Adding no_std support

boringtun-cli/src/main.rs

@@ -128,7 +128,7 @@ fn main() {
         let log = matches.get_one::<String>("log").unwrap();
 
         let log_file =
-            File::create(log).unwrap_or_else(|_| panic!("Could not create log file {}", log));
+            File::create(log).unwrap_or_else(|_| panic!("Could not create log file {log}"));
 
         let (non_blocking, guard) = tracing_appender::non_blocking(log_file);
 

boringtun/Cargo.toml

@@ -14,52 +14,67 @@ documentation = "https://docs.rs/boringtun/0.7.1/boringtun/"
 edition = "2018"
 
 [features]
-default = []
-device = ["socket2", "thiserror"]
-jni-bindings = ["ffi-bindings", "jni"]
-ffi-bindings = ["tracing-subscriber"]
-# mocks std::time::Instant with mock_instant
-mock-instant = ["mock_instant"]
+default = ["std"]
+alloc = []
+std = ["dep:nix", "dep:parking_lot", "dep:winsafe", "alloc", "once_cell/std"]
+device = ["std", "socket2", "thiserror"]
+jni-bindings = ["std", "ffi-bindings", "jni"]
+ffi-bindings = ["std", "tracing-subscriber"]
+defmt = ["dep:defmt", "fugit/defmt"]
 
 [dependencies]
-base64 = "0.22"
-hex = "0.4"
+base64 = { version = "0.23.0", default-features = false }
+hex = { version = "0.4", default-features = false }
 untrusted = "0.9.0"
-libc = "0.2"
-parking_lot = "0.12"
+libc = { version = "0.2", default-features = false }
+parking_lot = { version = "0.12.4", optional = true }
+lock_api = "0.4.13"
+spin = { version = "0.12.2" }
+once_cell = { version = "1.19.0", default-features = false, features = [
+  "critical-section",
+] }
 portable-atomic = { version = "1.13.1", features = ["fallback"] }
-tracing = "0.1.40"
+tracing = { version = "0.1.40", default-features = false }
 tracing-subscriber = { version = "0.3", features = ["fmt"], optional = true }
-ip_network = "0.4.1"
-ip_network_table = "0.2.0"
-ring = "0.17"
-x25519-dalek = { version = "2.0.1", features = [
-    "reusable_secrets",
-    "static_secrets",
+ip_network = { version = "0.4.1", default-features = false }
+ip_network_table = { version = "0.2.0", default-features = false }
+ring = { version = "0.17.14", default-features = false }
+x25519-dalek = { version = "3.0.0", features = [
+  "getrandom",
+  "reusable_secrets",
+  "static_secrets",
 ] }
-rand_core = { version = "0.6.4", features = ["getrandom"] }
-chacha20poly1305 = "0.10.0-pre.1"
-aead = "0.5.0-pre.2"
-blake2 = "0.10"
-hmac = "0.12"
+rand = { version = "0.10.1", default-features = false, features = ["sys_rng"] }
+chacha20poly1305 = { version = "0.11.0", default-features = false }
+aead = "0.6.0-rc.2"
+blake2 = { version = "0.11.0-rc.6", default-features = false }
+hmac = "0.13.0"
 jni = { version = "0.19.0", optional = true }
-mock_instant = { version = "0.3", optional = true }
 socket2 = { version = "0.4.7", features = ["all"], optional = true }
 thiserror = { version = "2", optional = true }
+fugit = { version = "0.5", default-features = false }
+defmt = { version = "1.1.1", optional = true, features = ["ip_in_core"] }
 
 [target.'cfg(unix)'.dependencies]
-nix = { version = "0.31", default-features = false, features = [
+nix = { version = "0.31", optional = true, default-features = false, features = [
     "time",
     "user",
 ] }
 
+[target.'cfg(windows)'.dependencies]
+winsafe = { version = "0.0.28", optional = true, default-features = false, features = [
+  "kernel",
+] }
+
 [dev-dependencies]
+base64 = { version = "0.23.0", default-features = false, features = ["alloc"] }
 etherparse = "0.13"
+hex = { version = "0.4", default-features = false, features = ["alloc"] }
 tracing-subscriber = "0.3"
 criterion = { version = "0.8.2", features = ["html_reports"] }
 
 [lib]
-crate-type = ["staticlib", "cdylib", "rlib"]
+crate-type = ["rlib"]
 
 [[bench]]
 name = "crypto_benches"

boringtun/benches/crypto_benches/blake2s_benching.rs

@@ -1,3 +1,4 @@
+use blake2::digest::consts::U16;
 use blake2::digest::{FixedOutput, KeyInit};
 use blake2::{Blake2s256, Blake2sMac, Digest};
 use criterion::{BenchmarkId, Criterion, Throughput};
@@ -77,7 +78,7 @@ pub fn bench_blake2s_keyed(c: &mut Criterion) {
                     key
                 },
                 |key| -> [u8; 16] {
-                    let mut hmac = Blake2sMac::new_from_slice(&key).unwrap();
+                    let mut hmac = Blake2sMac::<U16>::new_from_slice(&key).unwrap();
                     blake2::digest::Update::update(&mut hmac, &buf_in);
                     hmac.finalize_fixed().into()
                 },

boringtun/benches/crypto_benches/chacha20poly1305_benching.rs

@@ -1,6 +1,7 @@
-use aead::{AeadInPlace, KeyInit};
+use aead::inout::InOutBuf;
+use aead::{AeadInOut, KeyInit};
 use criterion::{BenchmarkId, Criterion, Throughput};
-use rand_core::{OsRng, RngCore};
+use rand::{rngs::SysRng, TryRng};
 use ring::aead::{Aad, LessSafeKey, Nonce, UnboundKey, CHACHA20_POLY1305};
 
 fn chacha20poly1305_ring(key_bytes: &[u8], buf: &mut [u8]) {
@@ -28,7 +29,7 @@ fn chacha20poly1305_non_ring(key_bytes: &[u8], buf: &mut [u8]) {
     let nonce = chacha20poly1305::Nonce::default();
 
     let tag = aead
-        .encrypt_in_place_detached(&nonce, &[], &mut buf[..n])
+        .encrypt_inout_detached(&nonce, &[], InOutBuf::from(&mut buf[..n]))
         .unwrap();
 
     buf[n..].copy_from_slice(tag.as_ref());
@@ -49,10 +50,10 @@ pub fn bench_chacha20poly1305(c: &mut Criterion) {
                 let mut key = [0; 32];
                 let mut buf = vec![0; i + 16];
 
-                let mut rng = OsRng::default();
+                let mut rng = SysRng::default();
 
-                rng.fill_bytes(&mut key);
-                rng.fill_bytes(&mut buf);
+                rng.try_fill_bytes(&mut key).unwrap();
+                rng.try_fill_bytes(&mut buf).unwrap();
 
                 b.iter(|| chacha20poly1305_ring(&key, &mut buf));
             },
@@ -65,10 +66,10 @@ pub fn bench_chacha20poly1305(c: &mut Criterion) {
                 let mut key = [0; 32];
                 let mut buf = vec![0; i + 16];
 
-                let mut rng = OsRng::default();
+                let mut rng = SysRng::default();
 
-                rng.fill_bytes(&mut key);
-                rng.fill_bytes(&mut buf);
+                rng.try_fill_bytes(&mut key).unwrap();
+                rng.try_fill_bytes(&mut buf).unwrap();
 
                 b.iter(|| chacha20poly1305_non_ring(&key, &mut buf));
             },

boringtun/benches/crypto_benches/x25519_public_key_benching.rs

@@ -1,5 +1,4 @@
 use criterion::Criterion;
-use rand_core::OsRng;
 
 pub fn bench_x25519_public_key(c: &mut Criterion) {
     let mut group = c.benchmark_group("x25519_public_key");
@@ -8,7 +7,7 @@ pub fn bench_x25519_public_key(c: &mut Criterion) {
 
     group.bench_function("x25519_public_key_dalek", |b| {
         b.iter(|| {
-            let secret_key = x25519_dalek::StaticSecret::random_from_rng(OsRng);
+            let secret_key = x25519_dalek::StaticSecret::random();
             let public_key = x25519_dalek::PublicKey::from(&secret_key);
 
             (secret_key, public_key)

boringtun/benches/crypto_benches/x25519_shared_key_benching.rs

@@ -1,17 +1,15 @@
 use criterion::{BatchSize, Criterion};
-use rand_core::OsRng;
 
 pub fn bench_x25519_shared_key(c: &mut Criterion) {
     let mut group = c.benchmark_group("x25519_shared_key");
 
     group.sample_size(1000);
 
     group.bench_function("x25519_shared_key_dalek", |b| {
-        let public_key =
-            x25519_dalek::PublicKey::from(&x25519_dalek::StaticSecret::random_from_rng(OsRng));
+        let public_key = x25519_dalek::PublicKey::from(&x25519_dalek::StaticSecret::random());
 
         b.iter_batched(
-            || x25519_dalek::StaticSecret::random_from_rng(OsRng),
+            || x25519_dalek::StaticSecret::random(),
             |secret_key| secret_key.diffie_hellman(&public_key),
             BatchSize::SmallInput,
         );

boringtun/src/device/api.rs

@@ -6,8 +6,9 @@ use super::drop_privileges::get_saved_ids;
 use super::{AllowedIP, Device, Error, SocketAddr};
 use crate::device::Action;
 use crate::serialization::KeyBytes;
+use crate::sleepyinstant::ClockDuration;
 use crate::x25519;
-use hex::encode as encode_hex;
+use hex::encode_to_slice as encode_hex;
 use libc::*;
 use std::fs::{create_dir, remove_file};
 use std::io::{BufRead, BufReader, BufWriter, Write};
@@ -69,7 +70,7 @@ impl Device {
                         _ => EIO,
                     };
                     // The protocol requires to return an error code as the response, or zero on success
-                    writeln!(writer, "errno={}\n", status).ok();
+                    writeln!(writer, "errno={status}\n").ok();
                 }
                 Action::Continue // Indicates the worker thread should continue as normal
             }),
@@ -99,7 +100,7 @@ impl Device {
                         _ => EIO,
                     };
                     // The protocol requires to return an error code as the response, or zero on success
-                    writeln!(writer, "errno={}\n", status).ok();
+                    writeln!(writer, "errno={status}\n").ok();
                 } else {
                     // The remote side is likely closed; we should trigger an exit.
                     d.trigger_exit();
@@ -157,46 +158,61 @@ impl Device {
 fn api_get(writer: &mut BufWriter<&UnixStream>, d: &Device) -> i32 {
     // get command requires an empty line, but there is no reason to be religious about it
     if let Some(ref k) = d.key_pair {
-        writeln!(writer, "own_public_key={}", encode_hex(k.1.as_bytes()));
+        let mut output = [0u8; 64];
+        encode_hex(k.1.as_bytes(), &mut output);
+        let hex_string = ::core::str::from_utf8(&output).unwrap();
+        writeln!(writer, "own_public_key={}", hex_string);
     }
 
     if d.listen_port != 0 {
         writeln!(writer, "listen_port={}", d.listen_port);
     }
 
     if let Some(fwmark) = d.fwmark {
-        writeln!(writer, "fwmark={}", fwmark);
+        writeln!(writer, "fwmark={fwmark}");
     }
 
     for (k, p) in d.peers.iter() {
         let p = p.lock();
-        writeln!(writer, "public_key={}", encode_hex(k.as_bytes()));
+
+        let mut output = [0u8; 64];
+        encode_hex(k.as_bytes(), &mut output);
+        let hex_string = ::core::str::from_utf8(&output).unwrap();
+        writeln!(writer, "public_key={}", hex_string);
 
         if let Some(ref key) = p.preshared_key() {
-            writeln!(writer, "preshared_key={}", encode_hex(key));
+            let mut output = [0u8; 64];
+            encode_hex(*key, &mut output);
+            let hex_string = ::core::str::from_utf8(&output).unwrap();
+            writeln!(writer, "preshared_key={}", hex_string);
         }
 
         if let Some(keepalive) = p.persistent_keepalive() {
-            writeln!(writer, "persistent_keepalive_interval={}", keepalive);
+            writeln!(writer, "persistent_keepalive_interval={keepalive}");
         }
 
         if let Some(ref addr) = p.endpoint().addr {
-            writeln!(writer, "endpoint={}", addr);
+            writeln!(writer, "endpoint={addr}");
         }
 
         for (ip, cidr) in p.allowed_ips() {
-            writeln!(writer, "allowed_ip={}/{}", ip, cidr);
+            writeln!(writer, "allowed_ip={ip}/{cidr}");
         }
 
         if let Some(time) = p.time_since_last_handshake() {
+            let whole_secs = ClockDuration::from_secs(time.as_secs());
             writeln!(writer, "last_handshake_time_sec={}", time.as_secs());
-            writeln!(writer, "last_handshake_time_nsec={}", time.subsec_nanos());
+            writeln!(
+                writer,
+                "last_handshake_time_nsec={}",
+                (time - whole_secs).as_nanos()
+            );
         }
 
         let (_, tx_bytes, rx_bytes, ..) = p.tunnel.stats();
 
-        writeln!(writer, "rx_bytes={}", rx_bytes);
-        writeln!(writer, "tx_bytes={}", tx_bytes);
+        writeln!(writer, "rx_bytes={rx_bytes}");
+        writeln!(writer, "tx_bytes={tx_bytes}");
     }
     0
 }
@@ -260,7 +276,7 @@ fn api_set(reader: &mut BufReader<&UnixStream>, d: &mut LockReadGuard<Device>) -
                                     reader,
                                     device,
                                     x25519::PublicKey::from(key_bytes.0),
-                                )
+                                );
                             }
                             Err(_) => return EINVAL,
                         },

boringtun/src/device/dev_lock.rs

@@ -26,7 +26,7 @@ impl<T> Lock<T> {
 impl<T: ?Sized> Lock<T> {
     /// Acquire a read lock
     pub fn read(&self) -> LockReadGuard<T> {
-        let (ref lock, ref cvar) = &self.wants_write;
+        let (lock, cvar) = &self.wants_write;
         let mut wants_write = lock.lock();
         while *wants_write {
             // We have a writer and we want to wait for it to go away
@@ -64,7 +64,7 @@ impl<'a, T: ?Sized> LockReadGuard<'a, T> {
     ) -> Option<U> {
         // First tell everyone that we want to write now, this will prevent any new reader from starting until we are done.
         {
-            let &(ref lock, cvar) = &self.wants_write;
+            let &(lock, cvar) = &self.wants_write;
             let mut wants_write = lock.lock();
 
             RwLockReadGuard::unlocked(&mut self.inner, move || {
@@ -90,7 +90,7 @@ impl<'a, T: ?Sized> LockReadGuard<'a, T> {
         }));
 
         // Finally signal other threads
-        let (ref lock, ref cvar) = &self.wants_write;
+        let (lock, cvar) = &self.wants_write;
         let mut wants_write = lock.lock();
         *wants_write = false;
         cvar.notify_all();

boringtun/src/device/epoll.rs

@@ -301,7 +301,7 @@ impl<H: Sync + Send> EventPoll<H> {
         unsafe {
             write(
                 notification_event.trigger,
-                &(std::u64::MAX - 1).to_ne_bytes()[0] as *const u8 as _,
+                &(u64::MAX - 1).to_ne_bytes()[0] as *const u8 as _,
                 8,
             )
         };