Test out HPKE update

.clippy.toml

@@ -1 +1 @@
-msrv = "1.83.0"
+msrv = "1.86.0"

.github/workflows/check.yml

@@ -23,7 +23,7 @@ jobs:
           - nss
           - rust-hpke
         rust:
-          - 1.83.0 # MSRV
+          - 1.86.0 # MSRV
           - stable
 
     steps:

Cargo.toml

@@ -19,6 +19,6 @@ keywords = ["ohttp", "http", "bhttp", "ietf"]
 categories = ["network-programming", "web-programming", "security"]
 readme = "README.md"
 version = "0.7.2"
-edition = "2021"
+edition = "2024"
 license = "MIT OR Apache-2.0"
-rust-version = "1.83.0"
+rust-version = "1.86.0"

bhttp/src/lib.rs

@@ -19,8 +19,8 @@ pub mod stream;
 pub use err::Error;
 use err::Res;
 #[cfg(feature = "http")]
-use parse::{downcase, is_ows, read_line, split_at, COLON, SEMICOLON, SLASH, SP};
-use parse::{index_of, trim_ows, COMMA};
+use parse::{COLON, SEMICOLON, SLASH, SP, downcase, is_ows, read_line, split_at};
+use parse::{COMMA, index_of, trim_ows};
 use rw::{read_varint, read_vec, write_len, write_varint, write_vec};
 
 #[cfg(feature = "http")]
@@ -452,11 +452,7 @@ impl ControlData {
     #[must_use]
     pub fn path(&self) -> Option<&[u8]> {
         if let Self::Request { path, .. } = self {
-            if path.is_empty() {
-                None
-            } else {
-                Some(path)
-            }
+            if path.is_empty() { None } else { Some(path) }
         } else {
             None
         }

bhttp/src/rw.rs

@@ -1,8 +1,8 @@
 use std::{borrow::BorrowMut, convert::TryFrom, io};
 
 use crate::{
-    err::{Error, Res},
     ReadSeek,
+    err::{Error, Res},
 };
 
 #[allow(clippy::cast_possible_truncation)]
@@ -98,7 +98,7 @@ mod test {
     use std::io::Cursor;
 
     use super::{read_varint, write_varint};
-    use crate::{rw::read_vec, Error};
+    use crate::{Error, rw::read_vec};
 
     #[test]
     fn basics() {

bhttp/src/stream/int.rs

@@ -1,6 +1,6 @@
 use std::{
     future::Future,
-    pin::{pin, Pin},
+    pin::{Pin, pin},
     task::{Context, Poll},
 };
 
@@ -82,7 +82,7 @@ impl<S: AsyncRead + Unpin> Future for ReadVarint<S> {
 
     fn poll(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Self::Output> {
         let this = self.as_mut();
-        if let Self::First(ref mut src) = this.get_mut() {
+        if let Self::First(src) = this.get_mut() {
             let mut buf = [0; 1];
             let src_ref = src.as_mut().unwrap();
             if let Poll::Ready(res) = pin!(src_ref).poll_read(cx, &mut buf[..]) {

bhttp/src/stream/mod.rs

@@ -5,16 +5,16 @@ use std::{
     cmp::min,
     io::{Cursor, Error as IoError, Result as IoResult},
     mem,
-    pin::{pin, Pin},
+    pin::{Pin, pin},
     task::{Context, Poll},
 };
 
-use futures::{stream::unfold, AsyncRead, Stream, TryStreamExt};
+use futures::{AsyncRead, Stream, TryStreamExt, stream::unfold};
 
 use crate::{
+    COOKIE, ControlData, Error, Field, FieldSection, Header, InformationalResponse, Message, Mode,
     err::Res,
     stream::{int::read_varint, vec::read_vec},
-    ControlData, Error, Field, FieldSection, Header, InformationalResponse, Message, Mode, COOKIE,
 };
 mod int;
 mod vec;
@@ -414,7 +414,7 @@ mod test {
     use futures::TryStreamExt;
     use sync_async::{Dribble, SyncRead, SyncResolve, SyncTryCollect};
 
-    use crate::{stream::AsyncReadMessage, Error, Message};
+    use crate::{Error, Message, stream::AsyncReadMessage};
 
     // Example from Section 5.1 of RFC 9292.
     const REQUEST1: &[u8] = &[

bhttp/src/stream/vec.rs

@@ -1,13 +1,13 @@
 use std::{
     future::Future,
     mem,
-    pin::{pin, Pin},
+    pin::{Pin, pin},
     task::{Context, Poll},
 };
 
-use futures::{io::AsyncRead, FutureExt};
+use futures::{FutureExt, io::AsyncRead};
 
-use super::int::{read_varint, ReadVarint};
+use super::int::{ReadVarint, read_varint};
 use crate::{Error, Res};
 
 /// A reader for a varint-length-prefixed buffer.
@@ -32,7 +32,7 @@ impl<S> ReadVec<S> {
     /// if this is called after the length is read.
     pub fn limit(&mut self, limit: u64) {
         usize::try_from(limit).expect("cannot set a limit larger than usize::MAX");
-        if let Self::ReadLen { ref mut cap, .. } = self {
+        if let Self::ReadLen { cap, .. } = self {
             *cap = limit;
         } else {
             panic!("cannot set a limit once the size has been read");
@@ -122,7 +122,7 @@ mod test {
     use futures::AsyncRead;
     use sync_async::SyncResolve;
 
-    use crate::{rw::write_varint as sync_write_varint, stream::vec::read_vec, Error};
+    use crate::{Error, rw::write_varint as sync_write_varint, stream::vec::read_vec};
 
     const FILL_VALUE: u8 = 90;
 

ohttp-client-cli/src/main.rs

@@ -3,7 +3,7 @@
 use std::io::{self, BufRead, Write};
 
 use bhttp::{Message, Mode};
-use ohttp::{init, ClientRequest};
+use ohttp::{ClientRequest, init};
 
 fn main() {
     init();

ohttp-server/src/main.rs

@@ -9,8 +9,8 @@ use std::{
 
 use bhttp::{Message, Mode, StatusCode};
 use ohttp::{
-    hpke::{Aead, Kdf, Kem},
     KeyConfig, Server as OhttpServer, SymmetricSuite,
+    hpke::{Aead, Kdf, Kem},
 };
 use structopt::StructOpt;
 use warp::Filter;

ohttp/Cargo.toml

@@ -25,19 +25,19 @@ stream = ["dep:futures", "dep:pin-project"]
 unsafe-print-secrets = []
 
 [dependencies]
-aead = {version = "0.5", optional = true, features = ["std"]}
-aes-gcm = {version = "0.10", optional = true}
+aead = {version = "0.6", optional = true, features = ["alloc"]}
+aes-gcm = {version = "0.11", optional = true}
 byteorder = "1.4"
-chacha20poly1305 = {version = "0.10", optional = true}
+chacha20poly1305 = {version = "0.11", optional = true}
 futures = {version = "0.3", optional = true}
 hex = "0.4"
-hkdf = {version = "0.12", optional = true}
-hpke = {version = "0.13", optional = true, default-features = false, features = ["std", "x25519", "p256"]}
+hkdf = {version = "0.13", optional = true}
+hpke = {version = "0.14", optional = true, default-features = false, features = ["getrandom", "x25519", "nistp", "mlkem", "aes", "chacha"]}
 log = {version = "0.4", default-features = false}
 pin-project = {version = "1.1", optional = true}
-rand = {version = "0.9", optional = true}
+rand = {version = "0.10", optional = true}
 regex = {version = "~1.11", optional = true}
-sha2 = {version = "0.10", optional = true}
+sha2 = {version = "0.11", optional = true}
 thiserror = "2"
 
 [build-dependencies]

ohttp/build.rs

@@ -54,8 +54,7 @@ mod nss {
     }
 
     fn is_debug() -> bool {
-        env::var("DEBUG")
-            .is_ok_and(|d| d.parse::<bool>().unwrap_or(false))
+        env::var("DEBUG").is_ok_and(|d| d.parse::<bool>().unwrap_or(false))
     }
 
     // bindgen needs access to libclang.
@@ -84,8 +83,12 @@ mod nss {
         };
         let libclang_dir = mozbuild_root.join("clang").join("lib");
         if libclang_dir.is_dir() {
-            env::set_var("LIBCLANG_PATH", libclang_dir.to_str().unwrap());
-            println!("rustc-env:LIBCLANG_PATH={}", libclang_dir.to_str().unwrap());
+            let libclang_dir = libclang_dir.to_str().unwrap();
+            unsafe {
+                // SAFETY: this is a single-threaded program
+                env::set_var("LIBCLANG_PATH", libclang_dir);
+            }
+            println!("rustc-env:LIBCLANG_PATH={libclang_dir}");
         } else {
             println!("warning: LIBCLANG_PATH isn't set; maybe run ./mach bootstrap with gecko");
         }
@@ -271,16 +274,13 @@ mod nss {
         builder = builder.clang_arg("-v");
 
         builder = builder.clang_arg("-DNO_NSPR_10_SUPPORT");
-        if env::consts::OS == "windows" {
-            builder = builder.clang_arg("-DWIN");
-        } else if env::consts::OS == "macos" {
-            builder = builder.clang_arg("-DDARWIN");
-        } else if env::consts::OS == "linux" {
-            builder = builder.clang_arg("-DLINUX");
-        } else if env::consts::OS == "android" {
-            builder = builder.clang_arg("-DLINUX");
-            builder = builder.clang_arg("-DANDROID");
-        }
+        builder = match env::consts::OS {
+            "windows" => builder.clang_arg("-DWIN"),
+            "macos" => builder.clang_arg("-DDARWIN"),
+            "linux" => builder.clang_arg("-DLINUX"),
+            "android" => builder.clang_arg("-DLINUX").clang_arg("-DANDROID"),
+            _ => builder,
+        };
         if bindings.cplusplus {
             builder = builder.clang_args(&["-x", "c++", "-std=c++11"]);
         }
@@ -399,8 +399,8 @@ mod nss {
     #[cfg(any(feature = "gecko", feature = "app-svc"))]
     fn setup_for_gecko() -> Vec<String> {
         use mozbuild::{
-            config::{BINDGEN_SYSTEM_FLAGS, NSPR_CFLAGS, NSS_CFLAGS},
             TOPOBJDIR,
+            config::{BINDGEN_SYSTEM_FLAGS, NSPR_CFLAGS, NSS_CFLAGS},
         };
 
         let fold_libs = mozbuild::config::MOZ_FOLD_LIBS;
@@ -489,7 +489,9 @@ mod nss {
                 "NSS_DIR path (obtained via `env`) does not exist: {}",
                 nss_dir.display()
             );
-            panic!("It looks like NSS is not built. Please run `libs/verify-[platform]-environment.sh` in application-services first!");
+            panic!(
+                "It looks like NSS is not built. Please run `libs/verify-[platform]-environment.sh` in application-services first!"
+            );
         }
 
         let lib_dir = nss_dir.join("lib");

ohttp/src/config.rs

@@ -7,17 +7,17 @@ use byteorder::{NetworkEndian, ReadBytesExt, WriteBytesExt};
 
 #[cfg(feature = "nss")]
 use crate::nss::{
-    hpke::{generate_key_pair, Config as HpkeConfig, HpkeR},
     PrivateKey, PublicKey,
+    hpke::{Config as HpkeConfig, HpkeR, generate_key_pair},
 };
 #[cfg(feature = "rust-hpke")]
 use crate::rh::hpke::{
-    derive_key_pair, generate_key_pair, Config as HpkeConfig, HpkeR, PrivateKey, PublicKey,
+    Config as HpkeConfig, HpkeR, PrivateKey, PublicKey, derive_key_pair, generate_key_pair,
 };
 use crate::{
+    KeyId,
     err::{Error, Res},
     hpke::{Aead as AeadId, Kdf, Kem},
-    KeyId,
 };
 
 /// A tuple of KDF and AEAD identifiers.
@@ -286,8 +286,9 @@ mod test {
     use std::iter::zip;
 
     use crate::{
+        Error, KeyConfig, KeyId, SymmetricSuite,
         hpke::{Aead, Kdf, Kem},
-        init, Error, KeyConfig, KeyId, SymmetricSuite,
+        init,
     };
 
     const KEY_ID: KeyId = 1;

ohttp/src/crypto.rs

@@ -1,4 +1,4 @@
-use crate::{err::Res, AeadId};
+use crate::{AeadId, err::Res};
 
 pub trait Decrypt {
     fn open(&mut self, aad: &[u8], ct: &[u8]) -> Res<Vec<u8>>;

ohttp/src/err.rs

@@ -49,4 +49,11 @@ impl From<std::num::TryFromIntError> for Error {
     }
 }
 
+// If this happens, it's a programming error in this crate.
+impl From<std::array::TryFromSliceError> for Error {
+    fn from(_v: std::array::TryFromSliceError) -> Self {
+        Self::Internal
+    }
+}
+
 pub type Res<T> = Result<T, Error>;

ohttp/src/hpke.rs

@@ -31,25 +31,28 @@ macro_rules! convert_enum {
 
 convert_enum! {
 pub enum Kem {
-    P256Sha256 = 16,      // DHKEM(P-256, HKDF-SHA256) = 0x0010
     X25519Sha256 = 32,    // DHKEM(X25519, HKDF-SHA256) = 0x0020
+    P256Sha256 = 16,      // DHKEM(P-256, HKDF-SHA256) = 0x0010
+    XWing = 0x647a,       // X-Wing (MLKEM768-X25519) = 0x647a
 }
 }
 
 impl Kem {
     #[must_use]
     pub fn n_enc(self) -> usize {
         match self {
-            Kem::P256Sha256 => 65,
-            Kem::X25519Sha256 => 32,
+            Self::X25519Sha256 => 32,
+            Self::P256Sha256 => 65,
+            Self::XWing => 1120,
         }
     }
 
     #[must_use]
     pub fn n_pk(self) -> usize {
         match self {
-            Kem::P256Sha256 => 65,
-            Kem::X25519Sha256 => 32,
+            Self::X25519Sha256 => 32,
+            Self::P256Sha256 => 65,
+            Self::XWing => 1216,
         }
     }
 }