEY_PEM},
             server_params,
         },
         ConnectionInfo, Endpoint,
@@ -146,12 +149,15 @@ impl ConnectionFuture for MyPrivateKeyFuture {
         let mut in_buf = vec![0; in_buf_size];
         op.input(&mut in_buf)?;
 
-        let key = EcKey::private_key_from_pem(KEY_PEM.as_bytes())
-            .expect("Failed to create EcKey from pem");
-        let sig = EcdsaSig::sign(&in_buf, &key).expect("Failed to sign input");
-        let out = sig.to_der().expect("Failed to convert signature to der");
+        let key = EcdsaKeyPair::from_pkcs8(&ECDSA_P256_SHA256_ASN1_SIGNING, KEY_DER)
+            .expect("Failed to create EcdsaKeyPair from pkcs8");
+        // s2n-tls hands us the already-computed digest, so import it and sign it
+        // directly rather than re-hashing the input.
+        let digest =
+            Digest::import_less_safe(&in_buf, &digest::SHA256).expect("Failed to import digest");
+        let sig = key.sign_digest(&digest).expect("Failed to sign input");
 
-        op.set_output(conn, &out)?;
+        op.set_output(conn, sig.as_ref())?;
         Poll::Ready(Ok(()))
     }
 }