Merge branch 'main' into grand_dispatch_queue

CMakeLists.txt

@@ -169,10 +169,21 @@ if (BYO_CRYPTO)
 endif()
 
 if (USE_S2N)
-    file(GLOB AWS_IO_TLS_SRC
-            "source/s2n/*.c"
-            )
-    aws_use_package(s2n)
+        file(GLOB AWS_IO_TLS_SRC
+                "source/s2n/*.c"
+                )
+        # Prefer find_package() because it's the normal CMake way to do dependencies.
+        # But fall back on aws_use_package() because some projects still need to do an IN_SOURCE_BUILD of S2N.
+        # (e.g. aws-crt-java until this is resolved: https://github.com/awslabs/aws-crt-java/pull/817)
+        find_package(s2n QUIET)
+
+        if (s2n_FOUND)
+            list(APPEND DEP_AWS_LIBS AWS::s2n)
+        else()
+            # Set flag to use in-source path to  <s2n/unstable/*.h> headers if we do an IN_SOURCE_BUILD.
+            aws_use_package(s2n)
+            add_definitions(-DAWS_S2N_INSOURCE_PATH)
+        endif()
 endif()
 
 file(GLOB IO_HEADERS

source/posix/socket.c

@@ -1220,7 +1220,8 @@ int aws_socket_set_options(struct aws_socket *socket, const struct aws_socket_op
 
     AWS_LOGF_DEBUG(
         AWS_LS_IO_SOCKET,
-        "id=%p fd=%d: setting socket options to: keep-alive %d, keep idle %d, keep-alive interval %d, keep-alive probe "
+        "id=%p fd=%d: setting socket options to: keep-alive %d, keep-alive timeout %d, keep-alive interval %d, "
+        "keep-alive probe "
         "count %d.",
         (void *)socket,
         socket->io_handle.data.fd,

source/s2n/s2n_tls_channel_handler.c

@@ -20,10 +20,16 @@
 #include <aws/common/task_scheduler.h>
 #include <aws/common/thread.h>
 
+#include <s2n.h>
+#ifdef AWS_S2N_INSOURCE_PATH
+#    include <api/unstable/cleanup.h>
+#else
+#    include <s2n/unstable/cleanup.h>
+#endif
+
 #include <errno.h>
 #include <inttypes.h>
 #include <math.h>
-#include <s2n.h>
 #include <stdio.h>
 #include <stdlib.h>
 
@@ -1247,7 +1253,7 @@ static struct aws_event_loop_local_object s_tl_cleanup_object = {
 static void s_aws_cleanup_s2n_thread_local_state(void *user_data) {
     (void)user_data;
 
-    s2n_cleanup();
+    s2n_cleanup_thread();
 }
 
 /* s2n allocates thread-local data structures. We need to clean these up when the event loop's thread exits. */

source/windows/windows_pki_utils.c

@@ -559,6 +559,7 @@ int aws_import_key_pair_to_cert_context(
 
     int result = AWS_OP_ERR;
     BYTE *key = NULL;
+    BYTE *key_wrapper = NULL;
 
     if (aws_pem_objects_init_from_file_contents(&certificates, alloc, *public_cert_chain)) {
         AWS_LOGF_ERROR(
@@ -640,6 +641,7 @@ int aws_import_key_pair_to_cert_context(
 
     struct aws_pem_object *private_key_ptr = NULL;
     DWORD decoded_len = 0;
+    DWORD decoded_wrapper_len = 0;
     enum aws_certificate_type cert_type = AWS_CT_X509_UNKNOWN;
     size_t private_key_count = aws_array_list_length(&private_keys);
     for (size_t i = 0; i < private_key_count; ++i) {
@@ -655,6 +657,27 @@ int aws_import_key_pair_to_cert_context(
                 &key,
                 &decoded_len)) {
             cert_type = AWS_CT_X509_RSA;
+        } else if (CryptDecodeObjectEx(
+                       X509_ASN_ENCODING,
+                       PKCS_PRIVATE_KEY_INFO,
+                       private_key_ptr->data.buffer,
+                       (DWORD)private_key_ptr->data.len,
+                       CRYPT_DECODE_ALLOC_FLAG,
+                       0,
+                       &key_wrapper,
+                       &decoded_wrapper_len)) {
+            CRYPT_PRIVATE_KEY_INFO *pPrivateKeyInfoStruct = (CRYPT_PRIVATE_KEY_INFO *)key_wrapper;
+            if (CryptDecodeObjectEx(
+                    X509_ASN_ENCODING,
+                    PKCS_RSA_PRIVATE_KEY,
+                    pPrivateKeyInfoStruct->PrivateKey.pbData,
+                    pPrivateKeyInfoStruct->PrivateKey.cbData,
+                    CRYPT_DECODE_ALLOC_FLAG,
+                    0,
+                    &key,
+                    &decoded_len)) {
+                cert_type = AWS_CT_X509_RSA;
+            }
         }
 #ifndef AWS_SUPPORT_WIN7
         else if (CryptDecodeObjectEx(
@@ -721,6 +744,7 @@ int aws_import_key_pair_to_cert_context(
     aws_pem_objects_clean_up(&private_keys);
 
     LocalFree(key);
+    LocalFree(key_wrapper);
 
     if (result == AWS_OP_ERR) {
         if (*store != NULL) {

tests/CMakeLists.txt

@@ -251,6 +251,7 @@ if(NOT BYO_CRYPTO)
     add_net_test_case(alpn_successfully_negotiates)
     add_net_test_case(alpn_no_protocol_message)
     add_net_test_case(test_ecc_cert_import)
+    add_net_test_case(test_pkcs8_import)
 
     add_test_case(alpn_error_creating_handler)
     add_test_case(tls_destroy_null_context)

tests/tls_handler_test.c

@@ -2503,4 +2503,40 @@ static int s_test_ecc_cert_import(struct aws_allocator *allocator, void *ctx) {
 
 AWS_TEST_CASE(test_ecc_cert_import, s_test_ecc_cert_import)
 
+static int s_test_pkcs8_import(struct aws_allocator *allocator, void *ctx) {
+    (void)ctx;
+    (void)allocator;
+
+    aws_io_library_init(allocator);
+
+    struct aws_byte_buf cert_buf;
+    struct aws_byte_buf key_buf;
+
+    ASSERT_SUCCESS(aws_byte_buf_init_from_file(&cert_buf, allocator, "unittests.crt"));
+    ASSERT_SUCCESS(aws_byte_buf_init_from_file(&key_buf, allocator, "unittests.p8"));
+
+    struct aws_byte_cursor cert_cur = aws_byte_cursor_from_buf(&cert_buf);
+    struct aws_byte_cursor key_cur = aws_byte_cursor_from_buf(&key_buf);
+    struct aws_tls_ctx_options tls_options = {0};
+    AWS_FATAL_ASSERT(
+        AWS_OP_SUCCESS == aws_tls_ctx_options_init_client_mtls(&tls_options, allocator, &cert_cur, &key_cur));
+
+    /* import happens in here */
+    struct aws_tls_ctx *tls_context = aws_tls_client_ctx_new(allocator, &tls_options);
+    ASSERT_NOT_NULL(tls_context);
+
+    aws_tls_ctx_release(tls_context);
+
+    aws_tls_ctx_options_clean_up(&tls_options);
+
+    aws_byte_buf_clean_up(&cert_buf);
+    aws_byte_buf_clean_up(&key_buf);
+
+    aws_io_library_clean_up();
+
+    return AWS_OP_SUCCESS;
+}
+
+AWS_TEST_CASE(test_pkcs8_import, s_test_pkcs8_import)
+
 #endif /* BYO_CRYPTO */