[DRAFT] Universal bindings

aws-lc-rs/Cargo.toml

@@ -47,7 +47,7 @@ fips = ["dep:aws-lc-fips-sys"]
 
 [dependencies]
 untrusted = { workspace = true, optional = true }
-aws-lc-sys = { version = "0.31.0", path = "../aws-lc-sys", optional = true }
+aws-lc-sys = { version = "0.31.0", path = "../aws-lc-sys", default-features = false, optional = true }
 aws-lc-fips-sys = { version = "0.13.1", path = "../aws-lc-fips-sys", optional = true }
 zeroize.workspace = true
 

aws-lc-sys/Cargo.toml

@@ -58,9 +58,11 @@ build = "builder/main.rs"
 
 [features]
 asan = []
-ssl = ['bindgen']
+ssl = ['bindgen', 'all-bindings']
 bindgen = ["dep:bindgen"] # Generate the bindings on the targeted platform as a fallback mechanism.
 prebuilt-nasm = []
+all-bindings = []
+default = ['all-bindings']
 
 [build-dependencies]
 cmake.workspace = true

aws-lc-sys/builder/sys_bindgen.rs

@@ -1,7 +1,7 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0 OR ISC
 
-use crate::{get_rust_include_path, BindingOptions, COPYRIGHT, PRELUDE};
+use crate::{emit_warning, get_rust_include_path, BindingOptions, COPYRIGHT, PRELUDE};
 use bindgen::callbacks::{ItemInfo, ParseCallbacks};
 use std::fmt::Debug;
 use std::path::Path;
@@ -31,6 +31,48 @@ impl ParseCallbacks for StripPrefixCallback {
     }
 }
 
+const ALLOWED_HEADERS: [&str; 29] = [
+    "aes.h",
+    "aead.h",
+    "base.h",
+    "bn.h",
+    "boringssl_prefix_symbols.h",
+    "boringssl_prefix_symbols_asm.h",
+    "boringssl_prefix_symbols_nasm.inc",
+    "bytestring.h",
+    "chacha.h",
+    "cipher.h",
+    "crypto.h",
+    "curve25519.h",
+    "digest.h",
+    "ec.h",
+    "ec_key.h",
+    "ecdh.h",
+    "ecdsa.h",
+    "err.h",
+    "evp.h",
+    "hkdf.h",
+    "hmac.h",
+    "is_awslc.h",
+    "kdf.h",
+    "mem.h",
+    "nid.h",
+    "poly1305.h",
+    "rand.h",
+    "rsa.h",
+    "sha.h",
+];
+
+const BLOCKED_FUNCTIONS: [&str; 5] = [
+    "BN_print_fp",
+    "CBS_parse_generalized_time",
+    "CBS_parse_utc_time",
+    "ERR_print_errors_fp",
+    "RSA_print_fp",
+];
+
+const BLOCKED_TYPES: [&str; 4] = ["FILE", "fpos_t", "tm", "__sFILE"];
+
 fn prepare_bindings_builder(manifest_dir: &Path, options: &BindingOptions) -> bindgen::Builder {
     let clang_args = crate::prepare_clang_args(manifest_dir, options);
 
@@ -39,7 +81,6 @@ fn prepare_bindings_builder(manifest_dir: &Path, options: &BindingOptions) -> bi
         .derive_debug(true)
         .derive_default(true)
         .derive_eq(true)
-        .allowlist_file(r".*(/|\\)openssl((/|\\)[^/\\]+)+\.h")
         .allowlist_file(r".*(/|\\)rust_wrapper\.h")
         .rustified_enum(r"point_conversion_form_t")
         .rust_target(bindgen::RustTarget::stable(70, 0).unwrap())
@@ -59,6 +100,23 @@ fn prepare_bindings_builder(manifest_dir: &Path, options: &BindingOptions) -> bi
                 .to_string(),
         );
 
+    if cfg!(feature = "all-bindings") {
+        builder = builder.allowlist_file(r".*(/|\\)openssl((/|\\)[^/\\]+)+\.h");
+    } else {
+        for header in ALLOWED_HEADERS {
+            emit_warning(format!("Allowed header: {header}").as_str());
+            builder = builder.allowlist_file(format!("{}{}", r".*(/|\\)openssl(/|\\)", header));
+        }
+        for function in BLOCKED_FUNCTIONS {
+            emit_warning(format!("Blocked function: {function}").as_str());
+            builder = builder.blocklist_function(function);
+        }
+        for tipe in BLOCKED_TYPES {
+            emit_warning(format!("Opaque type: {tipe}").as_str());
+            builder = builder.blocklist_type(tipe);
+        }
+    }
+
     if !options.disable_prelude {
         builder = builder.raw_line(PRELUDE);
     }

aws-lc-sys/src/lib.rs

@@ -4,8 +4,6 @@
 #![cfg_attr(not(clippy), allow(unexpected_cfgs))]
 #![cfg_attr(not(clippy), allow(unknown_lints))]
 
-use std::os::raw::{c_char, c_long, c_void};
-
 #[allow(unused_macros)]
 macro_rules! use_bindings {
     ($bindings:ident) => {
@@ -14,11 +12,24 @@ macro_rules! use_bindings {
     };
 }
 
+#[cfg(not(any(feature = "ssl", feature = "all-bindings", use_bindgen_generated)))]
+use_bindings!(universal);
+
 macro_rules! platform_binding {
     ($platform:ident, $platform_crypto:ident, $platform_ssl:ident) => {
-        #[cfg(all($platform, not(feature = "ssl"), not(use_bindgen_generated)))]
+        #[cfg(all(
+            $platform,
+            feature = "all-bindings",
+            not(feature = "ssl"),
+            not(use_bindgen_generated)
+        ))]
         use_bindings!($platform_crypto);
-        #[cfg(all($platform, feature = "ssl", not(use_bindgen_generated)))]
+        #[cfg(all(
+            $platform,
+            feature = "all-bindings",
+            not(feature = "ssl"),
+            not(use_bindgen_generated)
+        ))]
         use_bindings!($platform_ssl);
     };
 }
@@ -138,6 +149,10 @@ pub fn ERR_GET_FUNC(packed_error: u32) -> i32 {
     unsafe { ERR_GET_FUNC_RUST(packed_error) }
 }
 
+#[cfg(feature = "all-bindings")]
+use std::os::raw::{c_char, c_long, c_void};
+
+#[cfg(feature = "all-bindings")]
 #[allow(non_snake_case, clippy::not_unsafe_ptr_arg_deref)]
 pub fn BIO_get_mem_data(b: *mut BIO, pp: *mut *mut c_char) -> c_long {
     unsafe { BIO_ctrl(b, BIO_CTRL_INFO, 0, pp.cast::<c_void>()) }